Function at 0x18000fb80
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 9], edi
mov dword [rbp + 0x77], edi
mov dword [rbp + 0x7f], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x78], rdi
lea rax, [rbp + 0x7f]
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000fe76
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800125c4
mov r15, rax
mov dword [rbp + 3], edi
mov ecx, dword [rbp + 0x7f]
inc ecx
mov dword [rbp - 5], ecx
call fcn.1800125c4
mov r13, rax
mov esi, edi
cmp dword [rbp - 9], edi
jbe 0x18000fe5d
lea rax, [rbx + 0x28]
mov qword [rbp + 0x17], rax
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov r8d, eax
xor edx, edx
mov rcx, r15
call fcn.180017ae0
mov r11d, dword [rbp + 0x7f]
inc r11d
mov dword [rbp - 5], r11d
mov r8d, r11d
xor edx, edx
mov rcx, r13
call fcn.180017ae0
lea r11, [rbp - 5]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov r8, r15
mov edx, esi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
mov r8, r15
lea rdx, [0x18003496c]
lea rcx, [rbp + 0xf]
call fcn.180010620
mov ecx, 0xa44
call fcn.1800152a8
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, 0xa44
call fcn.180014c30
mov ecx, gethostbyname
call fcn.1800152a8
mov r12, rax
mov qword [rbp + 7], rax
mov rcx, qword [r13 + 0xa44]
mov qword [rax], rcx
mov rcx, qword [r13 + 0xa4c]
mov qword [rax + 8], rcx
mov rcx, qword [r13 + 0xa54]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13 + 0xa5c]
mov qword [rax + 0x18], rcx
mov rcx, qword [r13 + 0xa64]
mov qword [rax + 0x20], rcx
mov rcx, qword [r13 + 0xa6c]
mov qword [rax + 0x28], rcx
movsxd rcx, dword [rdi + 0x208]
call fcn.1800125c4
mov rbx, rax
movsxd r8, dword [rdi + 0x208]
lea rdx, [r13 + 0xa74]
mov rcx, rax
call fcn.180014c30
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rbx
mov rax, qword [rbp + 0x17]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx + 0x438]
mov dword [r12 + 0x10], eax
mov eax, dword [rcx + 0x440]
mov dword [r12 + 0x14], eax
mov eax, dword [rcx + 0x448]
mov dword [r12 + 0x28], eax
mov qword [r12], rcx
lea rax, [rbp + 7]
mov rcx, qword [0x180046f80]
cmp rax, rcx
jae 0x18000fdff
lea rdx, [rbp + 7]
mov rax, qword [0x180046f78]
cmp rax, rdx
ja 0x18000fdff
lea rbx, [rbp + 7]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [0x180046f88]
jne 0x18000fdf1
call fcn.180010300
mov rcx, qword [0x180046f80]
mov rax, qword [0x180046f78]
test rcx, rcx
je 0x18000fe23
mov rax, qword [rax + rbx*8]
mov qword [rcx], rax
jmp 0x18000fe1c
cmp rcx, qword [0x180046f88]
jne 0x18000fe14
call fcn.180010300
mov rcx, qword [0x180046f80]
test rcx, rcx
je 0x18000fe23
mov qword [rcx], r12
mov rcx, qword [0x180046f80]
add rcx, 8
mov qword [0x180046f80], rcx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000fe4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + htons]
inc esi
cmp esi, dword [rbp - 9]
mov edi, 0
jb 0x18000fc52
mov rcx, r15
call fcn.180015790
mov rcx, r13
call fcn.180015790
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret