Function at 0x18000a0f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8f0
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov dword [rsp + 0xdc], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0xe0]
call fcn.180074680
mov dword [rsp + 0xd8], 0x800
mov r14, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x18000a170
mov rbx, qword [rdi]
add r14, rbx
jmp 0x18000a176
add r14, rdi
mov rbx, rdi
mov qword [rsp + 0x78], r13
mov rcx, r13
mov qword [rsp + 0x88], rcx
mov r8d, 7
mov qword [rsp + 0x90], r8
mov word [rsp + 0x78], r13w
mov rdx, r14
sub rdx, rbx
cmp rdx, 8
jb 0x18000a1c3
lea rcx, [rsp + 0x78]
call fcn.180007970
mov rcx, r13
mov qword [rsp + 0x88], rcx
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
nop dword [rax]
cmp rbx, r14
je 0x18000a238
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000a219
lea rax, [rcx + 1]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
cmp r8, 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r13w
inc rbx
mov r8, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
jmp 0x18000a1d0
lea rcx, [rsp + 0x78]
call fcn.180007b50
inc rbx
mov r8, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
jmp 0x18000a1d0
lea r12, [rsp + 0x78]
cmp r8, 8
cmovae r12, qword [rsp + 0x78]
mov r14, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x18000a25a
mov rbx, qword [rsi]
add r14, rbx
jmp 0x18000a260
add r14, rsi
mov rbx, rsi
mov qword [rsp + 0x58], r13
mov rcx, r13
mov qword [rsp + 0x68], rcx
mov r8d, 7
mov qword [rsp + 0x70], r8
mov word [rsp + 0x58], r13w
mov rdx, r14
sub rdx, rbx
cmp rdx, 8
jb 0x18000a2a1
lea rcx, [rsp + 0x58]
call fcn.180007970
mov rcx, r13
mov qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
nop dword [rax + rax]
cmp rbx, r14
je 0x18000a309
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000a2f0
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp r8, 8
cmovae rax, qword [rsp + 0x58]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r13w
inc rbx
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
jmp 0x18000a2b0
lea rcx, [rsp + 0x58]
call fcn.180007b50
inc rbx
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
jmp 0x18000a2b0
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x18000a4c6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [r15], r13
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
mov r8d, 4
lea rdx, [0x1800c7b40]
mov rcx, r15
call fcn.180005f90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18000a3b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a3b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a88b
call fcn.180071ba8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rdx, qword [rsp + 0x90]
cmp rdx, 8
jb 0x18000a412
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a40d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a891
call fcn.180071ba8
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18000a466
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18000a461
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000a897
mov rcx, r8
call fcn.180071ba8
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x18000a4af
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18000a4aa
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x18000a87f
mov rcx, rax
call fcn.180071ba8
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rax, r15
jmp 0x18000a85c
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xdc]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], r13w
lea rax, [rsp + 0xe0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000a533
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xb8]
call fcn.180005e10
nop
lea rcx, [rsp + 0xb8]
mov r9, qword [rsp + 0xb8]
mov r10, qword [rsp + 0xd0]
cmp r10, 8
cmovae rcx, r9
mov rax, qword [rsp + 0xc8]
lea r14, [rcx + rax*2]
lea rbx, [rsp + 0xb8]
cmovae rbx, r9
mov qword [rsp + 0x98], r13
mov rcx, r13
mov qword [rsp + 0xa8], rcx
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xb0], r8
mov rdx, r14
sub rdx, rbx
sar rdx, 1
cmp rdx, 0x10
jb 0x18000a5ec
lea rcx, [rsp + 0x98]
call fcn.180015650
mov rcx, r13
mov qword [rsp + 0xa8], rcx
mov r10, qword [rsp + 0xd0]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
nop dword [rax]
cmp rbx, r14
je 0x18000a66d
movzx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000a63a
lea rax, [rcx + 1]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x98]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x98]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18000a647
lea rcx, [rsp + 0x98]
call fcn.180007190
add rbx, 2
mov r10, qword [rsp + 0xd0]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
jmp 0x18000a600
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0xa8]
movups xmmword [r15 + 0x10], xmm1
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], 0
cmp r10, 8
jb 0x18000a6dd
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000a6d5
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a885
mov rcx, r9
call fcn.180071ba8
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18000a73c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a88b
call fcn.180071ba8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rdx, qword [rsp + 0x90]
cmp rdx, 8
jb 0x18000a795
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a790
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a891
call fcn.180071ba8
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18000a7e9
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18000a7e4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000a897
mov rcx, r8
call fcn.180071ba8
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x18000a82e
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18000a829
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000a87f
mov rcx, r8
call fcn.180071ba8
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rax, r15
jmp 0x18000a85c
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.180071b80
add rsp, 0x8f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.18007a274
nop
call fcn.18007a274
nop
call fcn.18007a274
nop
call fcn.18007a274
nop
call fcn.18007a274
int3