Function at 0x180008f88
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x110
lea rbp, [rsp + 0x50]
mov qword [rsp], rax
mov rax, 0x10c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180008fa0
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xa8], rbx
mov byte [rbp + 0x33], 0
mov byte [rbp + 0x32], 0
mov byte [rbp + 0x31], 0
mov byte [rbp + 0x30], 0
movss xmm0, dword [0x1800c3fa0]
movss dword [rbp + 0x38], xmm0
mov byte [rbp + 0x30], 1
mov rax, 0xffffffff80000002
lea rdx, [0x180101280]
mov ecx, 0
mov ebx, 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0x30], 0
lea rsi, [rbp + 0x20]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0
mov rsi, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x90], ecx
mov rcx, rax
mov eax, dword [rbp + 0x90]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x18000933c
movzx eax, byte [rbp + 0x30]
test eax, eax
jne 0x180009079
lea rax, [0x1801012ec]
mov rcx, rax
call fcn.180064a90
mov byte [rbp + 0x31], 1
mov byte [rbp + 0x32], 1
mov rax, qword [rbp + 0x20]
lea rdx, [0x1801012dc]
mov ecx, 0
lea rbx, [rbp + 8]
mov qword [rsp + 0x20], 0
lea rsi, [rbp + 0x14]
mov qword [rsp + 0x28], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp + 0x98], rcx
mov rcx, rax
mov rax, qword [rbp + 0x98]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
test eax, eax
jne 0x180009312
movzx eax, byte [rbp + 0x31]
test eax, eax
jne 0x1800090ec
lea rax, [0x1801012f0]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 8]
cmp eax, 1
jne 0x180009312
movzx eax, byte [rbp + 0x32]
test eax, eax
jne 0x18000910f
lea rax, [0x1801012fc]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x14]
mov rcx, rax
call fcn.180062320
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x33], 1
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x58], rax
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x180009141
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x180009312
movzx eax, byte [rbp + 0x30]
test eax, eax
jne 0x180009165
lea rax, [0x1801012ec]
mov rcx, rax
call fcn.180064a90
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x18000917c
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov byte [rbp + 0x31], 1
mov byte [rbp + 0x32], 1
mov rax, qword [rbp + 0x20]
lea rdx, [0x1801012cc]
mov ecx, 0
lea rbx, [rbp + 8]
mov rsi, qword [rbp + 0x58]
mov qword [rsp + 0x20], rsi
lea rsi, [rbp + 0x14]
mov qword [rsp + 0x28], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp + 0xa0], rcx
mov rcx, rax
mov rax, qword [rbp + 0xa0]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
test eax, eax
jne 0x1800092ef
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x1800091ef
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
mov edx, 0x2e
mov rcx, rax
call fcn.180001794
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x1800092b9
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x180009228
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
mov edx, 0x2e
mov rcx, rax
call fcn.180001794
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov edx, 0x2e
mov rcx, rax
call fcn.180001794
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
test rax, rax
je 0x1800092b9
mov word [rbp + 0x34], 0
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x180009278
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
mov edx, 0x2e
mov rcx, rax
call fcn.180001794
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov edx, 0x2e
mov rcx, rax
call fcn.180001794
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx edx, word [rbp + 0x34]
mov word [rax], dx
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x1800092d0
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
mov rcx, rax
call fcn.180067920
movsd qword [rbp + 0x70], xmm0
movsd xmm0, qword [rbp + 0x70]
cvtsd2ss xmm0, xmm0
movss dword [rbp + 0x38], xmm0
movzx eax, byte [rbp + 0x33]
test eax, eax
jne 0x180009306
lea rax, [0x180101308]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x58]
mov rcx, rax
call fcn.1800622b0
movzx eax, byte [rbp + 0x30]
test eax, eax
jne 0x180009329
lea rax, [0x1801012ec]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 0x20]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rax
call rdx
mov dword [rbp + 0x44], eax
movss xmm0, dword [rbp + 0x38]
movss dword [rbp + 0x4c], xmm0
lea rax, reloc.WS2_32.dll_closesocket
mov rdx, rax
mov rcx, rbp
call fcn.180061140
movss xmm0, dword [rbp + 0x4c]
mov rbx, qword [rbp + 0xa8]
mov rsi, qword [rbp + 0xb0]
lea rsp, [rbp + 0xc0]
pop rbp
ret