Function at 0x18002b22c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor r14d, r14d
mov rsi, rcx
mov ebx, 0x20a
mov dword [rsp + 0x44], r14d
mov r8d, ebx
mov qword [rsp + 0x50], r14
xor edx, edx
lea rcx, [rbp + 0x170]
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x48], 0x105
mov dil, byte [0x1800b78f3]
test dil, 0x20
jne 0x180044642
mov r8, rbx
lea rcx, [rsp + 0x60]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x40], r14d
lea r12, str.ParametersDnsConnections
test dil, 0x10
jne 0x180044662
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x18004468e
sub ebx, dword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov eax, dword [rsp + 0x40]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x18002b38b
mov r8d, 0x7ffffffe
mov r9, r12
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x18002b36f
movzx eax, word [r9 + rdx]
test ax, ax
je 0x18002b36f
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x18002b34f
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r14w
test ebx, ebx
js 0x1800446be
test byte [0x1800b78f3], 0x10
jne 0x1800446e1
mov r12d, 0x20019
test ebx, ebx
js 0x18004472a
lea rax, [rsp + 0x58]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18002b3e9
test byte [0x1800b78f1], 4
jne 0x180044737
cmp ebx, 2
je 0x180044805
cmp ebx, 0x490
je 0x180044805
test ebx, ebx
jle 0x18002b40d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x180044756
mov edi, r14d
xor edx, edx
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180044763
test byte [0x1800b78f3], 0x20
jne 0x180044827
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18002b479
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18002b48f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
mov ecx, 0x13
lea rdx, [0x18009f2c0]
mov r8, rsi
call fcn.1800879b4
mov dil, byte [0x1800b78f3]
jmp 0x18002b29e
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094330
nop
jmp 0x18002b2c8
test byte [0x1800b78f3], 0x10
je 0x1800446b3
mov dword [rsp + 0x28], edi
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094248
mov ecx, edi
call fcn.1800828c8
mov ebx, eax
jmp 0x180044703
test byte [0x1800b78f3], 0x10
je 0x18002b3a0
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x180044703
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094124
test byte [0x1800b78f3], 0x10
je 0x18002b3a0
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18002b3a0
mov ecx, ebx
call fcn.180011928
nop
jmp 0x18002b3d6
mov ecx, 0xa
lea r8, [rsp + 0x60]
mov r9d, ebx
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18002b3e9
mov dword [rsp + 0x44], 0xf6
jmp 0x18002b451
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18004477e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1800447b5
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800447f8
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.18006baa0
cmp eax, 0x80070490
je 0x1800447e7
cmp eax, 0x80070002
je 0x1800447e7
mov ebx, eax
test eax, eax
jns 0x1800447e7
mov dword [rsp + 0x44], 0x119
jmp 0x18002b451
inc edi
mov dword [rsp + 0x48], 0x105
mov edx, edi
jmp 0x18002b418
mov dword [rsp + 0x44], 0x10a
jmp 0x18002b451
test byte [0x1800b78f3], 0x20
je 0x18004481f
mov ecx, 0x14
lea rdx, [0x18009f2c0]
call fcn.180087008
mov ebx, r14d
jmp 0x18002b451
mov ecx, 0x15
lea rdx, [0x18009f2c0]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18002b45e