Function at 0x18000fc40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 9], edi
mov dword [rbp + 0x77], edi
mov dword [rbp + 0x7f], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x78], rdi
lea rax, [rbp + 0x7f]
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000ff36
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180012694
mov r15, rax
mov dword [rbp + 3], edi
mov ecx, dword [rbp + 0x7f]
inc ecx
mov dword [rbp - 5], ecx
call fcn.180012694
mov r13, rax
mov esi, edi
cmp dword [rbp - 9], edi
jbe 0x18000ff1d
lea rax, [rbx + 0x28]
mov qword [rbp + 0x17], rax
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp - 1], eax
mov r8d, eax
xor edx, edx
mov rcx, r15
call fcn.180017bb0
mov r11d, dword [rbp + 0x7f]
inc r11d
mov dword [rbp - 5], r11d
mov r8d, r11d
xor edx, edx
mov rcx, r13
call fcn.180017bb0
lea r11, [rbp - 5]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov r8, r15
mov edx, esi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf], rax
mov r8, r15
lea rdx, [0x180034b74]
lea rcx, [rbp + 0xf]
call fcn.1800106f0
mov ecx, 0xa44
call fcn.180015378
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, 0xa44
call fcn.180014d00
mov ecx, gethostbyname
call fcn.180015378
mov r12, rax
mov qword [rbp + 7], rax
mov rcx, qword [r13 + 0xa44]
mov qword [rax], rcx
mov rcx, qword [r13 + 0xa4c]
mov qword [rax + 8], rcx
mov rcx, qword [r13 + 0xa54]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13 + 0xa5c]
mov qword [rax + 0x18], rcx
mov rcx, qword [r13 + 0xa64]
mov qword [rax + 0x20], rcx
mov rcx, qword [r13 + 0xa6c]
mov qword [rax + 0x28], rcx
movsxd rcx, dword [rdi + 0x208]
call fcn.180012694
mov rbx, rax
movsxd r8, dword [rdi + 0x208]
lea rdx, [r13 + 0xa74]
mov rcx, rax
call fcn.180014d00
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rbx
mov rax, qword [rbp + 0x17]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx + 0x438]
mov dword [r12 + 0x10], eax
mov eax, dword [rcx + 0x440]
mov dword [r12 + 0x14], eax
mov eax, dword [rcx + 0x448]
mov dword [r12 + 0x28], eax
mov qword [r12], rcx
lea rax, [rbp + 7]
mov rcx, qword [0x180046f80]
cmp rax, rcx
jae 0x18000febf
lea rdx, [rbp + 7]
mov rax, qword [0x180046f78]
cmp rax, rdx
ja 0x18000febf
lea rbx, [rbp + 7]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [0x180046f88]
jne 0x18000feb1
call fcn.1800103d0
mov rcx, qword [0x180046f80]
mov rax, qword [0x180046f78]
test rcx, rcx
je 0x18000fee3
mov rax, qword [rax + rbx*8]
mov qword [rcx], rax
jmp 0x18000fedc
cmp rcx, qword [0x180046f88]
jne 0x18000fed4
call fcn.1800103d0
mov rcx, qword [0x180046f80]
test rcx, rcx
je 0x18000fee3
mov qword [rcx], r12
mov rcx, qword [0x180046f80]
add rcx, 8
mov qword [0x180046f80], rcx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000ff0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + htons]
inc esi
cmp esi, dword [rbp - 9]
mov edi, 0
jb 0x18000fd12
mov rcx, r15
call fcn.180015860
mov rcx, r13
call fcn.180015860
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret