Function at 0x180025224
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x490
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor esi, esi
mov qword [rsp + 0x50], rsi
test byte [0x1800b78f1], 4
jne 0x180042ebc
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTDNSClientDnsPolicyConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1800253de
mov ebx, 0x20a
lea rcx, [rsp + 0x60]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
test byte [0x1800b78f3], 0x10
lea r12, str.ParametersDnsPolicyConfig
jne 0x180042ed3
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x180042eff
sub ebx, dword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov eax, dword [rsp + 0x40]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x18002538c
mov r8d, 0x7ffffffe
mov r9, r12
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x180025371
movzx eax, word [r9 + rdx]
test ax, ax
je 0x180025371
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x180025351
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], si
test ebx, ebx
js 0x180042f32
test byte [0x1800b78f3], 0x10
jne 0x180042f59
test ebx, ebx
js 0x180042f9b
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18002549e
mov edi, esi
mov r12d, 0x105
xor edx, edx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x270]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180042fc7
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [0x1800b7928]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
lea rcx, [0x1800b7928]
mov dword [0x1800b7f74], ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
test byte [0x1800b78f1], 4
jne 0x18004312a
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
test byte [0x1800b78f1], 4
jne 0x180042fa8
test ebx, ebx
je 0x1800253de
mov ebx, esi
jmp 0x180025438
test byte [0x1800b78f3], 0x10
je 0x1800253a1
jmp 0x180042f81
mov ecx, 0x2b
lea rdx, [0x1800a3388]
call fcn.180087008
nop
jmp 0x180025262
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094330
nop
jmp 0x1800252ca
test byte [0x1800b78f3], 0x10
je 0x180042f24
mov dword [rsp + 0x28], edi
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094248
mov ecx, edi
call fcn.1800828c8
mov ebx, eax
jmp 0x1800254b7
test byte [0x1800b78f3], 0x10
je 0x1800253a1
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x1800254b7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094124
nop
jmp 0x1800254b7
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x1800253a1
mov ecx, ebx
call fcn.180011928
nop
jmp 0x1800253d4
mov ecx, 0xa
lea r8, [rsp + 0x60]
mov r9d, ebx
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x1800254ab
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1800430fb
mov rcx, qword [rsp + 0x50]
call fcn.180061380
mov ebx, eax
test eax, eax
je 0x1800430e1
test byte [0x1800b78f1], 4
je 0x180043036
mov ecx, 0x2d
lea r8, [rsp + 0x270]
mov r9d, eax
lea rdx, [0x1800a3388]
call fcn.180087538
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
cmp ebx, 0x32
je 0x1800430dd
cmp ebx, 0x1392
je 0x1800430dd
cmp ebx, 0x3fa
je 0x1800430d3
mov eax, dword [0x1800b85c0]
test al, 1
je 0x18004308b
mov r9d, ebx
lea r8, [rsp + 0x270]
lea rdx, [0x1800a2470]
call fcn.1800616d8
mov eax, dword [0x1800b85c0]
test al, 0x10
je 0x1800430d3
prefetchw byte [0x1800b7990]
mov eax, dword [0x1800b7990]
mov edx, 0x10000
mov ecx, eax
or ecx, edx
lock cmpxchg dword [0x1800b7990], ecx
jne 0x1800430a1
test edx, eax
jne 0x1800430d3
test byte [0x1800b85c0], 0x10
je 0x1800430d3
mov r9d, ebx
lea r8, [rsp + 0x270]
lea rdx, [0x1800a23d0]
call fcn.1800616d8
mov ebx, 0x2564
jmp 0x180025427
mov ebx, esi
jmp 0x1800430f2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
inc edi
mov edx, edi
jmp 0x1800253e8
test byte [0x1800b78f1], 4
je 0x180025427
mov ecx, 0x2c
lea r8, [rsp + 0x270]
mov r9d, eax
lea rdx, [0x1800a3388]
call fcn.180087538
nop
jmp 0x180025427
mov ecx, 0x2e
lea rdx, [0x1800a3388]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x180025471