Function at 0x18000ba68
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r13, rdx
mov qword [rsp + 0x70], rdx
mov r15d, ecx
mov dword [rsp + 0x68], ecx
xor edi, edi
mov r14d, edi
mov qword [rsp + 0x78], rdi
mov esi, edi
lea rax, [0x18008a130]
mov rcx, qword [0x18008a130]
mov r12d, 0x400
cmp rcx, rax
je 0x18000bad2
test dword [rcx + 0x1c], r12d
jne 0x1800533ae
test r15d, r15d
jne 0x18000bae0
test r13, r13
je 0x18003d95e
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x180021670]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1800338c9
mov dword [rsp + 0x60], edi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x1800216d0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x18000bb52
test eax, eax
jne 0x1800338c9
mov ecx, dword [rsp + 0x60]
call fcn.180008d40
mov r14, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x18003d968
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x1800216d0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1800338c9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
test r15d, r15d
jne 0x180039bd1
mov r15d, dword [r13 + 0x44]
lea r13d, [rbx + 1]
test r15d, r15d
je 0x1800338c9
imul ebx, r15d, 0x6f8
add ebx, 0x960
mov ecx, ebx
call fcn.180008d40
mov rsi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18003d968
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rbx, [rsi + 0x270]
lea rcx, [rsi + 0x238]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitializeCriticalSection]
jmp 0x18000bc1b
mov dword [rsi + 0x2c], r13d
cmp dword [rsp + 0x68], edi
jne 0x180039c09
mov eax, edi
mov dword [rsp + 0x68], eax
mov rdx, qword [rsp + 0x70]
cmp dword [rdx + 0x44], edi
jbe 0x180039c8a
lea r13, [rbx + 8]
imul rbx, rax, 0x88
mov r9, qword [rbx + rdx + 0x68]
lea r8, [0x1800216e0]
mov edx, 0x41
lea rcx, [rsp + 0xf0]
call fcn.180008f30
mov rcx, qword [rsp + 0x70]
mov eax, dword [rbx + rcx + 0x9c]
add eax, 0xffffff0d
mov ecx, edi
mov ebx, 1
cmp eax, ebx
cmovbe ecx, ebx
test ecx, ecx
jne 0x180033884
lea r8, [rsp + 0xf0]
mov edx, dword [rsp + 0x60]
mov rcx, r14
call fcn.18000bf34
test eax, eax
je 0x180033884
lea r8, [rsp + 0xf0]
mov edx, 0x105
mov rcx, r13
call fcn.1800091c0
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18000bcd9
test dword [rcx + 0x1c], r12d
jne 0x1800533e6
mov qword [r13 + 0x230], rsi
add r13, 0x6f0
mov rcx, qword [0x18008a130]
mov eax, dword [rsp + 0x68]
add eax, ebx
mov dword [rsp + 0x68], eax
mov rdx, qword [rsp + 0x70]
cmp eax, dword [rdx + 0x44]
jb 0x18000bc41
lea rbx, [rsi + 0x270]
test r15d, r15d
je 0x1800338ae
mov r13d, edi
test r15d, r15d
je 0x18000be10
lea r12, [rbx + 8]
mov eax, r15d
mov qword [rsp + 0x70], rax
mov rdx, r12
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x98], getservbyport
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xb0], 0x40
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
mov eax, 3
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x98]
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x180039ba1
cmp qword [rbx], rdi
je 0x180039ba1
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18000bdf7
test dword [rcx + 0x1c], 0x400
jne 0x180053442
mov eax, 0x6f0
add rbx, rax
add r12, rax
inc r13d
dec qword [rsp + 0x70]
jne 0x18000bd2e
test r13d, r13d
je 0x18005348e
mov dword [rsi + 8], r13d
mov dword [rsi + 0xc], r15d
mov qword [rsi + 0x10], r14
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18000be45
test dword [rcx + 0x1c], 0x400
jne 0x1800534c2
mov rcx, rsi
call fcn.18000bfb0
mov rax, rsi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180001000
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
dec r15d
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18000bcee
test dword [rcx + 0x1c], r12d
je 0x18000bcee
jmp 0x18003d958
mov ebx, 0x10d8
lea rax, [0x18008a130]
cmp rcx, rax
je 0x1800338c9
test dword [rcx + 0x1c], r12d
jne 0x180053427
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jne 0x1800534ea
test r14, r14
je 0x1800338e4
mov rcx, r14
call fcn.180008b84
test ebx, ebx
je 0x1800338f0
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rcx, rsi
call fcn.18000a390
xor eax, eax
jmp 0x18000be50
mov rcx, qword [0x18008a130]
lea rdx, [0x18008a130]
cmp rcx, rdx
je 0x180039bc1
test dword [rcx + 0x1c], 0x400
jne 0x180053466
mov eax, 0x6f0
add rbx, rax
add r12, rax
jmp 0x18000be05
mov r15d, edi
mov rax, r14
mov r13d, 1
cmp word [r14], di
je 0x18000bbc6
add r15d, r13d
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], di
jne 0x180039bee
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], di
jne 0x180039be7
jmp 0x18000bbc6
mov r13, r14
cmp word [r14], di
je 0x180039c8a
lea rax, [rbx + 8]
mov qword [rsp + 0x68], rax
mov ebx, reloc.WS2_32.dll_ntohl
mov r8, r13
mov edx, 0x105
mov rcx, rax
call fcn.1800091c0
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x180039c4d
test dword [rcx + 0x1c], r12d
jne 0x1800533c9
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x230], rsi
add rax, 0x6f0
mov qword [rsp + 0x68], rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r13 + rcx*2], di
jne 0x180039c68
lea r13, [r13 + rcx*2]
add r13, 2
cmp word [r13], di
jne 0x180039c20
lea rbx, [rsi + 0x270]
mov rcx, qword [0x18008a130]
jmp 0x18000bd0d
jmp 0x180053404
mov ebx, 0x57
jmp 0x1800338c9
mov ebx, reloc.WS2_32.dll_ntohl
jmp 0x1800338c9
mov edx, reloc.WS2_32.dll_listen
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.180058818
nop
jmp 0x18000bad2
mov edx, ebx
mov r9, qword [rsp + 0x68]
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.18005b04c
nop
jmp 0x180039c4d
mov edx, send
mov r9, r13
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.18005b04c
nop
jmp 0x18000bcd9
mov edx, reloc.WS2_32.dll_ntohs
lea r9, [rsp + 0xf0]
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.18005b04c
nop
jmp 0x18000bce7
mov edx, send
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.180058818
nop
jmp 0x1800338c9
mov edx, reloc.WS2_32.dll_select
mov r9, r12
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.18005b04c
mov rcx, qword [0x18008a130]
jmp 0x18000bdf7
mov edx, reloc.WS2_32.dll_send
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.180058df4
mov rcx, qword [0x18008a130]
jmp 0x180039bc1
lea rax, [0x18008a130]
cmp rcx, rax
je 0x1800534b8
test dword [rcx + 0x1c], 0x400
je 0x1800534b8
mov edx, reloc.WS2_32.dll_sendto
lea r8, [0x1800827b0]
mov rcx, qword [rcx + 0x10]
call fcn.180058818
mov ebx, 0x10d8
jmp 0x1800338c9
lea rax, [rsi + 0x270]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, rsi
mov rcx, qword [rcx + 0x10]
call fcn.180068a38
nop
jmp 0x18000be45
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
jmp 0x1800338d7