Function at 0x180017638
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov ebx, r9d
mov r15, rdx
mov r13, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x180017661
mov edi, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r12d, r12d
test rax, rax
lea rcx, [rbp - 0x20]
mov r8d, edi
setne r12b
call fcn.1800152e0
mov eax, edi
cdq
lea rcx, [rbp - 0x20]
sub eax, edx
sar eax, 1
mov edx, eax
mov r14d, eax
mov dword [rbp - 0x30], eax
call fcn.180015328
lea rcx, [rbp - 0x20]
mov edx, r14d
mov rsi, rax
call fcn.180015328
or ebx, 0x20019
mov r14, rax
lea rax, [rbp - 0x28]
xor r8d, r8d
mov r9d, ebx
mov rdx, r15
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800176e8
mov edx, eax
mov ecx, 0x3f
call fcn.18000daec
jmp 0x18001787b
mov rbx, qword [rbp + 0x70]
mov eax, edi
movsxd r13, r12d
cdq
xor r15d, r15d
and edx, 7
lea r12d, [rdx + rax]
sar r12d, 3
mov eax, dword [rbp - 0x30]
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x68], eax
call fcn.18001c370
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov rcx, r14
call fcn.18001c370
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8, rsi
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x1800177c7
test eax, eax
jne 0x18001782c
test r13, r13
je 0x18001778b
mov r8, qword [rbp + 0x50]
mov rax, rsi
sub r8, rsi
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x180017787
inc rax
test edx, edx
jne 0x180017774
test ecx, ecx
jne 0x1800177c7
lea rdx, str.__24s
mov r8, rsi
mov rcx, rbx
call fcn.18000d61c
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x1800177b8
cmp eax, 2
jbe 0x180017818
cmp eax, 3
je 0x1800177e3
cmp eax, 4
je 0x1800177cf
cmp eax, 7
je 0x180017818
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, rbx
call fcn.18000d61c
inc r15d
jmp 0x180017700
mov r8d, dword [r14]
lea rdx, [0x18002ccc4]
mov rcx, rbx
call fcn.18000d61c
jmp 0x1800177c7
xor edi, edi
cmp dword [rbp + 0x68], edi
jbe 0x1800177b8
movsx ecx, byte [rdi + r14]
lea rdx, [0x18002ccc8]
movzx r8d, cl
mov rcx, rbx
cmp r8d, 0xf
jbe 0x18001780a
lea rdx, [0x18002cccc]
call fcn.18000d61c
inc edi
cmp edi, dword [rbp + 0x68]
jb 0x1800177ea
jmp 0x1800177b8
lea rdx, [0x18002cad4]
mov r8, r14
mov rcx, rbx
call fcn.18000d61c
jmp 0x1800177c7
xor edi, edi
test r13, r13
jne 0x180017871
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x58], r12d
call fcn.18001c370
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180017871
lea rdx, str._s_n
mov r8, rsi
mov rcx, rbx
call fcn.18000d61c
inc edi
jmp 0x180017833
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret