Function at 0x180029560
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18005d0e0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov qword [rbp - 0x40], rcx
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov edi, r15d
mov byte [rbp + 0x100], dil
xor edx, edx
mov r8d, 0xfe
lea rcx, [rbp + 0x101]
call fcn.1800334b0
mov byte [rbp], dil
xor edx, edx
mov r8d, 0xfe
lea rcx, [rbp + 1]
call fcn.1800334b0
mov dword [rbp - 0x78], 0xff
mov dword [rsp + 0x40], 0xff
mov dword [rsp + 0x50], 7
lea rdx, str.nfvmdLXh4QmKyqDTfEM0C8Vb3dr7px_SlC6Ngoj5bu1GGl7MIGD86NfM2p6AaYVdgCNwAgIDOuu7x9xYyEjGQ
lea rcx, [rbp - 0x10]
call fcn.180001580
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.18002b2c0
mov rsi, qword [rax]
mov qword [rbp - 0x30], rsi
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029704
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002a2aa
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x100]
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rbx, qword [rsp + 0x48]
cmp eax, 0x103
je 0x18002a29e
inc edi
mov dword [rbp - 0x50], edi
lea r8, [rbp + 0x100]
lea rdx, [0x18004e3b4]
lea rcx, [rbp - 0x68]
call fcn.180002980
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x28], rax
cmp dword [rax - 0x10], 0
je 0x18002a166
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
test rsi, rsi
je 0x1800297f0
test rsi, 0xffffffffffff0000
jne 0x1800297de
movzx edi, si
mov ecx, edi
call fcn.180001110
test rax, rax
je 0x180029803
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.180001a00
jmp 0x180029803
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
jmp 0x1800297f3
mov ecx, r15d
mov r8d, ecx
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.180001b40
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.18002a3e0
nop
lea r8, [rbp - 0x68]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.18002a330
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x180029948
cmp dword [rdi + 0x10], 0
jl 0x180029874
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x180029874
call fcn.180001790
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180029866
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x180029948
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x1800298d3
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x180029948
cmp dword [rdi + 0x10], 0
jge 0x1800298a5
cmp dword [rbx - 0xc], 0
jl 0x18002a196
mov dword [rbx - 0x10], r15d
mov byte [rbx], 0
jmp 0x180029948
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1800298bf
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x180029948
test r13, r13
je 0x18002a1b7
mov r15d, dword [rbx - 0x10]
mov r14, r13
sub r14, rbx
test esi, esi
js 0x18002a1ac
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, esi
or eax, ecx
jge 0x180029910
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.180001ef0
mov rbx, qword [rsp + 0x48]
mov rdi, rsi
movsxd rdx, dword [rbx - 0xc]
mov r9, rsi
mov rcx, rbx
cmp r14, r15
ja 0x18002992d
lea r8, [r14 + rbx]
call fcn.18002f970
jmp 0x180029935
mov r8, r13
call fcn.18002feb4
cmp esi, dword [rbx - 0xc]
jg 0x18002a1a1
mov dword [rbx - 0x10], esi
mov byte [rdi + rbx], 0
xor r15d, r15d
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029968
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029988
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800299a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002a141
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
mov rsi, qword [rsp + 0x58]
test ecx, ecx
jne 0x180029a78
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180029ae5
cmp dword [rdx + 0x10], eax
jge 0x180029a48
cmp dword [rsi - 0xc], eax
jl 0x18002a1c2
mov dword [rsi - 0x10], r15d
mov byte [rsi], al
jmp 0x180029ae5
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029a5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov rbx, qword [rsp + 0x48]
jmp 0x180029ae5
mov r14d, dword [rsi - 0x10]
lea r13, [rbp]
sub r13, rsi
test ecx, ecx
js 0x18002a293
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x180029aad
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.180001ef0
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
cmp r13, r14
movsxd r14, edi
mov r9, r14
ja 0x180029acb
lea r8, [r13 + rsi]
call fcn.18002f970
jmp 0x180029ad4
lea r8, [rbp]
call fcn.18002feb4
cmp edi, dword [rsi - 0xc]
jg 0x18002a288
mov dword [rsi - 0x10], edi
mov byte [rsi + r14], 0
mov dword [rsp + 0x40], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp]
call fcn.1800334b0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r13, rcx
test ecx, ecx
jne 0x180029ba5
mov rax, qword [rsp + 0x60]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x180029c1f
cmp dword [rdx + 0x10], ecx
jge 0x180029b70
cmp dword [rax - 0xc], ecx
jl 0x18002a1cd
mov dword [rax - 0x10], r15d
mov byte [rax], cl
jmp 0x180029c1f
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029b87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
jmp 0x180029c1f
mov rdi, qword [rsp + 0x60]
mov r15d, dword [rdi - 0x10]
lea r14, [rbp]
sub r14, rdi
test ecx, ecx
js 0x18002a27d
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x180029be6
mov edx, r13d
lea rcx, [rsp + 0x60]
call fcn.180001ef0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
cmp r14, r15
movsxd r15, r13d
mov r9, r15
ja 0x180029c03
lea r8, [rdi + r14]
call fcn.18002f970
jmp 0x180029c0c
lea r8, [rbp]
call fcn.18002feb4
cmp r13d, dword [rdi - 0xc]
jg 0x18002a272
mov dword [rdi - 0x10], r13d
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp]
call fcn.1800334b0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r13, rcx
test ecx, ecx
jne 0x180029cde
mov rax, qword [rsp + 0x68]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x180029d58
cmp dword [rdx + 0x10], ecx
jge 0x180029ca9
cmp dword [rax - 0xc], ecx
jl 0x18002a1d8
mov dword [rax - 0x10], ecx
mov byte [rax], cl
jmp 0x180029d58
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029cc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
jmp 0x180029d58
mov rdi, qword [rsp + 0x68]
mov r15d, dword [rdi - 0x10]
lea r14, [rbp]
sub r14, rdi
test ecx, ecx
js 0x18002a267
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x180029d1f
mov edx, r13d
lea rcx, [rsp + 0x68]
call fcn.180001ef0
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
cmp r14, r15
movsxd r15, r13d
mov r9, r15
ja 0x180029d3c
lea r8, [rdi + r14]
call fcn.18002f970
jmp 0x180029d45
lea r8, [rbp]
call fcn.18002feb4
cmp r13d, dword [rdi - 0xc]
jg 0x18002a25c
mov dword [rdi - 0x10], r13d
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp]
call fcn.1800334b0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r13, rcx
test ecx, ecx
jne 0x180029e17
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x180029e91
cmp dword [rdx + 0x10], ecx
jge 0x180029de2
cmp dword [rax - 0xc], ecx
jl 0x18002a1e3
mov dword [rax - 0x10], ecx
mov byte [rax], cl
jmp 0x180029e91
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029df9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
jmp 0x180029e91
mov rdi, qword [rsp + 0x70]
mov r15d, dword [rdi - 0x10]
lea r14, [rbp]
sub r14, rdi
test ecx, ecx
js 0x18002a251
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x180029e58
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.180001ef0
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
cmp r14, r15
movsxd r15, r13d
mov r9, r15
ja 0x180029e75
lea r8, [rdi + r14]
call fcn.18002f970
jmp 0x180029e7e
lea r8, [rbp]
call fcn.18002feb4
cmp r13d, dword [rdi - 0xc]
jg 0x18002a246
mov dword [rdi - 0x10], r13d
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 0xff
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r13, rcx
test ecx, ecx
jne 0x180029f3f
mov rax, qword [rsp + 0x78]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x180029fb9
cmp dword [rdx + 0x10], ecx
jge 0x180029f0a
cmp dword [rax - 0xc], ecx
jl 0x18002a1ee
mov dword [rax - 0x10], ecx
mov byte [rax], cl
jmp 0x180029fb9
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180029f21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
jmp 0x180029fb9
mov rdi, qword [rsp + 0x78]
mov r15d, dword [rdi - 0x10]
lea r14, [rbp]
sub r14, rdi
test ecx, ecx
js 0x18002a23b
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x180029f80
mov edx, r13d
lea rcx, [rsp + 0x78]
call fcn.180001ef0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
cmp r14, r15
movsxd r15, r13d
mov r9, r15
ja 0x180029f9d
lea r8, [rdi + r14]
call fcn.18002f970
jmp 0x180029fa6
lea r8, [rbp]
call fcn.18002feb4
cmp r13d, dword [rdi - 0xc]
jg 0x18002a230
mov dword [rdi - 0x10], r13d
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp]
call fcn.1800334b0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov rcx, r12
lea rdi, [rbp]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r13, rcx
test ecx, ecx
jne 0x18002a076
mov rax, qword [rbp - 0x80]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x18002a0ed
cmp dword [rdx + 0x10], ecx
jge 0x18002a042
cmp dword [rax - 0xc], ecx
jl 0x18002a1f9
mov dword [rax - 0x10], ecx
mov byte [rax], cl
jmp 0x18002a0ed
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18002a059
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
jmp 0x18002a0ed
mov rdi, qword [rbp - 0x80]
mov r15d, dword [rdi - 0x10]
lea r14, [rbp]
sub r14, rdi
test ecx, ecx
js 0x18002a225
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x18002a0b4
mov edx, r13d
lea rcx, [rbp - 0x80]
call fcn.180001ef0
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x58]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
cmp r14, r15
movsxd r15, r13d
mov r9, r15
ja 0x18002a0d1
lea r8, [rdi + r14]
call fcn.18002f970
jmp 0x18002a0da
lea r8, [rbp]
call fcn.18002feb4
cmp r13d, dword [rdi - 0xc]
jg 0x18002a21a
mov dword [rdi - 0x10], r13d
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp]
call fcn.1800334b0
cmp dword [rsi - 0x10], 0
je 0x18002a141
mov rax, qword [rbp - 0x28]
mov ecx, dword [rax - 0x10]
test ecx, ecx
js 0x18002a20f
mov rax, qword [rbp - 0x68]
cmp byte [rax], 0x4b
jne 0x18002a133
cmp ecx, 1
jl 0x18002a204
cmp byte [rax + 1], 0x42
je 0x18002a141
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp - 0x40]
call fcn.18002a4a0
mov dword [rbp - 0x78], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x100]
call fcn.1800334b0
mov rsi, qword [rbp - 0x30]
mov edi, dword [rbp - 0x50]
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x100]
mov edx, edi
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x18002975e
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
nop
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002a2af
mov rbx, qword [rsp + 0x48]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18002a2cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x18002a2eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x58]
call fcn.18000d9b0
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18002f950
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret