Function at 0x18001b510
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
lea rax, [r11 - 0x38]
mov ebp, r9d
mov qword [r11 - 0x40], rax
mov r14d, r8d
mov qword [r11 - 0x48], r13
lea r9, [r11 - 0x34]
mov dword [r11 - 0x34], r13d
xor r8d, r8d
mov dword [r11 - 0x38], r13d
mov rsi, rdx
mov rdi, rcx
mov r15d, r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18001b590
test byte [0x1800b78f1], 4
jne 0x180040f42
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x34]
cmp ebp, eax
jne 0x180040f5f
mov qword [rsp + 0x70], r12
mov r12, qword [rsp + 0x90]
cmp eax, 1
jne 0x180040f69
mov r15d, dword [rsp + 0x30]
mov eax, 4
cmp r15d, eax
cmovbe r15d, eax
mov rax, qword [0x1800b8500]
mov dword [rsp + 0x30], r15d
test rax, rax
jne 0x180040f97
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x180040fbf
mov r8d, r15d
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov r15, rbx
test rbx, rbx
je 0x180040fd7
mov dword [rbx], r13d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x180041006
mov ecx, dword [rsp + 0x34]
cmp ecx, 1
jne 0x180040fe1
mov ecx, dword [rsp + 0x30]
test r14b, 0x10
jne 0x180040ff4
test ecx, ecx
je 0x18001b69f
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18001b676
mov word [rbx + rax*2 - 2], r13w
mov ecx, dword [rsp + 0x30]
test r14b, 1
jne 0x180041011
cmp ebp, 4
je 0x18001b689
mov qword [r12], rbx
mov rax, qword [rsp + 0x98]
mov dword [rax], ecx
mov eax, edi
mov r12, qword [rsp + 0x70]
jmp 0x18001b575
mov dword [rbx], r13d
jmp 0x18001b672
mov ecx, 0xc
lea rdx, [0x18009f440]
mov r9d, ebx
mov r8, rsi
call fcn.180087538
nop
jmp 0x18001b573
mov eax, 0x3f2
jmp 0x18001b575
cmp eax, 2
jb 0x180040f85
cmp eax, 3
jbe 0x18001b5b2
cmp eax, 4
je 0x180040f8f
cmp eax, 7
je 0x18001b5b2
mov eax, 0x57
jmp 0x18001b695
mov rbx, r12
jmp 0x18001b611
mov ecx, r15d
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18001b602
mov r8d, r15d
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18001b602
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18001b5e8
mov eax, 0xe
jmp 0x18001b695
cmp ecx, 2
je 0x18001b651
cmp ecx, 7
jne 0x180041053
jmp 0x18001b651
test ecx, ecx
je 0x180041001
cmp dword [rbx], r13d
jne 0x18001b65f
mov edi, 0xd
cmp ebp, 4
je 0x18004105c
mov qword [r12], r13
jmp 0x180041060
add ecx, ecx
call fcn.180017d38
mov rsi, rax
test rax, rax
jne 0x180041025
lea edi, [rax + 0xe]
jmp 0x180041006
mov edx, dword [rsp + 0x30]
mov r8, rsi
mov rcx, rbx
lea r9d, [rdx + rdx]
shr edx, 1
call fcn.180079130
test eax, eax
jne 0x180041048
mov rcx, rsi
call sym.DNSAPI.dll_DnsApiFree
jmp 0x180041001
mov rcx, r15
call sym.DNSAPI.dll_DnsApiFree
mov rbx, rsi
mov ecx, dword [rsp + 0x30]
jmp 0x18001b680
mov dword [r12], r13d
mov rax, qword [rsp + 0x98]
mov rcx, r15
mov dword [rax], r13d
call sym.DNSAPI.dll_DnsApiFree
test edi, edi
je 0x18001b693
test byte [0x1800b78f1], 4
je 0x18001b693
mov ecx, 0xd
lea rdx, [0x18009f440]
mov r8d, edi
call fcn.1800876bc
nop
jmp 0x18001b693