Function at 0x18002add0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x3d8]
sub rsp, 0x4c0
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r14d, r14d
mov dword [rsp + 0x68], 0x105
mov rsi, rcx
mov dword [rsp + 0x44], r14d
mov ebx, 0x20a
mov qword [rsp + 0x70], r14
mov r8d, ebx
lea rcx, [rbp + 0x1a0]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rax, [0x18009dff0]
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
lea rax, [rsi + 8]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x58], xmm0
test byte [0x1800b78f3], 0x20
jne 0x180043bea
lea rcx, [rsp + 0x48]
call fcn.180007644
mov r8, rbx
lea rcx, [rbp - 0x70]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x40], r14d
test byte [0x1800b78f3], 0x10
lea r12, str.ParametersDnsActiveIfs
jne 0x180043c04
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rbp - 0x70]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x180043c2f
sub ebx, dword [rsp + 0x40]
lea rdx, [rbp - 0x70]
mov eax, dword [rsp + 0x40]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x18002af5a
mov r8d, 0x7ffffffe
mov r9, r12
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x18002af3e
movzx eax, word [r9 + rdx]
test ax, ax
je 0x18002af3e
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x18002af1e
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r14w
test ebx, ebx
js 0x180043c5f
test byte [0x1800b78f3], 0x10
jne 0x180043c82
mov r12d, 0x20019
test ebx, ebx
js 0x180043cca
lea rax, [rsp + 0x78]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18002afb7
test byte [0x1800b78f1], 4
jne 0x180043cd7
cmp ebx, 0x490
je 0x180043e48
cmp ebx, 2
je 0x180043e48
test ebx, ebx
jle 0x18002afdb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x180043cf5
mov edi, r14d
xor edx, edx
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180043d02
test byte [0x1800b78f3], 0x20
jne 0x180043e6a
cmp dword [rsp + 0x50], r14d
jne 0x180043e84
cmp dword [rsp + 0x54], r14d
je 0x18002b048
lea rcx, [rsp + 0x48]
call fcn.180021ef0
lea rcx, [rbp - 0x80]
call fcn.180021be4
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18002b06c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18002b082
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
mov ecx, 0x3a
lea rdx, [0x18009f2c0]
mov r8, rsi
call fcn.1800879b4
nop
jmp 0x18002ae63
lea rax, [rbp - 0x70]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094330
nop
jmp 0x18002ae99
test byte [0x1800b78f3], 0x10
je 0x180043c54
mov dword [rsp + 0x28], edi
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094248
mov ecx, edi
call fcn.1800828c8
mov ebx, eax
jmp 0x180043ca3
test byte [0x1800b78f3], 0x10
je 0x18002af6f
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x180043ca3
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r12
call fcn.180094124
test byte [0x1800b78f3], 0x10
je 0x18002af6f
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18002af6f
mov ecx, ebx
call fcn.180011928
nop
jmp 0x18002afa4
mov ecx, 0xa
lea r8, [rbp - 0x70]
mov r9d, ebx
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18002afb7
mov dword [rsp + 0x44], 0x55d
jmp 0x18002b01f
test byte [0x1800b78f3], 0x20
je 0x180043d23
mov ecx, 0x3c
lea r8, [rbp + 0x1a0]
lea rdx, [0x18009f2c0]
call fcn.180087814
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180043d3e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x180043d75
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180043e3b
lea rcx, [rbp - 0x80]
call fcn.180026e74
mov rcx, qword [rsp + 0x70]
lea rdx, str.Connection
lea r8, [rbp - 0x80]
call fcn.18006c95c
mov ebx, eax
test eax, eax
js 0x180043e2e
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
lea rdx, str.ActiveInterfaces
call fcn.18006c690
mov ebx, eax
test eax, eax
js 0x180043e21
mov rax, qword [rbp - 0x78]
test eax, eax
je 0x180043ddc
mov rcx, qword [rbp - 0x80]
lea edx, [rax + 1]
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll__wcslwr_s]
nop dword [rax + rax]
mov rax, qword [rbp - 0x80]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x58], rax
call fcn.18006cdec
mov ebx, eax
test eax, eax
js 0x180043e14
inc edi
mov qword [rsp + 0x58], r14
mov edx, edi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x68], 0x105
jmp 0x18002afe6
mov dword [rsp + 0x44], 0x58b
jmp 0x18002b01f
mov dword [rsp + 0x44], 0x581
jmp 0x18002b01f
mov dword [rsp + 0x44], 0x57d
jmp 0x18002b01f
mov dword [rsp + 0x44], 0x577
jmp 0x18002b01f
test byte [0x1800b78f3], 0x20
je 0x180043e62
mov ecx, 0x3b
lea rdx, [0x18009f2c0]
call fcn.180087008
mov ebx, r14d
jmp 0x18002b01f
mov ecx, 0x3d
lea rdx, [0x18009f2c0]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x18002b02c
lea rcx, [rsp + 0x48]
call fcn.18002a804
nop
jmp 0x18002b037