Function at 0x18009eea0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor r14d, r14d
mov qword [rsp + 0x70], rcx
mov ebx, r14d
lea rdx, str.Path
mov dword [rbp - 0x60], ebx
lea rcx, [rsp + 0x50]
movdqa xmm0, xmmword [0x180115d60]
lea r8d, [r14 + 4]
mov qword [rsp + 0x50], r14
movdqu xmmword [rsp + 0x60], xmm0
call fcn.1800bfba0
movdqa xmm0, xmmword [0x180115d60]
lea r8d, [r14 + 0x3f]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
call fcn.1800bfba0
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x400
call fcn.1800d0180
cmp qword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x30]
lea r8, [rbp - 0x68]
mov dword [rbp - 0x60], 0x400
cmovae rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18009ef94
cmp qword [rsp + 0x68], 0x10
lea rax, [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
lea rdx, [rsp + 0x50]
cmovae rdx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x58], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 0xf
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x18009efc0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.1800bfba0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18009f013
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f00e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f777
call fcn.1800cd2cc
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x180115d60]
mov byte [rsp + 0x30], bl
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 0x10
jb 0x18009f062
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f05d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f777
call fcn.1800cd2cc
mov qword [rsp + 0x538], rsi
mov qword [rsp + 0x540], rdi
mov rdi, qword [rbp - 0x48]
test rdi, rdi
je 0x18009f0fa
lea rcx, [rdi - 1]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
cmp rdi, rcx
jb 0x18009f77d
sub rdi, rcx
lea rdx, [rbp - 0x58]
mov ebx, 1
cmp rdi, rbx
mov r8d, ebx
cmovb r8, rdi
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
add rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1800bfba0
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x40], rbx
jne 0x18009f0f4
cmp byte [rax], 0x5c
jne 0x18009f0f4
mov rdi, qword [rbp - 0x48]
movzx esi, bl
jmp 0x18009f107
mov rdi, qword [rbp - 0x48]
jmp 0x18009f104
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
xor sil, sil
mov qword [rsp + 0x548], r12
mov qword [rsp + 0x508], r13
mov qword [rsp + 0x500], r15
movaps xmmword [rsp + 0x4f0], xmm6
movaps xmmword [rsp + 0x4e0], xmm7
test bl, 1
je 0x18009f167
cmp rdx, 0x10
jb 0x18009f167
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f162
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f771
call fcn.1800cd2cc
test sil, sil
je 0x18009f1f7
lea r8, [rdi - 1]
mov qword [rsp + 0x50], r14
cmp rdi, r8
mov qword [rsp + 0x60], r14
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x68], 0xf
cmovb r8, rdi
lea rcx, [rsp + 0x50]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
call fcn.1800bfba0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18009f1e1
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f1dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f771
call fcn.1800cd2cc
movups xmm1, xmmword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x48], xmm1
mov rdi, qword [rbp - 0x48]
movups xmmword [rbp - 0x58], xmm0
mov r13, qword [rbp - 0x40]
lea rsi, [rbp - 0x58]
mov r15, qword [rbp - 0x58]
cmp r13, 0x10
movabs rax, 0x7fffffffffffffff
cmovae rsi, r15
cmp rdi, 0x10
jae 0x18009f23b
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x40], rdi
lea r14, [rsp + 0x30]
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x18009f2c4
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18009f282
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009f783
mov rcx, rax
call fcn.1800cd2d4
test rax, rax
je 0x18009f789
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18009f28f
test rcx, rcx
je 0x18009f28f
call fcn.1800cd2d4
mov r14, rax
lea r8, [rdi + 1]
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov rcx, r14
call fcn.1800d03a0
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
cmp rbx, 0x10
jb 0x18009f2c1
lea rbx, [r14 + rdi]
mov rsi, r14
jmp 0x18009f2d1
mov r14, rcx
lea rbx, [rsp + 0x30]
add rbx, rdi
lea rsi, [rsp + 0x30]
cmp rsi, rbx
je 0x18009f2f4
sub r14, rsi
nop dword [rax]
movzx ecx, byte [rsi]
call fcn.1800d9390
mov byte [rsi + r14], al
inc rsi
cmp rsi, rbx
jne 0x18009f2e0
movups xmm0, xmmword [rsp + 0x30]
lea r12, [0x1801296d8]
movups xmm1, xmmword [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
call fcn.1800bf440
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18008c5f0
test eax, eax
jg 0x18009f693
cmp r13, 0x10
lea rsi, [rbp - 0x58]
cmovae rsi, r15
cmp rdi, 0x10
jae 0x18009f356
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x68], 0xf
movups xmmword [rsp + 0x50], xmm0
jmp 0x18009f3d1
movabs rax, 0x7fffffffffffffff
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18009f3aa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009f78f
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x18009f795
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18009f3b8
test rcx, rcx
je 0x18009f3b6
call fcn.1800cd2d4
jmp 0x18009f3b8
xor eax, eax
lea r8, [rdi + 1]
mov qword [rsp + 0x50], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x60], rdi
call fcn.1800bf440
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18009d2b0
cmp qword [0x180128ed0], 0x10
lea r8, [0x180128eb8]
mov r9, qword [0x180128ec8]
mov rcx, rax
cmovae r8, qword [0x180128eb8]
call fcn.1800c44c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x180128ed0]
cmp rdx, 0x10
jb 0x18009f478
mov rcx, qword [0x180128eb8]
inc rdx
cmp rdx, 0x1000
jb 0x18009f473
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f795
mov rcx, r8
call fcn.1800cd2cc
mov rdx, qword [rsp + 0x48]
movups xmmword [0x180128eb8], xmm6
movups xmmword [0x180128ec8], xmm7
cmp rdx, 0x10
jb 0x18009f4c3
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f4be
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f795
call fcn.1800cd2cc
cmp r13, 0x10
lea r14, [rbp - 0x58]
cmovae r14, r15
cmp rdi, 0x10
jae 0x18009f4f6
movups xmm0, xmmword [r14]
mov qword [rsp + 0x40], rdi
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x18009f58d
movabs rax, 0x7fffffffffffffff
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18009f547
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18009f79b
mov rcx, rax
call fcn.1800cd2d4
test rax, rax
je 0x18009f76b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18009f558
test rcx, rcx
je 0x18009f556
call fcn.1800cd2d4
mov rsi, rax
jmp 0x18009f558
xor esi, esi
lea r8, [rdi + 1]
mov qword [rsp + 0x30], rsi
mov rdx, r14
mov rcx, rsi
call fcn.1800d03a0
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
cmp rbx, 0x10
jb 0x18009f58a
lea rbx, [rsi + rdi]
mov rdi, rsi
jmp 0x18009f59a
mov rsi, rcx
lea rbx, [rsp + 0x30]
add rbx, rdi
lea rdi, [rsp + 0x30]
cmp rdi, rbx
je 0x18009f5b5
sub rsi, rdi
movzx ecx, byte [rdi]
call fcn.1800d9390
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x18009f5a2
cmp qword [0x1801296f0], 0x10
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x30]
cmovae r12, qword [0x1801296d8]
movups xmm1, xmmword [rsp + 0x40]
mov r9, qword [0x1801296e8]
mov r8, r12
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
call fcn.1800c44c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x1801296f0]
cmp rdx, 0x10
jb 0x18009f648
mov rcx, qword [0x1801296d8]
inc rdx
cmp rdx, 0x1000
jb 0x18009f643
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f76b
mov rcx, r8
call fcn.1800cd2cc
mov rdx, qword [rsp + 0x68]
movups xmmword [0x1801296d8], xmm6
movups xmmword [0x1801296e8], xmm7
cmp rdx, 0x10
jb 0x18009f693
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f68e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f76b
call fcn.1800cd2cc
cmp r13, 0x10
jb 0x18009f6ca
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x18009f6c2
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f771
mov rcx, r15
call fcn.1800cd2cc
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18009f705
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18009f700
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009f771
mov rcx, r8
call fcn.1800cd2cc
movaps xmm6, xmmword [rsp + 0x4f0]
mov r15, qword [rsp + 0x500]
mov r13, qword [rsp + 0x508]
mov r12, qword [rsp + 0x548]
movaps xmm7, xmmword [rsp + 0x4e0]
mov rsi, qword [rsp + 0x538]
mov rdi, qword [rsp + 0x540]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.1800cd010
add rsp, 0x510
pop r14
pop rbx
pop rbp
ret
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.1800bfe50
int3
call fcn.180088bc0
int3
call fcn.1800dc358
int3
call fcn.180088bc0
int3
call fcn.1800dc358
int3
call fcn.180088bc0
int3