Function at 0x18001ab30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push r12
push r15
lea rbp, [r11 - 0x6f8]
sub rsp, 0x7e0
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov qword [r11 + 0x18], rbx
mov r12, rcx
mov qword [r11 - 0x20], rsi
lea rcx, [rbp + 0x1f0]
mov qword [r11 - 0x30], r13
mov ebx, 0xa0
mov r13, rdx
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov esi, 0x20a
lea rcx, [rbp + 0x290]
mov r8d, esi
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov r8d, esi
lea rcx, [rbp + 0x4a0]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x70], r15
mov dword [rsp + 0x78], r15d
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x80], r15d
mov dword [rbp - 0x7c], r15d
mov dword [rbp - 0x78], r15d
mov dword [rbp - 0x74], r15d
mov dword [rsp + 0x7c], r15d
test byte [0x1800b78f1], 4
jne 0x1800408ca
mov qword [rsp + 0x7d0], rdi
mov qword [rsp + 0x7c0], r14
test r13, r13
je 0x180040ed9
cmp dword [r13], 1
jne 0x180040ed9
test r12, r12
je 0x180040eb0
xorps xmm0, xmm0
lea rax, [rbp + 0x1f0]
movups xmmword [rbp - 0x30], xmm0
xor r8d, r8d
mov word [rbp - 0x2e], bx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlStringFromGUIDEx]
nop dword [rax + rax]
test eax, eax
js 0x180040eb0
lea rax, [rbp + 0x1f0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x290]
lea rax, [0x18009e2d0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x105
mov qword [rsp + 0x20], r15
call fcn.18001b6b0
mov ebx, eax
test eax, eax
js 0x1800408d8
lea rax, [rbp + 0x1f0]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x4a0]
lea rax, str.InterfaceSpecificParameters
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x105
lea rax, [0x18009e288]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.18001b6b0
mov ebx, eax
test eax, eax
js 0x18004090b
mov r8, rsi
lea rcx, [rbp - 0x20]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x70], r15d
test byte [0x1800b78f3], 0x10
jne 0x180040916
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SystemCurrentControlSetServicesTcpipParametersInterfaces
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.DnscacheTcpipInterfaces
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov edi, 0x7ffffffe
mov r14d, 0x5c
mov ebx, eax
test eax, eax
js 0x180040948
mov edx, dword [rsp + 0x70]
mov ecx, esi
mov eax, edx
sub ecx, edx
shr rax, 1
mov ebx, r15d
mov edx, ecx
lea rax, [rbp + rax*2 - 0x20]
shr rdx, 1
mov word [rax - 2], r14w
je 0x180040982
test ebx, ebx
js 0x18004099a
mov ebx, r15d
test rdx, rdx
je 0x18004098c
mov r8, rdi
lea r9, [rbp + 0x290]
sub r8, rdx
sub r9, rax
nop dword [rax]
lea rcx, [rdx + r8]
test rcx, rcx
je 0x18001adb5
movzx ecx, word [rax + r9]
test cx, cx
je 0x18001adb5
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x18001ad90
jmp 0x18004098c
test rdx, rdx
je 0x18004098c
mov word [rax], r15w
test ebx, ebx
js 0x1800409a8
test byte [0x1800b78f3], 0x10
jne 0x1800409cf
test ebx, ebx
js 0x180040a17
lea rax, [rbp - 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
jne 0x18001b48f
test byte [r13 + 8], 1
jne 0x18001b32e
mov r8, rsi
lea rcx, [rbp - 0x20]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
mov dword [rsp + 0x70], eax
test byte [0x1800b78f3], 0x10
jne 0x180040b6e
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180040ba0
mov ecx, dword [rsp + 0x70]
lea rdx, [rbp - 0x20]
mov eax, ecx
sub esi, ecx
shr rax, 1
mov ecx, esi
lea rdx, [rdx + rax*2]
shr rcx, 1
mov esi, 0
mov word [rdx - 2], r14w
mov ebx, esi
je 0x180040bdc
test ebx, ebx
js 0x180040bf4
mov ebx, esi
test rcx, rcx
je 0x180040be6
sub rdi, rcx
lea r8, [rbp + 0x4a0]
sub r8, rdx
nop dword [rax]
lea rax, [rcx + rdi]
test rax, rax
je 0x18001aef5
movzx eax, word [rdx + r8]
test ax, ax
je 0x18001aef5
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x18001aed0
jmp 0x180040be6
test rcx, rcx
je 0x180040be6
mov word [rdx], si
test ebx, ebx
js 0x180040c02
test byte [0x1800b78f3], 0x10
jne 0x180040c29
test ebx, ebx
js 0x180040c71
lea rax, [rbp - 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18001b4aa
mov rdi, qword [rbp - 0x40]
lea rax, [rsp + 0x74]
mov r14, qword [str.RegistrationEnabled]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x70], esi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov dword [rsp + 0x74], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov ebx, 1
test eax, eax
je 0x180040c9c
test byte [0x1800b78f0], 4
jne 0x180040cb8
test esi, esi
je 0x18001afb6
mov dword [rbp - 0x80], ebx
mov r14, qword [str.RegisterAdapterName]
lea r9, [rsp + 0x74]
xor eax, eax
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x74], eax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x180040cd5
test byte [0x1800b78f0], 4
jne 0x180040cf4
xor eax, eax
test esi, esi
je 0x18001b018
mov dword [rbp - 0x7c], eax
mov r14, qword [str.EnableMulticast]
lea r9, [rsp + 0x74]
mov dword [rsp + 0x74], eax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x28], rax
mov rdx, r14
lea rax, [rbp - 0x78]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x180040d11
test byte [0x1800b78f0], 4
jne 0x180040d2d
test esi, esi
je 0x18001b076
mov dword [rbp - 0x78], ebx
mov r14, qword [str.QueryAdapterName]
lea r9, [rsp + 0x74]
xor eax, eax
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x74], eax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rbp - 0x74]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x180040d4a
test byte [0x1800b78f0], 4
jne 0x180040d66
test esi, esi
je 0x18001b0d6
mov dword [rbp - 0x74], ebx
mov r9, qword [rbp - 0x70]
test r9, r9
jne 0x180040d83
xor esi, esi
mov rdx, qword [str.Domain]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9d, ebx
lea rax, [rbp - 0x68]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18001b510
cmp eax, 0xe
je 0x180040db4
test byte [r13 + 8], bl
lea rax, [rsp + 0x78]
mov rdx, qword [str.SearchList]
mov r9d, ebx
cmovne rdi, qword [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call fcn.18001b510
cmp eax, 0xe
je 0x180040dbf
mov rdx, qword [str.NameServer]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9d, ebx
lea rax, [rbp - 0x58]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18001b510
cmp eax, 0xe
je 0x180040dca
mov rdx, qword [str.ProfileNameServer]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9d, ebx
lea rax, [rbp - 0x50]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18001b510
cmp eax, 0xe
je 0x180040dd5
mov r10, qword [rbp - 0x70]
test r10, r10
jne 0x180040de0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18001b1d0
mov qword [r13 + 0x10], rcx
mov qword [rbp - 0x68], rsi
mov rcx, qword [rbp - 0x60]
test rcx, rcx
jne 0x180040e1f
mov rcx, qword [rbp - 0x58]
test rcx, rcx
jne 0x18001b321
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x180040e2c
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x180040e39
cmp dword [rbp - 0x80], 0
je 0x180040e46
mov ecx, ebx
cmp dword [rbp - 0x7c], 0
mov dword [r13 + 0x28], ecx
jne 0x180040e4d
mov r8d, esi
cmp dword [rbp - 0x78], 0
mov dword [r13 + 0x2c], r8d
je 0x180040e55
mov r9d, ebx
cmp dword [rbp - 0x74], 0
mov dword [r13 + 0x30], r9d
je 0x180040e5d
mov edx, ebx
cmp dword [rsp + 0x7c], 0
mov dword [r13 + 0x34], edx
jne 0x18001b24f
mov ebx, esi
mov dword [r13 + 0x40], ebx
test byte [0x1800b78f1], 4
jne 0x180040e64
mov rcx, qword [rbp - 0x40]
mov r14, qword [rsp + 0x7c0]
mov r13, qword [rsp + 0x7c8]
mov rdi, qword [rsp + 0x7d0]
mov rsi, qword [rsp + 0x7d8]
mov rbx, qword [rsp + 0x810]
test rcx, rcx
je 0x18001b29d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x18001b47e
mov r10, qword [rbp - 0x70]
test r10, r10
jne 0x180040ee4
mov rcx, qword [rbp - 0x68]
test rcx, rcx
jne 0x180040ef9
mov rcx, qword [rbp - 0x60]
test rcx, rcx
jne 0x180040f04
mov rcx, qword [rbp - 0x58]
test rcx, rcx
jne 0x180040f0f
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x180040f1a
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x180040f25
test r15d, r15d
jne 0x18001b4bc
mov eax, r15d
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x7e0
pop r15
pop r12
pop rbp
ret
mov qword [r13 + 0x18], rcx
mov qword [rbp - 0x58], rsi
jmp 0x18001b1ea
mov r8, rsi
lea rcx, [rbp - 0x20]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor r15d, r15d
mov dword [rsp + 0x70], r15d
test byte [0x1800b78f3], 0x10
jne 0x180040a42
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SystemCurrentControlSetServicesTcpip6ParametersInterfaces
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.DnscacheTcpip6Interfaces
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180040a74
mov ecx, dword [rsp + 0x70]
lea rdx, [rbp - 0x20]
mov eax, ecx
mov ebx, r15d
shr rax, 1
lea rdx, [rdx + rax*2]
mov eax, esi
sub eax, ecx
mov word [rdx - 2], r14w
mov ecx, eax
shr rcx, 1
je 0x180040aae
test ebx, ebx
js 0x180040ac6
mov ebx, r15d
test rcx, rcx
je 0x180040ab8
mov r8, rdi
lea r9, [rbp + 0x290]
sub r8, rcx
sub r9, rdx
nop dword [rax]
lea rax, [rcx + r8]
test rax, rax
je 0x18001b405
movzx eax, word [rdx + r9]
test ax, ax
je 0x18001b405
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x18001b3e0
jmp 0x180040ab8
test rcx, rcx
je 0x180040ab8
mov word [rdx], r15w
test ebx, ebx
js 0x180040ad4
test byte [0x1800b78f3], 0x10
jne 0x180040afb
test ebx, ebx
js 0x180040b43
lea rax, [rbp - 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x18001ae1e
test byte [0x1800b78f1], 4
jne 0x180040b50
test r15d, r15d
jne 0x18001b260
jmp 0x18001ae1e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x18001b2aa
test byte [0x1800b78f1], 4
jne 0x180040a24
test r15d, r15d
je 0x18001ae13
jmp 0x18001b260
test byte [0x1800b78f1], 4
je 0x18001af4f
jmp 0x180040c7e
test byte [0x1800b78f1], 4
je 0x18001b301
jmp 0x180040f30
test byte [0x1800b78f3], 0x10
je 0x18001add7
jmp 0x1800409fd
test byte [0x1800b78f3], 0x10
je 0x18001af16
jmp 0x180040c57
test byte [0x1800b78f3], 0x10
je 0x18001b427
jmp 0x180040b29
mov r8, r12
call fcn.18009256c
nop
jmp 0x18001abf0
test byte [0x1800b78f1], 4
je 0x1800408fc
mov ecx, 0x2d
jmp 0x1800408ed
mov ecx, 0x2e
mov r8d, ebx
lea rdx, [0x18009f410]
call fcn.1800876bc
mov ecx, ebx
call fcn.180011928
mov r15d, eax
jmp 0x18001b260
test byte [0x1800b78f1], 4
je 0x1800408fc
jmp 0x1800408e8
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, str.SystemCurrentControlSetServicesTcpipParametersInterfaces
lea rax, [rbp + 0x290]
lea r8, str.DnscacheTcpipInterfaces
mov qword [rsp + 0x20], rax
call fcn.180094330
nop
jmp 0x18001acf9
test byte [0x1800b78f3], 0x10
je 0x180040974
lea rax, [rbp + 0x290]
mov dword [rsp + 0x28], ebx
lea r9, str.SystemCurrentControlSetServicesTcpipParametersInterfaces
mov qword [rsp + 0x20], rax
lea r8, str.DnscacheTcpipInterfaces
call fcn.180094248
mov ecx, ebx
call fcn.1800828c8
mov ebx, eax
jmp 0x18001b4ce
mov ebx, 0x80070057
jmp 0x18001ad69
sub rax, 2
mov ebx, 0x8007007a
jmp 0x18001adbe
test rdx, rdx
je 0x18001adc2
jmp 0x18001adbe
test byte [0x1800b78f3], 0x10
je 0x18001add7
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001b4ce
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, str.SystemCurrentControlSetServicesTcpipParametersInterfaces
lea rax, [rbp + 0x290]
lea r8, str.DnscacheTcpipInterfaces
mov qword [rsp + 0x20], rax
call fcn.180094124
nop
jmp 0x18001b4ce
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001add7
mov ecx, ebx
call fcn.180011928
nop
jmp 0x18001ae08
mov ecx, 0xa
lea r8, [rbp - 0x20]
mov r9d, r15d
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18001b49c
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, str.SystemCurrentControlSetServicesTcpip6ParametersInterfaces
lea rax, [rbp + 0x290]
lea r8, str.DnscacheTcpip6Interfaces
mov qword [rsp + 0x20], rax
call fcn.180094330
nop
jmp 0x18001b351
test byte [0x1800b78f3], 0x10
je 0x180040aa0
lea rax, [rbp + 0x290]
mov dword [rsp + 0x28], ebx
lea r9, str.SystemCurrentControlSetServicesTcpip6ParametersInterfaces
mov qword [rsp + 0x20], rax
lea r8, str.DnscacheTcpip6Interfaces
call fcn.180094248
mov ecx, ebx
call fcn.1800828c8
mov ebx, eax
jmp 0x18001b4f2
mov ebx, 0x80070057
jmp 0x18001b3b9
sub rdx, 2
mov ebx, 0x8007007a
jmp 0x18001b40e
test rcx, rcx
je 0x18001b412
jmp 0x18001b40e
test byte [0x1800b78f3], 0x10
je 0x18001b427
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001b4f2
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, str.SystemCurrentControlSetServicesTcpip6ParametersInterfaces
lea rax, [rbp + 0x290]
lea r8, str.DnscacheTcpip6Interfaces
mov qword [rsp + 0x20], rax
call fcn.180094124
nop
jmp 0x18001b4f2
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001b427
mov ecx, ebx
call fcn.180011928
nop
jmp 0x18001b458
mov ecx, 0xa
lea r8, [rbp - 0x20]
mov r9d, r15d
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18001b470
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rbp + 0x4a0]
lea r8, str.Dnscache
mov qword [rsp + 0x20], rax
call fcn.180094330
nop
jmp 0x18001ae3f
test byte [0x1800b78f3], 0x10
je 0x180040bcc
lea rax, [rbp + 0x4a0]
mov dword [rsp + 0x28], ebx
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
mov qword [rsp + 0x20], rax
lea r8, str.Dnscache
call fcn.180094248
mov ecx, ebx
call fcn.1800828c8
mov ebx, eax
xor esi, esi
jmp 0x18001b4e0
mov ebx, 0x80070057
jmp 0x18001aea9
sub rdx, 2
mov ebx, 0x8007007a
jmp 0x18001aefe
test rcx, rcx
je 0x18001af01
jmp 0x18001aefe
test byte [0x1800b78f3], 0x10
je 0x18001af16
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001b4e0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rbp + 0x4a0]
lea r8, str.Dnscache
mov qword [rsp + 0x20], rax
call fcn.180094124
nop
jmp 0x18001b4e0
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18001af16
mov ecx, ebx
call fcn.180011928
nop
jmp 0x18001af47
mov ecx, 0xa
lea r8, [rbp - 0x20]
mov r9d, eax
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18001af4f
cmp dword [rsp + 0x70], 4
jne 0x180040cae
cmp dword [rsp + 0x74], 4
je 0x18001afb6
mov esi, 0x3f2
jmp 0x18001afa2
mov ecx, 0xb
lea rdx, [0x18009f440]
mov r9d, esi
mov r8, r14
call fcn.180087538
nop
jmp 0x18001afaf
cmp dword [rsp + 0x74], 4
jne 0x180040cea
cmp dword [rsp + 0x70], 4
jne 0x180040cea
xor eax, eax
jmp 0x18001b018
mov esi, 0x3f2
jmp 0x18001b002
mov ecx, 0xb
lea rdx, [0x18009f440]
mov r9d, esi
mov r8, r14
call fcn.180087538
nop
jmp 0x18001b00f
cmp dword [rsp + 0x74], 4
jne 0x180040d23
cmp dword [rsp + 0x70], 4
je 0x18001b076
mov esi, 0x3f2
jmp 0x18001b062
mov ecx, 0xb
lea rdx, [0x18009f440]
mov r9d, esi
mov r8, r14
call fcn.180087538
nop
jmp 0x18001b06f
cmp dword [rsp + 0x74], 4
jne 0x180040d5c
cmp dword [rsp + 0x70], 4
je 0x18001b0d6
mov esi, 0x3f2
jmp 0x18001b0c2
mov ecx, 0xb
lea rdx, [0x18009f440]
mov r9d, esi
mov r8, r14
call fcn.180087538
nop
jmp 0x18001b0cf
mov ecx, 0x53
call fcn.18007f5fc
mov rdx, rax
lea r8, [rsp + 0x7c]
mov rcx, r9
call fcn.18001c1d4
mov ecx, dword [rsp + 0x7c]
test eax, eax
mov esi, 0
cmovne ecx, esi
mov dword [rsp + 0x7c], ecx
jmp 0x18001b0e5
mov r15d, 0xe
jmp 0x18001b260
mov r15d, 0xe
jmp 0x18001b260
mov r15d, 0xe
jmp 0x18001b260
mov r15d, 0xe
jmp 0x18001b260
mov ecx, 0x54
call fcn.18007f5fc
mov rdx, rax
mov r9d, ebx
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r10
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.18001b510
cmp eax, 0xe
jne 0x18001b1bf
mov r15d, eax
jmp 0x18001b260
mov qword [r13 + 0x20], rcx
mov qword [rbp - 0x60], rsi
jmp 0x18001b1dd
mov qword [r13 + 0x38], rcx
mov qword [rbp - 0x50], rsi
jmp 0x18001b1f7
mov qword [r13 + 0x48], rcx
mov qword [rbp - 0x48], rsi
jmp 0x18001b204
mov ecx, esi
jmp 0x18001b210
mov r8d, ebx
jmp 0x18001b221
mov r9d, esi
jmp 0x18001b232
mov edx, esi
jmp 0x18001b242
mov rax, qword [r13 + 0x48]
mov qword [rsp + 0x60], rax
mov rax, qword [r13 + 0x38]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rax
mov rax, qword [r13 + 0x20]
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r9d
mov r9, qword [r13 + 0x10]
mov dword [rsp + 0x38], r8d
mov r8, r12
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov rax, qword [r13 + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1800925e0
nop
jmp 0x18001b260
mov r15d, 8
test byte [0x1800b78f1], 4
je 0x18001b260
lea ecx, [r15 + 0x24]
lea rdx, [0x18009f410]
call fcn.180087008
nop
jmp 0x18001b260
mov r15d, 0x57
jmp 0x18001b260
mov rcx, r10
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x18001b2b7
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18001b2c4
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18001b2d1
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18001b2de
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18001b2eb
call sym.DNSAPI.dll_DnsApiFree
nop
jmp 0x18001b2f8
mov r9d, r15d
mov r8, r12
call fcn.18009259c
nop
jmp 0x18001b301