Function at 0x1800982b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x180142d48]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x18009854c
test edx, edx
je 0x18009854c
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.18009b170
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r14d, r14d
test eax, eax
jne 0x1800984d8
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x398], rdi
mov edi, r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1800984c5
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180098489
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ServiceName
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18009847e
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.18009b170
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x150]
call fcn.180098580
test eax, eax
je 0x18009847e
cmp byte [rsp + 0x60], r14b
je 0x180098435
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x18009847e
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x180098470
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x180098470
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x180098450
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r14b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180098380
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x398]
cmp byte [rsp + 0x60], r14b
je 0x18009854c
lea rax, [rsi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
mov edx, r14d
mov r9d, 0x80070057
mov rcx, rsi
cmova edx, r9d
test edx, edx
js 0x180098543
test esi, esi
je 0x18009852c
sub r8, rcx
lea rdx, [rsp + 0x60]
sub rdx, rbx
nop
lea rax, [r8 + rcx]
test rax, rax
je 0x18009852c
movzx eax, byte [rdx + rbx]
test al, al
je 0x18009852c
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x180098510
test rcx, rcx
lea rax, [rbx - 1]
mov edx, 0x8007007a
cmovne rax, rbx
cmovne edx, r14d
mov byte [rax], r14b
not edx
shr edx, 0x1f
mov eax, edx
jmp 0x18009854e
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180050ad0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rsi
pop rbp
ret