Function at 0x18001b25c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0xb0], rbx
mov rax, qword [0x1800ba600]
xor rax, rbp
mov qword [rbp + 0x60], rax
mov r12b, dl
mov rbx, rcx
xor r13d, r13d
mov qword [rbp + 8], r13
mov dword [rbp], r13d
mov qword [rbp + 0x58], SafeArrayGetLBound
mov qword [rbp + 0x50], r13
mov byte [rbp + 0x40], r13b
lea rdx, str.__dtx__barid
lea rcx, [rbp + 0x28]
call fcn.180002188
mov r8, rax
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.180017858
mov rax, qword [rax]
cmp rax, r13
je 0x18001b2da
mov rdi, qword [rax]
jmp 0x18001b2dd
mov rdi, r13
mov rbx, qword [rbp + 0x20]
cmp rbx, r13
je 0x18001b320
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x18001b31c
cmp rbx, r13
je 0x18001b31c
mov rcx, qword [rbx]
cmp rcx, r13
je 0x18001b306
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
cmp rcx, r13
je 0x18001b314
call fcn.180064200
mov rcx, rbx
call fcn.18006419c
mov qword [rbp + 0x20], r13
cmp rdi, r13
jne 0x18001b32d
mov rbx, r13
jmp 0x18001b3b3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x18001b348
mov rbx, r13
jmp 0x18001b3b3
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18001b361
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180080590
sub rsp, rcx
lea rsi, [rsp + 0x50]
cmp rsi, r13
je 0x18001b3b0
mov byte [rsi], r13b
lea eax, [r9 + r9]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rbx, rbx
and rbx, rsi
jmp 0x18001b3b3
mov rbx, r13
call fcn.18005c854
cmp al, r13b
je 0x18001b3de
lea rcx, str.SoftwareAppDataLowSoftware_
call fcn.180064df0
mov r8, rax
lea rdx, str.SoftwareAppDataLowSoftware_
lea rcx, [rbp + 0x38]
call fcn.180005ecc
jmp 0x18001b3fd
lea rcx, str.Software_
call fcn.180064df0
mov r8, rax
lea rdx, str.Software_
lea rcx, [rbp + 0x38]
call fcn.180005ecc
mov rcx, rbx
call fcn.180064df0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.180011cd4
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
mov dword [rbp], eax
cmp eax, r13d
je 0x18001b486
cmp qword [rbp + 0x58], 0x10
jb 0x18001b46f
mov rcx, qword [rbp + 0x40]
call fcn.18006419c
mov qword [rbp + 0x58], SafeArrayGetLBound
mov qword [rbp + 0x50], r13
mov byte [rbp + 0x40], r13b
mov eax, ebx
jmp 0x18001b55d
movzx eax, r12b
mov dword [rbp + 0x1c], eax
mov edi, 4
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.Toolbar_Enabled
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov dword [rbp], eax
cmp eax, r13d
jne 0x18001b53b
mov dword [rbp + 0x10], r13d
mov dword [rbp + 0x14], r13d
cmp r12b, r13b
jne 0x18001b512
mov dword [rbp + 4], edi
mov dword [rbp + 0x18], edi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x14]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 4]
xor r8d, r8d
lea rdx, str.Toolbar_Hide_Time
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov dword [rbp], eax
xor ecx, ecx
call fcn.18006618c
mov dword [rbp + 0x10], eax
cmp dword [rbp + 0x14], r13d
jne 0x18001b53b
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.Toolbar_Hide_Time
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov dword [rbp], eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x18001b54b
cmp qword [rbp + 0x58], 0x10
jb 0x18001b55b
mov rcx, qword [rbp + 0x40]
call fcn.18006419c
mov eax, ebx
mov rcx, qword [rbp + 0x60]
xor rcx, rbp
call fcn.180064d20
mov rbx, qword [rbp + 0xb0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret