Function at 0x180019210
Capabilities:
Query or enumerate registry value

Disassembly:
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
jmp 0x180019d97
cmp dword [rsp + 0x44], 4
jne 0x18003db0c
cmp dword [rsp + 0x40], 4
je 0x1800191ec
jmp 0x18003db0c
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1800191f4
xor ecx, ecx
lea r9, [rsp + 0x44]
xor r8d, r8d
mov dword [rsp + 0x44], ecx
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x18001918e
test edi, edi
jne 0x180019383
mov rbx, qword [rsp + 0x48]
jmp 0x1800193dc
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r10, qword [rbp + 0x120]
mov ebx, r9d
xor r9d, r9d
mov r11, r8
mov qword [rsp + 0x68], r8
mov rax, rdx
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x48], rcx
mov r8, rcx
mov edi, r9d
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x70], r9
mov rcx, qword [0x18008a130]
lea rsi, [0x18008a130]
cmp rcx, rsi
je 0x180019289
test byte [rcx + 0x1c], 4
jne 0x180045124
cmp dword [0x18008a0d8], edi
je 0x180030137
cmp rcx, rsi
je 0x1800192a4
test byte [rcx + 0x1c], 4
jne 0x1800451c2
cmp ebx, 0x65
ja 0x1800452c7
mov rdx, rbx
lea rcx, [0x180000000]
shl rdx, 4
mov qword [rsp + 0x58], rdx
mov rsi, qword [rdx + rcx + 0x8b1f0]
test rsi, rsi
je 0x1800452c7
test rax, rax
jne 0x1800191a6
test r11, r11
jne 0x18001941d
test r8, r8
je 0x180045210
mov rcx, qword [r8]
lea rax, [0x180000000]
test rcx, rcx
jne 0x180045240
mov rcx, qword [r8 + 0x18]
test rcx, rcx
je 0x18001935b
cmp byte [rdx + rax + 0x8b1ff], 0
je 0x18001935b
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], r9d
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x44], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x1800306c4
test edi, edi
je 0x1800191f4
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rax, qword [r8 + 0x10]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18001937e
lea rcx, [0x180000000]
cmp byte [rdx + rcx + 0x8b1fe], 0
jne 0x180019f44
mov edi, 2
mov eax, dword [reloc.WS2_32.dll_htons]
xor r8d, r8d
mov edx, r8d
cmp eax, 0xffffffff
je 0x1800193b5
cmp eax, ebx
je 0x180019d5d
inc edx
lea rax, [0x180000000]
lea rcx, [rdx + rdx*2]
mov eax, dword [rax + rcx*4 + 0x8b930]
cmp eax, 0xffffffff
jne 0x180019394
test edi, edi
je 0x1800191f4
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
lea rcx, [0x180000000]
mov eax, dword [rax + rcx + 0x8b1f8]
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
lea rax, [rsp + 0x78]
cmp rbx, rax
je 0x1800452b9
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x180019411
mov eax, edi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.180001000
add rsp, 0x1d8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1800193f4
xor edx, edx
mov rcx, r11
call fcn.180019450
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1800451f6
mov qword [rsp + 0x70], rax
jmp 0x1800191ab
mov eax, edx
lea rcx, [rax + rax*2]
lea rax, [0x180000000]
mov r9d, dword [rax + rcx*4 + 0x8b934]
mov esi, dword [rax + rcx*4 + 0x8b938]
cmp r9d, 0xffffffff
je 0x1800193b5
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x18000d870
mov rax, r8
mov rdx, r8
lea rcx, [rsp + 0x40]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.180019210
mov edi, eax
test eax, eax
jne 0x1800193c2
jmp 0x18003db06
xor ecx, ecx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x44]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x180019f93
test edi, edi
jne 0x18001937e
mov rbx, qword [rsp + 0x48]
jmp 0x1800193dc
cmp dword [rsp + 0x40], 4
jne 0x18003db17
cmp dword [rsp + 0x44], 4
je 0x180019f80
jmp 0x18003db17
lea rcx, [0x18008ac20]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
cmp dword [0x18008a0d8], edi
jne 0x1800301d9
lea rcx, [sym.DNSAPI.dll_DnsGlobals]
xor edx, edx
mov r8d, 0x120
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x11c
mov dword [0x18008a36c], 1
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x11c
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetVersionExW]
test eax, eax
je 0x18004516d
movzx eax, byte [rbp + 0xba]
cmp al, 1
je 0x18003db22
cmp al, 3
jne 0x18003c012
mov dword [0x18008a374], 1
mov dword [0x18008a0d8], 1
mov rcx, qword [0x18008a130]
cmp rcx, rsi
je 0x1800301d9
test byte [rcx + 0x1c], 4
jne 0x18004518c
lea rcx, [0x18008ac20]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
mov rcx, qword [0x18008a130]
mov rax, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
xor r9d, r9d
jmp 0x180019295
cmp dword [rsp + 0x40], 4
jne 0x180045282
cmp dword [rsp + 0x44], 4
je 0x180019349
jmp 0x180045282
cmp al, 2
jne 0x1800301b9
mov dword [0x18008a37c], 1
jmp 0x1800301af
jmp 0x18004528c
mov edi, 0x3f2
jmp 0x1800191ec
mov edi, 0x3f2
jmp 0x180019f80
mov dword [0x18008a370], 1
jmp 0x1800301b9
mov rcx, qword [rcx + 0x10]
mov r9, r8
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r11
lea r8, [0x180082450]
mov edx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x20], rax
call fcn.18005c7ec
mov rcx, qword [0x18008a130]
mov rax, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
xor r9d, r9d
jmp 0x180019289
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x114
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetVersionExW]
test eax, eax
je 0x1800301d9
jmp 0x1800301b9
mov eax, dword [0x18008a37c]
mov r9d, dword [0x18008a370]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [0x18008a374]
lea r8, [0x180082450]
mov edx, 0xa
mov dword [rsp + 0x20], eax
call fcn.18005b3d8
nop
jmp 0x1800301d9
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082450]
mov edx, reloc.WS2_32.dll_inet_addr
mov r9d, ebx
call fcn.180058fb0
mov rax, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
xor r9d, r9d
jmp 0x1800192a4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x180019383
mov edi, 0x3f3
jmp 0x180019383
lea rcx, [rsp + 0x78]
call fcn.1800199b0
mov edi, eax
test eax, eax
jne 0x180019383
mov rdx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x48], r8
xor r9d, r9d
jmp 0x1800192ec
cmp byte [rdx + rax + 0x8b1fc], 0
je 0x1800192ff
mov r8, r10
mov rdx, rsi
call fcn.180061868
mov edi, eax
test eax, eax
je 0x1800191f4
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
xor r9d, r9d
lea rax, [0x180000000]
jmp 0x1800192ff
mov edi, 0x3f2
jmp 0x180019349
test esi, esi
je 0x1800452a9
cmp dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x50]
mov ecx, 0
sete cl
mov dword [rax], ecx
jmp 0x1800193dc
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x40]
mov dword [rax], ecx
jmp 0x1800193dc
mov rcx, rbx
call fcn.180019950
nop
jmp 0x1800193f4
mov dword [r10], r9d
mov eax, 0x57
jmp 0x1800193f6