Function at 0x180029254
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor r12d, r12d
mov r13, rdx
mov esi, r12d
mov qword [rsp + 0x70], r12
mov edi, r12d
mov r15d, ecx
test byte [0x1800b78f1], 4
jne 0x180049760
test r15d, r15d
jne 0x1800292b5
test r13, r13
je 0x180049777
lea rax, [rsp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesNetBTLinkage
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180049923
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.Export
mov dword [rsp + 0x68], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
je 0x180029330
test eax, eax
jne 0x180049923
mov ecx, dword [rsp + 0x68]
call fcn.180017d38
mov qword [rsp + 0x60], rax
mov rsi, rax
test rax, rax
je 0x180049781
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.Export
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180049923
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x70], r12
test r15d, r15d
jne 0x18004978b
mov r14d, dword [r13 + 0x44]
test r14d, r14d
je 0x180049939
imul ebx, r14d, 0x6f8
add ebx, 0x960
mov ecx, ebx
call fcn.180017d38
mov rdi, rax
test rax, rax
je 0x180049781
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rcx, [rdi + 0x238]
lea r12, [rdi + 0x270]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
xor ecx, ecx
mov dword [rdi + 0x2c], 1
test r15d, r15d
jne 0x1800497bf
mov r12d, ecx
cmp dword [r13 + 0x44], ecx
jbe 0x1800294a8
lea r15, [rdi + 0x278]
mov eax, r12d
lea r8, str.DeviceNetBT_Tcpip__s
mov edx, 0x41
lea rcx, [rbp - 0x30]
lea rbx, [rax + rax*8]
add rbx, rbx
mov r9, qword [r13 + rbx*8 + 0x68]
call fcn.180029694
mov eax, dword [r13 + rbx*8 + 0xa4]
add eax, 0xffffff0d
cmp eax, 1
jbe 0x18004984c
mov edx, dword [rsp + 0x68]
lea r8, [rbp - 0x30]
mov rcx, rsi
call fcn.180029618
test eax, eax
je 0x18004984c
lea r8, [rbp - 0x30]
mov edx, 0x105
mov rcx, r15
call fcn.180008070
test byte [0x1800b78f1], 4
jne 0x180049832
mov qword [r15 + 0x230], rdi
add r15, 0x6f0
inc r12d
cmp r12d, dword [r13 + 0x44]
jb 0x18002941b
xor ecx, ecx
lea r12, [rdi + 0x270]
test r14d, r14d
je 0x180049877
mov ebx, ecx
mov r15, r12
test r14d, r14d
je 0x180049904
mov r12d, r14d
xor esi, esi
lea r13, [r15 + 8]
mov rdx, r13
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov dword [rsp + 0x50], esi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rsi
lea r9, [rbp - 0x40]
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x78]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
mov eax, 3
mov dword [rsp + 0x78], 0x30
mov dword [rsp + 0x38], eax
mov edx, 0x80000000
mov dword [rsp + 0x30], eax
mov rcx, r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov qword [rbp - 0x80], rsi
mov dword [rbp - 0x70], 0x40
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
test eax, eax
jne 0x1800498b9
cmp qword [r15], rsi
je 0x1800498b9
test byte [0x1800b78f1], 4
jne 0x18004989f
inc ebx
add r15, 0x6f0
sub r12, 1
jne 0x1800294cb
mov rsi, qword [rsp + 0x60]
test ebx, ebx
je 0x180049904
mov dword [rdi + 8], ebx
mov dword [rdi + 0xc], r14d
mov qword [rdi + 0x10], rsi
test byte [0x1800b78f1], 4
jne 0x1800498e3
mov rcx, rdi
call fcn.1800295e8
mov rax, rdi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0xd
lea rdx, [0x1800a36a8]
call fcn.180087008
nop
jmp 0x1800292a7
mov ebx, 0x57
jmp 0x180049923
mov ebx, 0xe
jmp 0x180049923
mov r14d, r12d
mov rax, rsi
cmp word [rsi], r12w
je 0x180049939
inc r14d
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1800497a2
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], r12w
jne 0x18004979b
jmp 0x1800293a5
mov r15, rsi
cmp word [rsi], cx
je 0x1800294af
lea r13, [rdi + 0x278]
mov ebx, 0xe
mov r8, r15
mov edx, 0x105
mov rcx, r13
call fcn.180008070
test byte [0x1800b78f1], 4
je 0x180049801
mov ecx, ebx
lea rdx, [0x1800a36a8]
mov r8, r13
call fcn.180087814
mov qword [r13 + 0x230], rdi
or rax, 0xffffffffffffffff
add r13, 0x6f0
xor ecx, ecx
inc rax
cmp word [r15 + rax*2], cx
jne 0x180049815
lea r15, [r15 + rax*2]
add r15, 2
cmp word [r15], cx
jne 0x1800497d7
jmp 0x1800294af
mov ecx, 0x10
lea rdx, [0x1800a36a8]
mov r8, r15
call fcn.180087814
nop
jmp 0x18002948b
dec r14d
test byte [0x1800b78f1], 4
je 0x180029499
mov ecx, 0xf
lea r8, [rbp - 0x30]
lea rdx, [0x1800a36a8]
call fcn.180087814
nop
jmp 0x180029499
mov ebx, 0x10d8
test byte [0x1800b78f1], 4
je 0x180049923
mov ecx, 0x11
lea rdx, [0x1800a36a8]
call fcn.180087008
jmp 0x180049923
mov ecx, 0x12
lea rdx, [0x1800a36a8]
mov r8, r13
call fcn.180087814
nop
jmp 0x180029571
test byte [0x1800b78f1], 4
je 0x180029573
mov ecx, 0x13
lea rdx, [0x1800a36a8]
mov r9d, eax
mov r8, r13
call fcn.180087538
nop
jmp 0x180029573
lea rax, [rdi + 0x270]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.18008d14c
nop
jmp 0x1800295a9
test byte [0x1800b78f1], 4
je 0x18004991e
mov ecx, 0x14
lea rdx, [0x1800a36a8]
call fcn.180087008
mov ebx, 0x10d8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180049939
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test rsi, rsi
je 0x180049946
mov rcx, rsi
call sym.DNSAPI.dll_DnsApiFree
test ebx, ebx
je 0x180049958
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, rdi
call fcn.18002a964
xor eax, eax
jmp 0x1800295b4