Function at 0x180018b74
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov ebx, r9d
mov r15, rdx
mov r13, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x180018b9d
mov edi, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r12d, r12d
test rax, rax
lea rcx, [rbp - 0x20]
mov r8d, edi
setne r12b
call fcn.18001590c
mov eax, edi
cdq
lea rcx, [rbp - 0x20]
sub eax, edx
sar eax, 1
mov edx, eax
mov r14d, eax
mov dword [rbp - 0x30], eax
call fcn.180015950
lea rcx, [rbp - 0x20]
mov edx, r14d
mov rsi, rax
call fcn.180015950
or ebx, 0x20019
mov r14, rax
lea rax, [rbp - 0x28]
xor r8d, r8d
mov r9d, ebx
mov rdx, r15
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180018c24
mov edx, eax
mov ecx, 0x3f
call fcn.18000d50c
jmp 0x180018db7
mov rbx, qword [rbp + 0x70]
mov eax, edi
movsxd r13, r12d
cdq
xor r15d, r15d
and edx, 7
lea r12d, [rdx + rax]
sar r12d, 3
mov eax, dword [rbp - 0x30]
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x68], eax
call fcn.18001aa50
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov rcx, r14
call fcn.18001aa50
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8, rsi
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x180018d03
test eax, eax
jne 0x180018d68
test r13, r13
je 0x180018cc7
mov r8, qword [rbp + 0x50]
mov rax, rsi
sub r8, rsi
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x180018cc3
inc rax
test edx, edx
jne 0x180018cb0
test ecx, ecx
jne 0x180018d03
lea rdx, str.__24s
mov r8, rsi
mov rcx, rbx
call fcn.18000d128
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x180018cf4
cmp eax, 2
jbe 0x180018d54
cmp eax, 3
je 0x180018d1f
cmp eax, 4
je 0x180018d0b
cmp eax, 7
je 0x180018d54
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, rbx
call fcn.18000d128
inc r15d
jmp 0x180018c3c
mov r8d, dword [r14]
lea rdx, [0x18002dd04]
mov rcx, rbx
call fcn.18000d128
jmp 0x180018d03
xor edi, edi
cmp dword [rbp + 0x68], edi
jbe 0x180018cf4
movsx ecx, byte [rdi + r14]
lea rdx, [0x18002dd08]
movzx r8d, cl
mov rcx, rbx
cmp r8d, 0xf
jbe 0x180018d46
lea rdx, [0x18002dd0c]
call fcn.18000d128
inc edi
cmp edi, dword [rbp + 0x68]
jb 0x180018d26
jmp 0x180018cf4
lea rdx, [0x18002d790]
mov r8, r14
mov rcx, rbx
call fcn.18000d128
jmp 0x180018d03
xor edi, edi
test r13, r13
jne 0x180018dad
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
call fcn.18001aa50
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180018dad
lea rdx, str._s_n
mov r8, rsi
mov rcx, rbx
call fcn.18000d128
inc edi
jmp 0x180018d6f
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret