Function at 0x18004b600
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r13
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f8
lea r13d, [r9 + 0x203]
mov edi, r9d
mov r15, rcx
cmp r9d, r13d
jae 0x18004b8a7
mov qword [rax + 8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], r12
mov r12, qword [rbp + 0x240]
mov qword [rax - 0x38], r14
mov r14, qword [rsp + 0x50]
mov eax, edi
sub eax, 0x43
je 0x18004b6c6
sub eax, 0x14
je 0x18004b699
sub eax, 0x53
je 0x18004b876
sub eax, 0x14
je 0x18004b67e
cmp eax, 0x67
je 0x18004b876
jmp 0x18004b86a
mov eax, dword [rdx]
mov rbx, r14
mov qword [rsp + 0x38], rbx
mov dword [r14 + 0xc], eax
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r8
jmp 0x18004b86a
xor edx, edx
mov qword [rsp + 0x50], 0x28
lea r9, [rsp + 0x50]
xor ecx, ecx
lea r8d, [rdx + 0x76]
call fcn.180032fc0
mov r14, rax
mov qword [rax], r12
mov dword [rax + 8], 1
jmp 0x18004b85c
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, str.cannot_add_local_filter_rules_in_long_named_directory:__s
mov esi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
test eax, eax
je 0x18004b710
lea ecx, [rsi + 3]
call fcn.180074128
mov rcx, rax
lea r8, str.cannot_add_local_filter_rules_in_long_named_directory:__s
mov r9d, ebx
lea rdx, str.cannot_open_reg_key__s:__d_n
call fcn.180064640
jmp 0x18004b853
mov ebx, 0x4b
cmp ebx, 0x4b
jne 0x18004b848
mov rcx, qword [rsp + 0x30]
lea esi, [rbx - 0x4c]
mov r9d, 0x200
lea r8, [rbp - 0x20]
xor edx, edx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x18004b835
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x238], 0x80
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18004b7e6
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x238]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.NameServer
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18004b7d0
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x238]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.EnsureCapacity
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18004b7e6
mov edx, 0x2c
lea rcx, [rsp + 0x60]
call fcn.180067ccc
cmp byte [rsp + 0x60], 0
jne 0x18004b809
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x20]
inc ebx
mov r9d, 0x200
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x18004b742
jmp 0x18004b835
test rax, rax
je 0x18004b811
mov byte [rax], 0
mov rdx, qword [r15]
lea r9, [rsp + 0x60]
lea r8, str.DBBrowserDB
mov rcx, r12
call fcn.1800644d0
mov rcx, qword [rsp + 0x48]
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
mov ebx, 0x4b
lea edi, [rbx - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
dec ebx
cmp ebx, 0x4a
ja 0x18004b715
mov dword [rsp + 0x38], esi
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rbp + 0x228]
mov r8, qword [rbp + 0x230]
add edi, 0x67
cmp edi, r13d
jb 0x18004b656
mov r12, qword [rsp + 0x2e8]
mov rax, rbx
mov rbx, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x2f0]
mov r14, qword [rsp + 0x2e0]
add rsp, 0x2f8
pop r15
pop r13
pop rdi
pop rbp
ret
mov rax, qword [rsp + 0x38]
add rsp, 0x2f8
pop r15
pop r13
pop rdi
pop rbp
ret