Function at 0x180018370
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rbp + 0x780], rax
movzx eax, word [0x18006f728]
movsd xmm0, qword [0x18006f720]
mov r15, rcx
lea rcx, [rbp - 0x76]
xor edx, edx
mov r8d, 0x7f6
movsd qword [rbp - 0x80], xmm0
mov word [rbp - 0x78], ax
call fcn.1800292e0
xor edi, edi
mov r12d, edi
mov qword [rsp + 0x68], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x1800184a3
lea rax, [rsp + 0x54]
lea rdx, [0x18006f740]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1800184a3
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea rdx, [0x18006f730]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x50], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov eax, edi
sete al
test eax, eax
jne 0x1800184a3
lea r8, [0x18006f748]
lea rcx, [rbp - 0x80]
or r9, 0xffffffffffffffff
mov edx, 0x800
call fcn.18002a5b4
lea r12d, [rdi + 1]
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018556
lea rax, [rsp + 0x60]
lea rdx, [0x18006f768]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x180018556
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f758]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, FreeADsMem
test ebx, ebx
cmove r14d, dword [rsp + 0x54]
jmp 0x18001855c
mov r14d, FreeADsMem
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x18001860c
lea rax, [rsp + 0x68]
lea rdx, [0x18006f770]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x18001860c
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x60]
lea rdx, [0x18006f46c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, edi
test ebx, ebx
cmove r13d, dword [rsp + 0x50]
jmp 0x18001860f
mov r13d, edi
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x1800186c0
lea rax, [rsp + 0x68]
lea rdx, [0x18006f790]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x1800186c0
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x60]
lea rdx, [0x18006f778]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x1811
test ebx, ebx
cmove esi, dword [rsp + 0x50]
jmp 0x1800186c5
mov esi, 0x1811
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018776
lea rax, [rsp + 0x68]
lea rdx, str.Network
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x180018776
lea rcx, [rsp + 0x54]
lea r9, [rsp + 0x60]
lea rdx, [0x18006f798]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov dword [rsp + 0x54], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x50]
lea eax, [rsi - 1]
cmp eax, 0xfffe
jbe 0x180018789
mov esi, 0x1811
add r12d, 4
lea r8, [rbp - 0x80]
or r9, 0xffffffffffffffff
mov edx, 0x800
mov rcx, r15
call fcn.18002a5b4
mov dword [r15 + 0x800], r14d
mov dword [r15 + 0x804], edi
mov dword [r15 + 0x808], r13d
mov dword [r15 + 0x80c], esi
mov eax, r12d
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret