Function at 0x1800988b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x180098b4c
test edx, edx
je 0x180098b4c
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.18009b770
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r14d, r14d
test eax, eax
jne 0x180098ad8
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x398], rdi
mov edi, r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x180098ac5
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180098a89
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ServiceName
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180098a7e
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.18009b770
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x150]
call fcn.180098b80
test eax, eax
je 0x180098a7e
cmp byte [rsp + 0x60], r14b
je 0x180098a35
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x180098a7e
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x180098a70
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x180098a70
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x180098a50
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r14b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180098980
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x398]
cmp byte [rsp + 0x60], r14b
je 0x180098b4c
lea rax, [rsi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
mov edx, r14d
mov r9d, 0x80070057
mov rcx, rsi
cmova edx, r9d
test edx, edx
js 0x180098b43
test esi, esi
je 0x180098b2c
sub r8, rcx
lea rdx, [rsp + 0x60]
sub rdx, rbx
nop
lea rax, [r8 + rcx]
test rax, rax
je 0x180098b2c
movzx eax, byte [rdx + rbx]
test al, al
je 0x180098b2c
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x180098b10
test rcx, rcx
lea rax, [rbx - 1]
mov edx, 0x8007007a
cmovne rax, rbx
cmovne edx, r14d
mov byte [rax], r14b
not edx
shr edx, 0x1f
mov eax, edx
jmp 0x180098b4e
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180050f90
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rsi
pop rbp
ret