Function at 0x180065140
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r15, rcx
xor r13d, r13d
mov qword [rbp - 0x68], r13
mov dword [rbp - 0x60], r13d
mov qword [rbp - 0x58], r13
lea r9d, [r13 + 8]
lea r8, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x68]
call fcn.180022180
mov rdi, qword [rbp - 0x68]
test eax, eax
je 0x1800651bc
mov ebx, r13d
jmp 0x180065650
mov r12d, r13d
nop
mov dword [rsp + 0x40], 0x104
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1e0]
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180065643
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x70], r13
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006562e
mov dword [rsp + 0x68], r13d
mov rbx, qword [rbp - 0x70]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x50], 0x208
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.BusType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800653be
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 1
ja 0x1800653be
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x1800652c2
test cl, 1
jne 0x1800653be
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x32], 0
je 0x1800652c7
jmp 0x1800653be
mov word [rbp - 0x30], r13w
shr ecx, 1
mov dword [rsp + 0x40], ecx
lea rcx, [rbp - 0x30]
call fcn.1800bd960
cmp eax, 5
je 0x1800653da
test eax, eax
jne 0x1800653be
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800653be
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x1800653be
mov ecx, dword [rsp + 0x54]
test ecx, ecx
je 0x180065352
test cl, 1
jne 0x1800653be
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x32], 0
je 0x180065357
jmp 0x1800653be
mov word [rbp - 0x30], r13w
shr ecx, 1
mov dword [rsp + 0x40], ecx
mov r8d, 9
lea rdx, str.Microsoft
lea rcx, [rbp - 0x30]
call fcn.1800bd98c
test eax, eax
jne 0x1800653be
mov dword [rsp + 0x58], r13d
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.IfType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800653be
cmp dword [rbp - 0x7c], 4
jne 0x1800653be
cmp dword [rsp + 0x58], 6
je 0x1800653da
test rbx, rbx
je 0x18006562e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
jmp 0x18006562e
mov dword [rsp + 0x5c], 0x208
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
xor r8d, r8d
lea rdx, str.NetCfgInstanceId
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800653be
mov eax, dword [rbp - 0x78]
dec eax
cmp eax, 1
ja 0x1800653be
mov ecx, dword [rsp + 0x5c]
test ecx, ecx
je 0x18006543b
test cl, 1
jne 0x1800653be
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x32], 0
je 0x180065440
jmp 0x1800653be
mov word [rbp - 0x30], r13w
shr ecx, 1
mov dword [rsp + 0x40], ecx
call fcn.180025f00
test rax, rax
je 0x1800656a3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x48]
call fcn.180025050
test al, al
jne 0x1800655bc
lea rax, [rbp - 0x30]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180065490
mov rbx, qword [rsp + 0x48]
test edi, edi
jne 0x180065500
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800655c1
cmp dword [rdx + 0x10], 0
jge 0x1800654d1
cmp dword [rbx - 0xc], 0
jl 0x1800656ae
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x1800655c1
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800654e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x1800655c1
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp - 0x30]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x180065698
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180065538
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.180025470
mov rbx, qword [rsp + 0x48]
movsxd rax, edi
cmp rsi, r14
ja 0x18006558f
lea rdx, [rbx + rsi*2]
lea rsi, [rax + rax]
test rsi, rsi
je 0x1800655a9
test rdx, rdx
jne 0x180065564
call fcn.1800aeaf8
mov dword [rax], 0x16
call fcn.1800aee10
jmp 0x1800655a9
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, rsi
jae 0x180065582
call fcn.1800aeaf8
mov dword [rax], 0x22
call fcn.1800aee10
jmp 0x1800655a9
mov r8, rsi
mov rcx, rbx
call fcn.1800ab630
jmp 0x1800655a9
lea rsi, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rsi
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.1800213f0
cmp edi, dword [rbx - 0xc]
jg 0x1800656b9
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], r13w
jmp 0x1800655c1
mov rbx, qword [rsp + 0x48]
mov rdi, qword [r15 + 8]
cmp qword [r15 + 0x10], rdi
je 0x1800655e6
mov qword [rbp - 0x40], rdi
lea rcx, [rbx - 0x18]
call fcn.180025a30
add rax, 0x18
mov qword [rdi], rax
add qword [r15 + 8], 8
jmp 0x1800655f7
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, r15
call fcn.1800255d0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180065614
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180065628
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
mov rdi, qword [rbp - 0x68]
jmp 0x18006562e
mov dword [rsp + 0x68], r13d
inc r12d
cmp r12d, 0x100
jl 0x1800651c0
mov ebx, r13d
mov rax, qword [r15 + 8]
cmp qword [r15], rax
setne bl
test rdi, rdi
je 0x180065662
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x68], r13
mov dword [rbp - 0x60], r13d
mov eax, ebx
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80070057
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3