Function at 0x180018034
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov ebx, r9d
mov r15, rdx
mov r13, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x18001805d
mov edi, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r12d, r12d
test rax, rax
lea rcx, [rbp - 0x20]
mov r8d, edi
setne r12b
call fcn.180015424
mov eax, edi
cdq
lea rcx, [rbp - 0x20]
sub eax, edx
sar eax, 1
mov edx, eax
mov r14d, eax
mov dword [rbp - 0x30], eax
call fcn.18001546c
lea rcx, [rbp - 0x20]
mov edx, r14d
mov rsi, rax
call fcn.18001546c
or ebx, 0x20019
mov r14, rax
lea rax, [rbp - 0x28]
xor r8d, r8d
mov r9d, ebx
mov rdx, r15
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800180e4
mov edx, eax
mov ecx, 0x3f
call fcn.18000d508
jmp 0x180018277
mov rbx, qword [rbp + 0x70]
mov eax, edi
movsxd r13, r12d
cdq
xor r15d, r15d
and edx, 7
lea r12d, [rdx + rax]
sar r12d, 3
mov eax, dword [rbp - 0x30]
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x68], eax
call fcn.180019f30
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov rcx, r14
call fcn.180019f30
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8, rsi
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x1800181c3
test eax, eax
jne 0x180018228
test r13, r13
je 0x180018187
mov r8, qword [rbp + 0x50]
mov rax, rsi
sub r8, rsi
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x180018183
inc rax
test edx, edx
jne 0x180018170
test ecx, ecx
jne 0x1800181c3
lea rdx, str.__24s
mov r8, rsi
mov rcx, rbx
call fcn.18000d124
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x1800181b4
cmp eax, 2
jbe 0x180018214
cmp eax, 3
je 0x1800181df
cmp eax, 4
je 0x1800181cb
cmp eax, 7
je 0x180018214
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, rbx
call fcn.18000d124
inc r15d
jmp 0x1800180fc
mov r8d, dword [r14]
lea rdx, [0x18002cc8c]
mov rcx, rbx
call fcn.18000d124
jmp 0x1800181c3
xor edi, edi
cmp dword [rbp + 0x68], edi
jbe 0x1800181b4
movsx ecx, byte [rdi + r14]
lea rdx, [0x18002cc90]
movzx r8d, cl
mov rcx, rbx
cmp r8d, 0xf
jbe 0x180018206
lea rdx, [0x18002cc94]
call fcn.18000d124
inc edi
cmp edi, dword [rbp + 0x68]
jb 0x1800181e6
jmp 0x1800181b4
lea rdx, [0x18002c750]
mov r8, r14
mov rcx, rbx
call fcn.18000d124
jmp 0x1800181c3
xor edi, edi
test r13, r13
jne 0x18001826d
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
call fcn.180019f30
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x18001826d
lea rdx, str._s_n
mov r8, rsi
mov rcx, rbx
call fcn.18000d124
inc edi
jmp 0x18001822f
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret