Function at 0x180018800
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0xba0]
sub rsp, 0xca0
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rbp + 0xb90], rax
movzx eax, word [0x18006f7c0]
movsd xmm0, qword [0x18006f7b8]
mov qword [rbp - 0x80], rcx
lea rcx, [rbp + 0x39a]
xor edx, edx
mov r8d, 0x7f6
movsd qword [rbp + 0x390], xmm0
mov word [rbp + 0x398], ax
call fcn.1800292e0
movzx eax, byte [0x18006f7d0]
movsd xmm0, qword [0x18006f7c8]
movsd qword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x99]
xor edx, edx
mov r8d, 0xf7
mov byte [rbp + 0x98], al
call fcn.1800292e0
movzx eax, byte [0x18006f7e8]
movsd xmm0, qword [0x18006f7e0]
movsd qword [rbp + 0x290], xmm0
lea rcx, [rbp + 0x299]
xor edx, edx
mov r8d, 0xf7
mov byte [rbp + 0x298], al
call fcn.1800292e0
movzx eax, byte [0x18006f800]
movsd xmm0, qword [0x18006f7f8]
movsd qword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x67]
xor edx, edx
mov r8d, 0xf7
mov byte [rbp - 0x68], al
call fcn.1800292e0
movzx eax, byte [0x18006f818]
movsd xmm0, qword [str.password]
movsd qword [rbp + 0x190], xmm0
lea rcx, [rbp + 0x199]
xor edx, edx
mov r8d, 0xf7
mov byte [rbp + 0x198], al
call fcn.1800292e0
xor edi, edi
mov r15d, edi
mov qword [rsp + 0x70], rdi
call fcn.18001acf0
mov rbx, rax
lea r12d, [rdi + 1]
test rax, rax
je 0x1800189fb
lea rax, [rsp + 0x50]
lea rdx, [0x18006f63c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x1800189fb
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
lea rdx, [0x18006f828]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x390]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x64], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov eax, edi
sete al
test eax, eax
jne 0x1800189fb
lea r8, str.127.0.0.1
lea rcx, [rbp + 0x390]
or r9, 0xffffffffffffffff
mov edx, 0x800
call fcn.18002a5b4
mov r15d, r12d
mov qword [rsp + 0x70], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018aad
lea rax, [rsp + 0x50]
lea rdx, [0x18006f784]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x180018aad
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
lea rdx, str.Allow
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
test ebx, ebx
cmove esi, dword [rsp + 0x78]
mov dword [rsp + 0x78], esi
jmp 0x180018ab1
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x70], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018b63
lea rax, [rsp + 0x50]
lea rdx, [0x18006f7d4]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x180018b63
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f848]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
test ebx, ebx
cmove esi, dword [rsp + 0x60]
mov dword [rsp + 0x64], esi
jmp 0x180018b67
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018c20
lea rax, [rsp + 0x68]
lea rdx, [0x18006f7ec]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x180018c20
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, str.WebPort
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180018c20
mov esi, dword [rsp + 0x50]
lea eax, [rsi - 1]
cmp eax, 0xfffe
jbe 0x180018c25
add r15d, 2
mov esi, 0x1811
mov qword [rsp + 0xcd8], r14
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018cd8
lea rax, [rsp + 0x70]
lea rdx, [0x18006f804]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x180018cd8
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, str.Restrict
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove r12d, dword [rsp + 0x60]
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018d88
lea rax, [rsp + 0x70]
lea rdx, [0x18006f81c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x180018d88
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, str.WebPortChange
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, edi
test ebx, ebx
cmove r13d, dword [rsp + 0x60]
jmp 0x180018d8b
mov r13d, edi
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018e5b
lea rax, [rsp + 0x70]
lea rdx, [0x18006f86c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x180018e5b
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f888]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov eax, edi
sete al
test eax, eax
jne 0x180018e5b
lea r8, [0x18006eb56]
lea rcx, [rbp + 0x90]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
add r15d, 4
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018f27
lea rax, [rsp + 0x70]
lea rdx, [0x18006f8ac]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x180018f27
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f898]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x290]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov eax, edi
sete al
test eax, eax
jne 0x180018f27
lea r8, [0x18006eb57]
lea rcx, [rbp + 0x290]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x180018fed
lea rax, [rsp + 0x70]
lea rdx, [0x18006f8cc]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x180018fed
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f8b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov eax, edi
sete al
test eax, eax
jne 0x180018fed
lea r8, [0x18006eb62]
lea rcx, [rbp - 0x70]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
mov qword [rsp + 0x58], rdi
call fcn.18001acf0
mov rbx, rax
test rax, rax
je 0x1800190b8
lea rax, [rsp + 0x70]
lea rdx, [0x18006f8ec]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x1800190b8
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
lea rdx, [0x18006f8d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x50], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
test edi, edi
jne 0x1800190b8
lea r8, [0x18006eb63]
lea rcx, [rbp + 0x190]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
mov rbx, qword [rbp - 0x80]
lea r8, [rbp + 0x90]
or r9, 0xffffffffffffffff
lea rcx, [rbx + 0x814]
mov edx, 0x100
call fcn.18002a5b4
lea rcx, [rbx + 0x914]
lea r8, [rbp + 0x290]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
lea rcx, [rbx + 0xa14]
lea r8, [rbp - 0x70]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
lea rcx, [rbx + 0xb14]
lea r8, [rbp + 0x190]
or r9, 0xffffffffffffffff
mov edx, 0x100
call fcn.18002a5b4
lea rcx, [rbx + 0x10]
lea r8, [rbp + 0x390]
or r9, 0xffffffffffffffff
mov edx, 0x800
call fcn.18002a5b4
mov eax, dword [rsp + 0x78]
mov r14, qword [rsp + 0xcd8]
mov dword [rbx], eax
mov eax, dword [rsp + 0x64]
mov dword [rbx + 0xc], r12d
mov dword [rbx + 0x810], eax
mov dword [rbx + 8], r13d
mov dword [rbx + 4], esi
mov eax, r15d
mov rcx, qword [rbp + 0xb90]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret