Function at 0x18000e540
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov r12d, edx
lea rax, [rbp - 0x68]
mov rsi, rcx
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
xor r8d, r8d
xor r13d, r13d
xor r14d, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000e5a6
xor eax, eax
jmp 0x18000ee60
mov qword [rsp + 0x748], rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x750], rdi
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x758], r15
call fcn.180113150
mov dword [rbp - 0x58], r13d
call fcn.1800f3548
test rax, rax
je 0x18000ee8a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea r15, [0x180154cbc]
mov rdi, 0xffffffffffffffff
add rax, 0x18
mov qword [rbp - 0x48], rax
cmp r15, 0x10000
jae 0x18000e618
movzx edx, r15w
lea rcx, [rbp - 0x48]
call fcn.18000f660
jmp 0x18000e639
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], r13w
jne 0x18000e620
mov r8d, eax
lea rcx, [rbp - 0x48]
mov rdx, r15
call fcn.180007b10
movzx ebx, r15w
call fcn.1800f3548
test rax, rax
je 0x18000ee8a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
movzx ebx, bx
mov qword [rbp - 0x50], rax
cmp r15, 0x10000
jae 0x18000e675
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.18000f660
jmp 0x18000e699
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], r13w
jne 0x18000e680
mov r8d, eax
lea rcx, [rbp - 0x50]
mov rdx, r15
call fcn.180007b10
call fcn.1800f3548
test rax, rax
je 0x18000ee8a
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
cmp r15, 0x10000
jae 0x18000e6cf
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.18000f660
jmp 0x18000e6eb
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r13w
jne 0x18000e6d2
mov r8d, eax
lea rcx, [rbp - 0x40]
mov rdx, r15
call fcn.180007b10
mov rcx, qword [rbp - 0x68]
lea r9, [rbp - 0x58]
xor ebx, ebx
mov dword [rbp - 0x58], 0x104
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
lea r15d, [rbx + 1]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18000e828
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x3f0]
mov r8d, 0x208
call fcn.180113150
lea rax, [rbp - 0x30]
mov edx, 0x104
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x3f0]
call fcn.18000f870
lea rax, [rbp - 0x60]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x3f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000e7ed
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, word [rbp - 0x30]
mov edx, ebx
test cx, cx
je 0x18000e7c9
nop dword [rax + rax]
cmp cx, 0x20
lea eax, [rbx + 1]
lea edx, [rdx + 1]
movzx ecx, word [rbp + rdx*2 - 0x30]
cmovne eax, ebx
mov ebx, eax
test cx, cx
jne 0x18000e7b0
cmp ebx, r14d
lea rcx, [rbp - 0x30]
mov eax, ebx
mov rdx, rsi
cmovbe eax, r14d
mov r14d, eax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000e878
xor ebx, ebx
mov rcx, qword [rbp - 0x68]
lea r9, [rbp - 0x58]
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], rbx
mov edx, r15d
mov qword [rsp + 0x28], rbx
inc r15d
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x58], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18000e730
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp - 0x40]
movzx eax, word [rbx]
cmp ax, word [0x180154cbc]
je 0x18000e85b
mov rdx, qword [rbp - 0x50]
mov r8, 0xffffffff80000002
mov rcx, r8
mov r9, rbx
call sym.SafeBase64.dll_CopyRegKey
mov r13d, eax
test r13d, r13d
je 0x18000edf2
cmp r13d, 5
je 0x18000edf2
mov esi, 1
jmp 0x18000edf4
lea eax, [r15 - 1]
mov r8d, 0x208
cmp r12d, eax
lea rcx, [rbp + 0x1e0]
setae r13b
xor edx, edx
mov dword [rsp + 0x50], r13d
call fcn.180113150
xor eax, eax
sub r14d, ebx
je 0x18000e8c3
lea rcx, [rbp + 0x1e0]
mov edx, 0x20
nop
mov word [rcx], dx
cmp eax, 0x32
jae 0x18000e8c3
inc eax
add rcx, 2
cmp eax, r14d
jb 0x18000e8b0
call fcn.1800f3548
test rax, rax
je 0x18000ee7f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rsi, rsi
je 0x18000e90f
cmp rsi, 0x10000
jae 0x18000e900
movzx edx, si
lea rcx, [rsp + 0x40]
call fcn.18000f660
jmp 0x18000e921
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x18000e903
jmp 0x18000e911
xor eax, eax
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.180007b10
call fcn.1800f3548
test rax, rax
je 0x18000ee7f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1e0]
cmp rax, 0x10000
jae 0x18000e966
lea rax, [rbp + 0x1e0]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.18000f660
jmp 0x18000e98e
lea rcx, [rbp + 0x1e0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000e970
mov r8d, eax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x58]
call fcn.180007b10
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rbx - 0x18]
lea r15, [rbx - 0x18]
test rcx, rcx
je 0x18000e9ab
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x18000e9c2
call fcn.1800f3548
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
test rax, rax
je 0x18000ee7f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov r9, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8d, dword [rbx - 0x10]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rdx, rbx
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
call fcn.18000f130
mov rdx, qword [rsp + 0x60]
mov r14, qword [rbp - 0x48]
add r14, 0xffffffffffffffe8
lea rbx, [rdx - 0x18]
cmp rbx, r14
je 0x18000ea58
cmp dword [r14 + 0x10], 0
jl 0x18000ea4b
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x18000ea4b
mov rcx, rbx
call fcn.18000f360
mov r13, rax
mov ecx, edi
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x18000ea3c
mov rcx, qword [r14]
mov rdx, r14
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [r13 + 0x18]
mov r13d, dword [rsp + 0x50]
mov qword [rbp - 0x48], rax
jmp 0x18000ea58
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x48]
call fcn.180007b10
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x18000ea70
mov rcx, qword [rbx]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, edi
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x18000ea89
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000eaa7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.1800f3548
test rax, rax
je 0x18000eea0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x18000eafc
cmp rsi, 0x10000
jae 0x18000eae4
movzx edx, si
lea rcx, [rsp + 0x48]
call fcn.18000f660
jmp 0x18000eb0e
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x18000eaf0
jmp 0x18000eafe
xor eax, eax
mov r8d, eax
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.180007b10
lea rdx, [0x180154c7c]
lea rcx, [rbp - 0x80]
call fcn.18000f1f0
mov rbx, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x18000eb38
mov rdx, qword [rcx]
call qword [rdx + 0x20]
test rax, rax
jne 0x18000eb4f
call fcn.1800f3548
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
test rax, rax
je 0x18000eea0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov r9, qword [rbx]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
add rax, 0x18
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov r8d, 0x4e
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
call fcn.18000f130
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rbx - 0x18]
lea r14, [rbx - 0x18]
test rcx, rcx
je 0x18000eba0
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x18000ebb7
call fcn.1800f3548
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
test rax, rax
je 0x18000eea0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov r9, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
mov r8d, dword [rbx - 0x10]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rdx, rbx
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
call fcn.18000f130
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rbp - 0x50]
add rsi, 0xffffffffffffffe8
lea rbx, [rdx - 0x18]
cmp rbx, rsi
je 0x18000ec46
cmp dword [rsi + 0x10], 0
jl 0x18000ec39
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x18000ec39
mov rcx, rbx
call fcn.18000f360
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x18000ec2f
mov rcx, qword [rsi]
mov rdx, rsi
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x50], rax
jmp 0x18000ec46
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x50]
call fcn.180007b10
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x18000ec5e
mov rcx, qword [rbx]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x18000ec77
mov rcx, qword [r14]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x80]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000ec94
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000ecb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x180154c7c]
lea rcx, [rbp - 0x70]
call fcn.18000f1f0
mov r8, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
lea rcx, [rbp - 0x78]
call fcn.18000f060
mov rbx, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x18000ecf2
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x18000ed03
call fcn.1800f3548
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x18000ee95
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x78]
mov r9, qword [rbp - 0x48]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r8d, dword [rdx - 0x10]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
call fcn.18000f130
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rbp - 0x40]
add rsi, 0xffffffffffffffe8
lea rbx, [rdx - 0x18]
cmp rbx, rsi
je 0x18000ed97
cmp dword [rsi + 0x10], 0
jl 0x18000ed8a
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x18000ed8a
mov rcx, rbx
call fcn.18000f360
mov r14, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x18000ed80
mov rcx, qword [rsi]
mov rdx, rsi
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [r14 + 0x18]
mov qword [rbp - 0x40], rax
jmp 0x18000ed97
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.180007b10
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x18000edaf
mov rcx, qword [rbx]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x78]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000edcc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x70]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e828
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x18000e828
xor esi, esi
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000ee0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x50]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000ee2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18000ee46
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rdi, qword [rsp + 0x750]
mov eax, esi
mov rbx, qword [rsp + 0x748]
mov r15, qword [rsp + 0x758]
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x710
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180007f70
int3
mov ecx, 0x80004005
call fcn.180007f70
int3
mov ecx, 0x80004005
call fcn.180007f70
int3
mov ecx, 0x80004005
call fcn.180007f70
int3