Function at 0x18000f290
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 9], edi
mov dword [rbp + 0x77], edi
mov dword [rbp + 0x7f], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x78], rdi
lea rax, [rbp + 0x7f]
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000f586
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180011cb8
mov r15, rax
mov dword [rbp + 3], edi
mov ecx, dword [rbp + 0x7f]
inc ecx
mov dword [rbp - 5], ecx
call fcn.180011cb8
mov r13, rax
mov esi, edi
cmp dword [rbp - 9], edi
jbe 0x18000f56d
lea rax, [rbx + 0x28]
mov qword [rbp + 0x17], rax
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov r8d, eax
xor edx, edx
mov rcx, r15
call fcn.180016fd0
mov r11d, dword [rbp + 0x7f]
inc r11d
mov dword [rbp - 5], r11d
mov r8d, r11d
xor edx, edx
mov rcx, r13
call fcn.180016fd0
lea r11, [rbp - 5]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov r8, r15
mov edx, esi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
mov r8, r15
lea rdx, [0x180032a84]
lea rcx, [rbp + 0xf]
call fcn.18000fd30
mov ecx, 0xa44
call fcn.180014998
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, 0xa44
call fcn.180014320
mov ecx, gethostbyname
call fcn.180014998
mov r12, rax
mov qword [rbp + 7], rax
mov rcx, qword [r13 + 0xa44]
mov qword [rax], rcx
mov rcx, qword [r13 + 0xa4c]
mov qword [rax + 8], rcx
mov rcx, qword [r13 + 0xa54]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13 + 0xa5c]
mov qword [rax + 0x18], rcx
mov rcx, qword [r13 + 0xa64]
mov qword [rax + 0x20], rcx
mov rcx, qword [r13 + 0xa6c]
mov qword [rax + 0x28], rcx
movsxd rcx, dword [rdi + 0x208]
call fcn.180011cb8
mov rbx, rax
movsxd r8, dword [rdi + 0x208]
lea rdx, [r13 + 0xa74]
mov rcx, rax
call fcn.180014320
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rbx
mov rax, qword [rbp + 0x17]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx + 0x438]
mov dword [r12 + 0x10], eax
mov eax, dword [rcx + 0x440]
mov dword [r12 + 0x14], eax
mov eax, dword [rcx + 0x448]
mov dword [r12 + 0x28], eax
mov qword [r12], rcx
lea rax, [rbp + 7]
mov rcx, qword [0x180044f80]
cmp rax, rcx
jae 0x18000f50f
lea rdx, [rbp + 7]
mov rax, qword [0x180044f78]
cmp rax, rdx
ja 0x18000f50f
lea rbx, [rbp + 7]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [0x180044f88]
jne 0x18000f501
call fcn.18000fa10
mov rcx, qword [0x180044f80]
mov rax, qword [0x180044f78]
test rcx, rcx
je 0x18000f533
mov rax, qword [rax + rbx*8]
mov qword [rcx], rax
jmp 0x18000f52c
cmp rcx, qword [0x180044f88]
jne 0x18000f524
call fcn.18000fa10
mov rcx, qword [0x180044f80]
test rcx, rcx
je 0x18000f533
mov qword [rcx], r12
mov rcx, qword [0x180044f80]
add rcx, 8
mov qword [0x180044f80], rcx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f55d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + htons]
inc esi
cmp esi, dword [rbp - 9]
mov edi, 0
jb 0x18000f362
mov rcx, r15
call fcn.180014e80
mov rcx, r13
call fcn.180014e80
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret