Function at 0x18009e8b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.180143d30
sub rsp, rax
mov rax, qword [0x18021e0b0]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov r13, r8
mov rsi, rdx
mov qword [rsp + 0x60], rdx
mov rbx, rcx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], r8
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x40], 0x1000
mov ecx, 0x1000
call fcn.180143930
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 3]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18009e972
mov rcx, rdi
call fcn.180142d20
nop
mov rcx, rsi
call fcn.180008160
nop
mov rcx, r13
call fcn.180009d40
mov eax, 1
jmp 0x18009ee6d
xor edx, edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x54], 0x1000
lea r9, [rsp + 0x54]
lea r8, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x18009ee46
cmp eax, 0xea
jne 0x18009e9e3
mov eax, dword [rsp + 0x40]
add eax, eax
mov dword [rsp + 0x40], eax
mov rcx, rdi
call fcn.180142d20
mov ecx, dword [rsp + 0x40]
call fcn.180143930
mov rdi, rax
mov edx, r14d
jmp 0x18009e974
test eax, eax
jne 0x18009ee2e
cmp dword [rsp + 0x58], 3
jne 0x18009ed4c
cmp qword [r13 + 0x10], 0
je 0x18009ebff
mov r8d, dword [rsp + 0x40]
shr r8, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.18000d7f0
nop
mov r11, qword [r13 + 0x10]
mov rbx, r13
cmp qword [r13 + 0x18], 8
jb 0x18009ea37
mov rbx, qword [r13]
lea r12, [rbp - 0x68]
mov r15, qword [rbp - 0x50]
cmp r15, 8
setae dl
mov byte [rsp + 0x44], dl
mov r14, qword [rbp - 0x68]
cmovae r12, r14
mov rsi, qword [rbp - 0x58]
cmp r11, rsi
ja 0x18009ebb7
test r11, r11
jne 0x18009ea6d
xor ebx, ebx
mov eax, ebx
jmp 0x18009eb01
mov rax, rsi
sub rax, r11
inc rax
lea rcx, [r12 + rax*2]
mov qword [rsp + 0x68], rcx
mov rax, r12
movzx r10d, word [rbx]
nop word [rax + rax]
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x18009eab9
cmp word [rax], r10w
je 0x18009eab6
cmp rcx, 1
je 0x18009eab9
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x18009eaa3
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x18009ebb7
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x18009eaea
mov r9, rax
sub r9, rbx
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x18009eb5e
add rdx, 2
sub r8, 1
jne 0x18009ead6
sub rax, r12
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x18009ebb7
movzx edx, byte [rsp + 0x44]
xor ebx, ebx
cmp rsi, rax
jb 0x18009ee9d
mov rcx, rsi
sub rcx, rax
cmp rcx, r11
cmovb r11, rcx
lea rcx, [rbp - 0x68]
test dl, dl
cmovne rcx, r14
lea rcx, [rcx + rax*2]
sub rsi, r11
lea rdx, [rcx + r11*2]
mov r8, rsi
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.180145460
mov qword [rbp - 0x58], rsi
inc dword [0x1802246b4]
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
jb 0x18009eb6c
mov rdx, qword [rbp - 0x68]
lea r8, [rdx + rsi*2]
jmp 0x18009eb74
add rax, 2
mov rcx, qword [rsp + 0x68]
jmp 0x18009ea90
lea r8, [rax + rsi*2]
lea rdx, [rbp - 0x68]
sub r8, rdx
mov rcx, rdi
call fcn.180145460
lea eax, [rsi + rsi]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18009ed5c
mov r15, qword [rbp - 0x50]
mov r14, qword [rbp - 0x68]
cmp r15, 8
jb 0x18009ebf2
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x18009ebea
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009eea3
mov rcx, r14
call fcn.180142d20
xor r15d, r15d
mov r14d, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
cmp qword [rsi + 0x10], 0
je 0x18009ed1f
mov r8d, dword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.180006820
nop
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.18001f650
cmp rax, 0xffffffffffffffff
je 0x18009ece4
mov r9, qword [rsi + 0x10]
mov rbx, qword [rbp - 0x38]
cmp rbx, rax
jb 0x18009eea9
mov rcx, rbx
sub rcx, rax
cmp rcx, r9
cmovb r9, rcx
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
add rcx, rax
sub rbx, r9
mov r8, rbx
sub r8, rax
inc r8
lea rdx, [rcx + r9]
call fcn.180145460
mov qword [rbp - 0x38], rbx
inc dword [0x1802246b4]
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
jb 0x18009eca4
mov rdx, qword [rbp - 0x48]
lea r8, [rbx + rdx]
jmp 0x18009ecac
lea r8, [rax + rbx]
lea rdx, [rbp - 0x48]
sub r8, rdx
mov rcx, rdi
call fcn.180145460
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18009edca
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18009ed1f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ed1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009ee97
call fcn.180142d20
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18009ee2e
inc r14d
mov dword [rsp + 0x50], r14d
mov edx, r14d
jmp 0x18009e974
mov rcx, rdi
call fcn.180142d20
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18009edb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009edab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009eea3
call fcn.180142d20
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], bx
mov rcx, qword [rsp + 0x60]
jmp 0x18009e95a
mov rcx, rdi
call fcn.180142d20
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18009ee19
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ee14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009ee97
call fcn.180142d20
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
jmp 0x18009e957
mov rcx, rdi
call fcn.180142d20
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18009e957
mov rcx, rdi
call fcn.180142d20
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rsi
call fcn.180008160
nop
mov rcx, r13
call fcn.180009d40
xor eax, eax
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.180142d00
mov rbx, qword [rsp + 0x2148]
add rsp, 0x20f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180151d10
nop
call fcn.18000a990
nop
call fcn.180151d10
nop
call fcn.18000a990
int3