Function at 0x18000ee20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 9], edi
mov dword [rbp + 0x77], edi
mov dword [rbp + 0x7f], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x78], rdi
lea rax, [rbp + 0x7f]
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000f116
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180011878
mov r15, rax
mov dword [rbp + 3], edi
mov ecx, dword [rbp + 0x7f]
inc ecx
mov dword [rbp - 5], ecx
call fcn.180011878
mov r13, rax
mov esi, edi
cmp dword [rbp - 9], edi
jbe 0x18000f0fd
lea rax, [rbx + 0x28]
mov qword [rbp + 0x17], rax
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov r8d, eax
xor edx, edx
mov rcx, r15
call fcn.180015b40
mov r11d, dword [rbp + 0x7f]
inc r11d
mov dword [rbp - 5], r11d
mov r8d, r11d
xor edx, edx
mov rcx, r13
call fcn.180015b40
lea r11, [rbp - 5]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov r8, r15
mov edx, esi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
mov r8, r15
lea rdx, [0x18002a2ac]
lea rcx, [rbp + 0xf]
call fcn.18000f8d0
mov ecx, 0xa44
call fcn.180011ef8
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, 0xa44
call fcn.1800118d0
mov ecx, gethostbyname
call fcn.180011ef8
mov r12, rax
mov qword [rbp + 7], rax
mov rcx, qword [r13 + 0xa44]
mov qword [rax], rcx
mov rcx, qword [r13 + 0xa4c]
mov qword [rax + 8], rcx
mov rcx, qword [r13 + 0xa54]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13 + 0xa5c]
mov qword [rax + 0x18], rcx
mov rcx, qword [r13 + 0xa64]
mov qword [rax + 0x20], rcx
mov rcx, qword [r13 + 0xa6c]
mov qword [rax + 0x28], rcx
movsxd rcx, dword [rdi + 0x208]
call fcn.180011878
mov rbx, rax
movsxd r8, dword [rdi + 0x208]
lea rdx, [r13 + 0xa74]
mov rcx, rax
call fcn.1800118d0
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rbx
mov rax, qword [rbp + 0x17]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx + 0x438]
mov dword [r12 + 0x10], eax
mov eax, dword [rcx + 0x440]
mov dword [r12 + 0x14], eax
mov eax, dword [rcx + 0x448]
mov dword [r12 + 0x28], eax
mov qword [r12], rcx
lea rax, [rbp + 7]
mov rcx, qword [0x18003a530]
cmp rax, rcx
jae 0x18000f09f
lea rdx, [rbp + 7]
mov rax, qword [0x18003a528]
cmp rax, rdx
ja 0x18000f09f
lea rbx, [rbp + 7]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [0x18003a538]
jne 0x18000f091
call fcn.18000f5b0
mov rcx, qword [0x18003a530]
mov rax, qword [0x18003a528]
test rcx, rcx
je 0x18000f0c3
mov rax, qword [rax + rbx*8]
mov qword [rcx], rax
jmp 0x18000f0bc
cmp rcx, qword [0x18003a538]
jne 0x18000f0b4
call fcn.18000f5b0
mov rcx, qword [0x18003a530]
test rcx, rcx
je 0x18000f0c3
mov qword [rcx], r12
mov rcx, qword [0x18003a530]
add rcx, 8
mov qword [0x18003a530], rcx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f0ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + htons]
inc esi
cmp esi, dword [rbp - 9]
mov edi, 0
jb 0x18000eef2
mov rcx, r15
call fcn.1800123c4
mov rcx, r13
call fcn.1800123c4
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret