Function at 0x18000fe20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 9], edi
mov dword [rbp + 0x77], edi
mov dword [rbp + 0x7f], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x78], rdi
lea rax, [rbp + 0x7f]
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180010116
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180012914
mov r15, rax
mov dword [rbp + 3], edi
mov ecx, dword [rbp + 0x7f]
inc ecx
mov dword [rbp - 5], ecx
call fcn.180012914
mov r13, rax
mov esi, edi
cmp dword [rbp - 9], edi
jbe 0x1800100fd
lea rax, [rbx + 0x28]
mov qword [rbp + 0x17], rax
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov r8d, eax
xor edx, edx
mov rcx, r15
call fcn.180017e30
mov r11d, dword [rbp + 0x7f]
inc r11d
mov dword [rbp - 5], r11d
mov r8d, r11d
xor edx, edx
mov rcx, r13
call fcn.180017e30
lea r11, [rbp - 5]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov r8, r15
mov edx, esi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
mov r8, r15
lea rdx, [0x1800349ec]
lea rcx, [rbp + 0xf]
call fcn.1800108c0
mov ecx, 0xa44
call fcn.1800155f8
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, 0xa44
call fcn.180014f80
mov ecx, gethostbyname
call fcn.1800155f8
mov r12, rax
mov qword [rbp + 7], rax
mov rcx, qword [r13 + 0xa44]
mov qword [rax], rcx
mov rcx, qword [r13 + 0xa4c]
mov qword [rax + 8], rcx
mov rcx, qword [r13 + 0xa54]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13 + 0xa5c]
mov qword [rax + 0x18], rcx
mov rcx, qword [r13 + 0xa64]
mov qword [rax + 0x20], rcx
mov rcx, qword [r13 + 0xa6c]
mov qword [rax + 0x28], rcx
movsxd rcx, dword [rdi + 0x208]
call fcn.180012914
mov rbx, rax
movsxd r8, dword [rdi + 0x208]
lea rdx, [r13 + 0xa74]
mov rcx, rax
call fcn.180014f80
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rbx
mov rax, qword [rbp + 0x17]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx + 0x438]
mov dword [r12 + 0x10], eax
mov eax, dword [rcx + 0x440]
mov dword [r12 + 0x14], eax
mov eax, dword [rcx + 0x448]
mov dword [r12 + 0x28], eax
mov qword [r12], rcx
lea rax, [rbp + 7]
mov rcx, qword [0x180046fa0]
cmp rax, rcx
jae 0x18001009f
lea rdx, [rbp + 7]
mov rax, qword [0x180046f98]
cmp rax, rdx
ja 0x18001009f
lea rbx, [rbp + 7]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [0x180046fa8]
jne 0x180010091
call fcn.1800105a0
mov rcx, qword [0x180046fa0]
mov rax, qword [0x180046f98]
test rcx, rcx
je 0x1800100c3
mov rax, qword [rax + rbx*8]
mov qword [rcx], rax
jmp 0x1800100bc
cmp rcx, qword [0x180046fa8]
jne 0x1800100b4
call fcn.1800105a0
mov rcx, qword [0x180046fa0]
test rcx, rcx
je 0x1800100c3
mov qword [rcx], r12
mov rcx, qword [0x180046fa0]
add rcx, 8
mov qword [0x180046fa0], rcx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800100ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + htons]
inc esi
cmp esi, dword [rbp - 9]
mov edi, 0
jb 0x18000fef2
mov rcx, r15
call fcn.180015ae0
mov rcx, r13
call fcn.180015ae0
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret