Function at 0x18003a780
Capabilities:
Query or enumerate registry value

Disassembly:
mov r8d, dword [rsi + 0x24]
test r8d, r8d
je 0x18003acfa
cmp eax, r8d
jb 0x18003acfa
mov rcx, r12
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
xor r10d, r10d
jmp 0x18003acfa
mov eax, dword [rsp + 0x30]
cmp eax, r13d
jbe 0x18003acce
mov ecx, eax
call fcn.180008d40
mov r14, rax
test rax, rax
je 0x18004a8b9
mov rdx, qword [rsi - 0xc]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsi + 0xc]
xor r10d, r10d
mov ebx, eax
mov qword [r12], r14
test rcx, rcx
je 0x18003acca
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
jmp 0x18003acca
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor esi, esi
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x10], rdx
lea rcx, [rsp + 0x78]
lea r8d, [rsi + 0x78]
xor edx, edx
mov qword [rsp + 0x70], rsi
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea edx, [rsi + 4]
lea ecx, [rsi + 1]
lea rax, [0x18003bc88]
lea r8d, [rsi + 2]
mov edi, esi
mov qword [rbp], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rsi
mov qword [rbp + 0x10], rax
lea rax, [0x18003bc98]
mov qword [rsp + 0x50], rsi
mov qword [rbp + 0x38], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x48], rax
lea rax, [0x18003bcb8]
mov qword [rsp + 0x58], rsi
mov qword [rbp + 0x70], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], 3
mov qword [rbp + 0x80], rax
lea rax, [rsp + 0x78]
mov dword [rbp + 8], edx
mov qword [rbp + 0x88], rax
lea rax, [0x18003bd08]
mov dword [rbp + 0xc], edx
mov qword [rbp + 0xa8], rax
lea rax, [rsp + 0x7c]
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0xb8], rax
lea rax, [0x18003bd40]
mov byte [rbp + 0x20], sil
mov qword [rbp + 0xe0], rax
lea rax, [rbp - 0x80]
mov dword [rbp + 0x24], ecx
mov qword [rbp + 0xf0], rax
lea rax, [0x18003bcc8]
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x118], rax
lea rax, [rbp - 0x78]
mov dword [rbp + 0x30], esi
mov qword [rbp + 0x128], rax
lea rax, [rbp - 0x70]
mov dword [rbp + 0x40], edx
mov dword [rbp + 0x44], edx
mov qword [rbp + 0x50], rsi
mov byte [rbp + 0x58], sil
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x5c], ecx
mov qword [rbp + 0x60], rsi
mov dword [rbp + 0x68], esi
mov qword [rbp + 0x78], 7
mov byte [rbp + 0x90], sil
mov dword [rbp + 0x94], ecx
mov qword [rbp + 0x98], rsi
mov dword [rbp + 0xa0], esi
mov dword [rbp + 0xb0], edx
mov dword [rbp + 0xb4], edx
mov qword [rbp + 0xc0], rsi
mov byte [rbp + 0xc8], sil
mov dword [rbp + 0xcc], r8d
mov qword [rbp + 0xd0], rsi
mov dword [rbp + 0xd8], esi
mov dword [rbp + 0xe8], edx
mov dword [rbp + 0xec], edx
mov qword [rbp + 0xf8], rsi
mov byte [rbp + 0x100], sil
mov dword [rbp + 0x104], r8d
mov qword [rbp + 0x108], rsi
mov dword [rbp + 0x110], esi
mov qword [rbp + 0x120], rcx
mov byte [rbp + 0x138], cl
lea rax, [0x18003bd78]
mov dword [rbp + 0x174], r8d
lea r8d, [rsi + 8]
mov qword [rbp + 0x150], rax
lea rax, [rbp - 0x7c]
mov dword [rbp + 0x13c], ecx
mov qword [rbp + 0x160], rax
lea rax, [0x18003bdb0]
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x188], rax
lea rax, [rbp - 0x68]
mov dword [rbp + 0x148], esi
mov qword [rbp + 0x198], rax
lea rax, [rbp - 0x60]
mov dword [rbp + 0x158], edx
mov qword [rbp + 0x1a0], rax
lea rax, [0x18003bde0]
mov dword [rbp + 0x15c], edx
mov qword [rbp + 0x1c0], rax
lea rax, [rbp - 0x5c]
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x1d0], rax
lea rax, [0x18003be20]
mov byte [rbp + 0x170], sil
mov qword [rbp + 0x1f8], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x208], rax
lea rax, [0x18003be68]
mov dword [rbp + 0x180], esi
mov qword [rbp + 0x230], rax
lea rax, [rbp - 0x54]
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x240], rax
lea rax, [0x18003be98]
mov byte [rbp + 0x1a8], sil
mov qword [rbp + 0x268], rax
lea rax, [rbp - 0x50]
mov dword [rbp + 0x1ac], edx
mov qword [rbp + 0x278], rax
lea rax, [rbp - 0x48]
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x280], rax
lea rax, [0x18003bec8]
mov dword [rbp + 0x1b8], esi
mov qword [rbp + 0x2a0], rax
lea rax, [rbp - 0x38]
mov dword [rbp + 0x1c8], edx
mov qword [rbp + 0x2b0], rax
lea rax, [rbp - 0x30]
mov dword [rbp + 0x1cc], edx
mov qword [rbp + 0x1d8], rsi
mov byte [rbp + 0x1e0], sil
mov dword [rbp + 0x1e4], edx
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x1e8], rsi
mov dword [rbp + 0x1f0], esi
mov dword [rbp + 0x200], edx
mov dword [rbp + 0x204], edx
mov qword [rbp + 0x210], rsi
mov byte [rbp + 0x218], sil
mov dword [rbp + 0x21c], edx
mov qword [rbp + 0x220], rsi
mov dword [rbp + 0x228], esi
mov dword [rbp + 0x238], edx
mov dword [rbp + 0x23c], edx
mov qword [rbp + 0x248], rsi
mov byte [rbp + 0x250], sil
mov dword [rbp + 0x254], edx
mov qword [rbp + 0x258], rsi
mov dword [rbp + 0x260], esi
mov qword [rbp + 0x270], rcx
mov byte [rbp + 0x288], sil
mov dword [rbp + 0x28c], edx
mov qword [rbp + 0x290], rsi
mov dword [rbp + 0x298], esi
mov qword [rbp + 0x2a8], rcx
mov byte [rbp + 0x2c0], sil
mov dword [rbp + 0x2c4], r8d
mov qword [rbp + 0x2c8], rsi
mov dword [rbp + 0x2d0], esi
lea rax, [0x18003bef0]
mov qword [rbp + 0x2f0], rsi
mov qword [rbp + 0x300], rsi
mov qword [rbp + 0x2d8], rax
lea rax, [rbp - 0x2c]
mov dword [rbp + 0x308], esi
mov qword [rbp + 0x2e8], rax
lea rax, [0x18003bf08]
mov qword [rbp + 0x328], rsi
mov qword [rbp + 0x310], rax
lea rax, [rbp - 0x28]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x320], rax
lea rax, [rsp + 0x60]
mov dword [rbp + 0x378], esi
mov qword [rbp + 0x338], rax
lea rax, [0x18003bf20]
mov qword [rbp + 0x398], rsi
mov qword [rbp + 0x348], rax
lea rax, [rbp - 0x20]
mov byte [rbp + 0x3a0], sil
mov qword [rbp + 0x358], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x3a8], rsi
mov qword [rbp + 0x360], rax
lea rax, [0x18003bf48]
mov dword [rbp + 0x3b0], esi
mov qword [rbp + 0x380], rax
lea rax, [rbp - 0x14]
mov r15d, esi
mov dword [rbp + 0x2e0], edx
mov dword [rbp + 0x2e4], edx
mov byte [rbp + 0x2f8], cl
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x2fc], r8d
mov dword [rbp + 0x318], edx
mov dword [rbp + 0x31c], edx
mov byte [rbp + 0x330], cl
mov dword [rbp + 0x334], r8d
mov dword [rbp + 0x340], edx
mov qword [rbp + 0x350], rcx
mov byte [rbp + 0x368], cl
mov dword [rbp + 0x36c], r8d
mov dword [rbp + 0x388], edx
mov dword [rbp + 0x38c], edx
mov dword [rbp + 0x3a4], socket
lea rsi, [rbp + 0xc]
mov r14d, dword [rsi - 4]
mov r13d, dword [rsi]
mov r12, qword [rsi + 4]
mov rdx, qword [rsi - 0xc]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
xor r10d, r10d
mov ebx, eax
test eax, eax
je 0x18003acfd
cmp dword [rsp + 0x34], r14d
je 0x18003a70d
mov eax, dword [rsp + 0x30]
test ebx, ebx
je 0x18003acfd
cmp byte [rsi + 0x14], 1
je 0x18003aced
mov ecx, dword [rsi + 0x18]
cmp ecx, 1
je 0x18004a8ce
test dword [rbp - 0x44], ecx
jne 0x18004a8ce
mov rdx, qword [rsi + 0x1c]
test rdx, rdx
jne 0x18003a467
mov ebx, r10d
inc r15d
add rsi, 0x38
cmp r15d, 0x11
jae 0x18003ad15
mov rbx, qword [rsp + 0x38]
jmp 0x18003ac7d
mov rcx, qword [0x18008a130]
lea r12, [0x18008a130]
mov esi, 0x400
cmp dword [rbp - 0x40], 2
ja 0x18004a8c4
xor r14d, r14d
test ebx, ebx
jne 0x18003af34
mov r9d, dword [rbp - 0x44]
test r9b, 0x1e
je 0x18004a939
test byte [rbp - 0x44], 2
jne 0x18004a968
test byte [rbp - 0x44], 4
jne 0x18004a9b8
test byte [rbp - 0x44], 8
jne 0x18004a9ff
test byte [rbp - 0x44], 0x10
je 0x18003ad88
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.18003afb0
mov ebx, eax
test eax, eax
jne 0x18004aa3c
cmp qword [rsp + 0x48], r14
jne 0x18003ada8
cmp qword [rsp + 0x50], r14
jne 0x18003ada8
cmp qword [rsp + 0x40], r14
jne 0x18003ada8
cmp qword [rsp + 0x58], r14
je 0x18004aa60
mov rsi, qword [rsp + 0x70]
mov r15d, dword [rsp + 0x78]
shr r15d, 1
cmp word [rsi], r14w
je 0x18003aef3
mov r13, qword [rbp - 0x10]
lea r8, [rsp + 0x38]
mov edx, r15d
mov rcx, rsi
call fcn.18002e2f4
test eax, eax
js 0x18004abc7
cmp dword [rsp + 0x38], r14d
je 0x18003aef3
test byte [rbp - 0x44], 0x1e
je 0x18004abc7
mov ecx, 0x68
call fcn.180008d40
mov rdi, rax
test rax, rax
je 0x18004abba
lock inc dword [rax]
mov rcx, qword [rsp + 0x38]
lea r12d, [rcx + 1]
cmp r12d, ecx
jb 0x18004abb0
mov r14d, r12d
mov eax, 0xffffffff
add r14, r14
cmp r14, rax
ja 0x18004abb0
mov ecx, r14d
call fcn.180008d40
mov qword [rdi + 0x48], rax
test rax, rax
je 0x18004abba
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
mov ebx, r14d
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rax, qword [rdi + 0x48]
shr rbx, 1
xor ecx, ecx
mov word [rax + rbx*2 - 2], cx
mov dword [rdi + 0x50], r14d
mov eax, dword [rbp - 0x44]
xor r14d, r14d
test al, 2
jne 0x18004aa69
test al, 4
jne 0x18004aa8c
test al, 8
jne 0x18004aaaf
test al, 0x10
je 0x18003ae9f
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18003ae9f
mov qword [rdi + 0x60], rcx
lock inc dword [rcx]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x18003aeb2
cmp word [rax], r14w
jne 0x18004aad2
mov rcx, r13
call qword [sym.DNSAPI.dll_DnsNotifyResolverClusterIp]
mov rcx, rdi
call r13
mov ebx, eax
test eax, eax
jne 0x18004ab7f
mov eax, 0xffffffff
mov rcx, rdi
lea rsi, [rsi + r12*2]
sub eax, dword [rsp + 0x38]
add r15d, eax
call fcn.180039eac
mov rdi, r14
cmp word [rsi], r14w
jne 0x18003adc3
jmp 0x18003aef3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x18004abd2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x18004abde
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x18004abea
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x18004abf6
test rdi, rdi
jne 0x18004ac02
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x18003af46
mov rcx, rsi
call fcn.180008b84
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18003af54
call fcn.180008b84
mov rcx, qword [rbp - 0x68]
test rcx, rcx
jne 0x18004ac11
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x18004ac1d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x18004ac29
mov eax, ebx
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0x520]
add rsp, 0x4d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 8
jmp 0x18003ad15
mov ebx, getprotobyname
jmp 0x18003af34
mov rcx, qword [0x18008a130]
lea r12, [0x18008a130]
cmp rcx, r12
je 0x18003ad23
mov esi, 0x400
test dword [rcx + 0x1c], esi
je 0x18003ad28
mov rax, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
lea r9, [0x18003cf00]
test rax, rax
lea r8, [0x180082770]
mov edx, 0xa
cmovne r9, rax
mov eax, r15d
imul rax, rax, 0x38
mov rax, qword [rbp + rax]
mov qword [rsp + 0x20], rax
call fcn.18005b610
mov rcx, qword [0x18008a130]
jmp 0x18003ad28
lea ebx, [r14 + 0x32]
cmp rcx, r12
je 0x18003af34
test dword [rcx + 0x1c], esi
je 0x18003af34
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x27]
lea r8, [0x180082770]
call fcn.180058fb0
jmp 0x18003af34
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.180065488
mov ebx, eax
test eax, eax
je 0x18003ad55
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18003aef3
test dword [rcx + 0x1c], esi
je 0x18003aef3
mov edx, reloc.WS2_32.dll_inet_ntoa
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082770]
call fcn.180058fb0
jmp 0x18003aef3
call fcn.180066020
test al, al
je 0x18003ad5f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.180065330
mov ebx, eax
test eax, eax
je 0x18003ad5f
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18003aef3
test dword [rcx + 0x1c], esi
je 0x18003aef3
mov edx, reloc.WS2_32.dll_listen
jmp 0x18004a99f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180065508
mov ebx, eax
test eax, eax
je 0x18003ad69
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18003aef3
test dword [rcx + 0x1c], esi
je 0x18003aef3
mov edx, reloc.WS2_32.dll_ntohl
jmp 0x18004a99f
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18003aef3
test dword [rcx + 0x1c], esi
je 0x18003aef3
mov edx, reloc.WS2_32.dll_ntohs
jmp 0x18004a99f
mov ebx, r14d
jmp 0x18003af34
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18003ae75
mov qword [rdi + 0x28], rcx
lock inc dword [rcx]
mov eax, dword [rbp - 0x44]
mov qword [rsp + 0x48], r14
jmp 0x18003ae75
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18003ae7d
mov qword [rdi + 0x30], rcx
lock inc dword [rcx]
mov eax, dword [rbp - 0x44]
mov qword [rsp + 0x50], r14
jmp 0x18003ae7d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18003ae85
mov qword [rdi + 0x58], rcx
lock inc dword [rcx]
mov eax, dword [rbp - 0x44]
mov qword [rsp + 0x40], r14
jmp 0x18003ae85
cmp qword [rdi + 0x28], r14
je 0x18004ab24
mov ecx, dword [rbp - 0x70]
call fcn.180008d40
mov rcx, qword [rdi + 0x28]
mov qword [rcx + 0x38], rax
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x18004abba
mov r8d, dword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rax, qword [rdi + 0x28]
mov edx, dword [rbp - 0x70]
mov rcx, qword [rax + 0x38]
shr rdx, 1
mov word [rcx + rdx*2 - 2], r14w
mov rcx, qword [rdi + 0x28]
mov eax, dword [rbp - 0x70]
mov dword [rcx + 0x40], eax
cmp qword [rdi + 0x30], r14
je 0x18003aeb2
mov ecx, dword [rbp - 0x70]
call fcn.180008d40
mov rcx, qword [rdi + 0x30]
mov qword [rcx + 0x78], rax
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x18004abba
mov r8d, dword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rax, qword [rdi + 0x30]
mov edx, dword [rbp - 0x70]
mov rcx, qword [rax + 0x78]
shr rdx, 1
mov word [rcx + rdx*2 - 2], r14w
mov rcx, qword [rdi + 0x30]
mov eax, dword [rbp - 0x70]
mov dword [rcx + 0x80], eax
jmp 0x18003aeb2
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18003aef3
test dword [rcx + 0x1c], 0x400
je 0x18003aef3
mov edx, send
mov r9d, ebx
jmp 0x18004a9a2
mov ebx, 0x216
jmp 0x18003aef3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x18003aef3
mov ebx, 0x57
jmp 0x18003aef3
call fcn.180065710
nop
jmp 0x18003af01
call fcn.180065690
nop
jmp 0x18003af0f
call fcn.18006577c
nop
jmp 0x18003af1d
call fcn.180008b84
nop
jmp 0x18003af2b
mov rcx, rdi
call fcn.180039eac
nop
jmp 0x18003af34
call fcn.180008b84
nop
jmp 0x18003af61
call fcn.180008b84
nop
jmp 0x18003af6e
call fcn.180008b84
nop
jmp 0x18003af7b