Function at 0x1800175ec
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov ebx, r9d
mov r15, rdx
mov r13, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x180017615
mov edi, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r12d, r12d
test rax, rax
lea rcx, [rbp - 0x20]
mov r8d, edi
setne r12b
call fcn.1800141f4
mov eax, edi
cdq
lea rcx, [rbp - 0x20]
sub eax, edx
sar eax, 1
mov edx, eax
mov r14d, eax
mov dword [rbp - 0x30], eax
call fcn.18001423c
lea rcx, [rbp - 0x20]
mov edx, r14d
mov rsi, rax
call fcn.18001423c
or ebx, 0x20019
mov r14, rax
lea rax, [rbp - 0x28]
xor r8d, r8d
mov r9d, ebx
mov rdx, r15
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18001769c
mov edx, eax
mov ecx, 0x3f
call fcn.18000d3d4
jmp 0x18001782f
mov rbx, qword [rbp + 0x70]
mov eax, edi
movsxd r13, r12d
cdq
xor r15d, r15d
and edx, 7
lea r12d, [rdx + rax]
sar r12d, 3
mov eax, dword [rbp - 0x30]
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x68], eax
call fcn.180019620
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov rcx, r14
call fcn.180019620
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8, rsi
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x18001777b
test eax, eax
jne 0x1800177e0
test r13, r13
je 0x18001773f
mov r8, qword [rbp + 0x50]
mov rax, rsi
sub r8, rsi
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x18001773b
inc rax
test edx, edx
jne 0x180017728
test ecx, ecx
jne 0x18001777b
lea rdx, str.__24s
mov r8, rsi
mov rcx, rbx
call fcn.18000cfa0
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x18001776c
cmp eax, 2
jbe 0x1800177cc
cmp eax, 3
je 0x180017797
cmp eax, 4
je 0x180017783
cmp eax, 7
je 0x1800177cc
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, rbx
call fcn.18000cfa0
inc r15d
jmp 0x1800176b4
mov r8d, dword [r14]
lea rdx, [0x18002c98c]
mov rcx, rbx
call fcn.18000cfa0
jmp 0x18001777b
xor edi, edi
cmp dword [rbp + 0x68], edi
jbe 0x18001776c
movsx ecx, byte [rdi + r14]
lea rdx, [0x18002c990]
movzx r8d, cl
mov rcx, rbx
cmp r8d, 0xf
jbe 0x1800177be
lea rdx, [0x18002c994]
call fcn.18000cfa0
inc edi
cmp edi, dword [rbp + 0x68]
jb 0x18001779e
jmp 0x18001776c
lea rdx, [0x18002c720]
mov r8, r14
mov rcx, rbx
call fcn.18000cfa0
jmp 0x18001777b
xor edi, edi
test r13, r13
jne 0x180017825
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
call fcn.180019620
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180017825
lea rdx, str._s_n
mov r8, rsi
mov rcx, rbx
call fcn.18000cfa0
inc edi
jmp 0x1800177e7
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret