Function at 0x1800a5240
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x1800a54dc
test edx, edx
je 0x1800a54dc
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.1800c61d0
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r14d, r14d
test eax, eax
jne 0x1800a5468
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x398], rdi
mov edi, r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1800a5455
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800a5419
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ServiceName
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800a540e
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.1800c61d0
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x150]
call fcn.1800a5510
test eax, eax
je 0x1800a540e
cmp byte [rsp + 0x60], r14b
je 0x1800a53c5
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x1800a540e
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x1800a5400
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x1800a5400
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x1800a53e0
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r14b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1800a5310
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x398]
cmp byte [rsp + 0x60], r14b
je 0x1800a54dc
lea rax, [rsi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
mov edx, r14d
mov r9d, 0x80070057
mov rcx, rsi
cmova edx, r9d
test edx, edx
js 0x1800a54d3
test esi, esi
je 0x1800a54bc
sub r8, rcx
lea rdx, [rsp + 0x60]
sub rdx, rbx
nop
lea rax, [r8 + rcx]
test rax, rax
je 0x1800a54bc
movzx eax, byte [rdx + rbx]
test al, al
je 0x1800a54bc
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1800a54a0
test rcx, rcx
lea rax, [rbx - 1]
mov edx, 0x8007007a
cmovne rax, rbx
cmovne edx, r14d
mov byte [rax], r14b
not edx
shr edx, 0x1f
mov eax, edx
jmp 0x1800a54de
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rsi
pop rbp
ret