Function at 0x180045dcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1d0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rcx
lea rdx, [r11 - 0x150]
lea rcx, [0x180162940]
call fcn.18002b024
mov rdx, qword [rax]
xor r12d, r12d
mov ebx, r12d
cmp dword [rdx - 8], r12d
sete bl
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
lea r14, [0x18015f758]
or r13d, 0xffffffff
cmp rcx, r14
je 0x180045e66
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x180045e66
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
cmp ebx, r12d
je 0x180045e85
lea rdx, str.CDataIESearchHookEntity::IsChanged_78_____Search_URL_is_empty._Not_checking...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x180046450
lea rcx, [0x180162940]
call fcn.180004a24
cmp eax, r12d
jne 0x180045eb0
lea rdx, str.CDataIESearchHookEntity::IsChanged_78_____Search_Installed_flag_is_set_to_False._Not_checking...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x180046450
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1801620e0]
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, r12d
jne 0x180045eef
lea rdx, str.CDataIESearchHookEntity::IsChanged_78_____IE_Not_enabled._Not_checking...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x180046450
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
lea rcx, [rsp + 0x48]
call fcn.1800041c0
nop
lea r8, [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r12d
je 0x180045f84
mov qword [rsp + 0x28], rbx
mov rax, qword [rdi + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str._t_t_tEntry__s_CHANGED_:_err_cannot_open_reg_key___s...
mov r8d, gethostbyaddr
lea rdx, str..DataIESearchHookEntity.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
nop
lea rcx, [rbx - 0xc]
cmp rcx, r14
je 0x180045f7a
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x180045f7a
call fcn.1800d1434
mov eax, 1
jmp 0x180046450
mov ecx, 8
call fcn.1800d1934
cmp rax, r12
je 0x180045f9d
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x180045fa0
mov rax, r12
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov esi, 0x80
mov dword [rsp + 0x40], esi
mov ebx, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xc0]
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0x103
cmp eax, ebp
je 0x18004608b
inc ebx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
call fcn.1800041c0
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.180001910
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x18004604e
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x18004604e
call fcn.1800d1434
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xc0]
mov edx, ebx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebp
jne 0x180045ffe
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub r11, rdx
sar r11, 3
cmp r11, r12
jne 0x180046169
lea rcx, [rdi + 0x128]
call fcn.180001eac
lea rcx, [rdi + 0x68]
call fcn.180001eac
mov r11, qword [0x18015f768]
mov qword [rsp + 0x90], r11
lea rcx, str.URLHOOKEMPTY
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.URLHOOKEMPTY
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.180003e28
lea rdx, [rsp + 0x90]
lea rcx, [rdi + 0x68]
call fcn.180001910
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x180046132
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x180046132
call fcn.1800d1434
nop
lea rcx, [rsp + 0x50]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x18004615f
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x18004615f
call fcn.1800d1434
mov eax, 1
jmp 0x180046450
cmp r11, 1
jne 0x18004634c
mov esi, r12d
mov rbx, r12
mov rax, qword [rdi + 0xf0]
sub rax, qword [rdi + 0xe8]
sar rax, 3
cmp rax, r12
jbe 0x180046256
mov rax, qword [rdi + 0xf0]
sub rax, qword [rdi + 0xe8]
sar rax, 3
cmp rbx, rax
jb 0x1800461b5
call fcn.1800d15f4
mov rdx, qword [rsp + 0x68]
mov rbp, qword [rdi + 0xe8]
mov rax, qword [rsp + 0x70]
sub rax, rdx
sar rax, 3
cmp rax, r12
ja 0x1800461d7
call fcn.1800d15f4
mov rdx, qword [rsp + 0x68]
mov r9, qword [rbp + rbx*8]
mov rax, qword [rdx]
sub r9, rax
movzx ecx, word [rax]
movzx r8d, word [rax + r9]
sub ecx, r8d
jne 0x1800461f8
add rax, 2
test r8d, r8d
jne 0x1800461e2
cmp ecx, r12d
je 0x180046222
inc esi
inc rbx
mov rcx, qword [rdi + 0xf0]
sub rcx, qword [rdi + 0xe8]
sar rcx, 3
movsxd rax, esi
cmp rax, rcx
jb 0x180046194
jmp 0x180046256
lea rcx, [rsp + 0x50]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x18004624f
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x18004624f
call fcn.1800d1434
xor eax, eax
jmp 0x180046450
lea rcx, [rdi + 0x128]
call fcn.180001eac
lea rcx, [rdi + 0x68]
call fcn.180001eac
mov r11, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub r11, rdx
sar r11, 3
cmp r11, r12
ja 0x18004628b
call fcn.1800d15f4
mov rdx, qword [rsp + 0x68]
lea rcx, [rdi + 0x128]
call fcn.180001910
mov r11, qword [0x18015f768]
mov qword [rsp + 0x98], r11
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
sub rax, r8
sar rax, 3
cmp rax, r12
ja 0x1800462c6
call fcn.1800d15f4
mov r8, qword [rsp + 0x68]
mov r8, qword [r8]
lea rdx, str.URLHOOK_s
lea rcx, [rsp + 0x98]
call fcn.180008f64
lea rdx, [rsp + 0x98]
lea rcx, [rdi + 0x68]
call fcn.180001910
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x180046315
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x180046315
call fcn.1800d1434
nop
lea rcx, [rsp + 0x50]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x180046342
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x180046342
call fcn.1800d1434
mov eax, 1
jmp 0x180046450
lea rsi, [rdi + 0x128]
mov rcx, rsi
call fcn.180001eac
lea rcx, [rdi + 0x68]
call fcn.180001eac
mov r11, qword [0x18015f768]
mov qword [rsp + 0x80], r11
lea rcx, str.URLHOOKMULTIPLE
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.URLHOOKMULTIPLE
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.180003e28
lea rdx, [rsp + 0x80]
lea rcx, [rdi + 0x68]
call fcn.180001910
mov edi, r12d
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rax, rcx
sar rax, 3
cmp rax, r12
jbe 0x1800463f8
mov rbx, r12
cmp rbx, rax
jb 0x1800463d2
call fcn.1800d15f4
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx + rbx*8]
mov rcx, rsi
call fcn.180001910
inc edi
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rax, rcx
sar rax, 3
mov ebx, edi
cmp rbx, rax
jb 0x1800463c3
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x18004641e
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x18004641e
call fcn.1800d1434
nop
lea rcx, [rsp + 0x50]
call fcn.1800016ac
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x18004644b
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r12d
jg 0x18004644b
call fcn.1800d1434
mov eax, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret