Function at 0x1016e80
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x188], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
movzx r12d, r9b
mov r13, r8
mov rbp, rdx
mov rsi, rcx
lea rax, [r11 - 0xc0]
mov qword [r11 - 0x48], rax
lea r15, [0x010048d0]
mov qword [r11 - 0xc0], r15
lea rbx, [0x010048c0]
mov qword [r11 - 0xb8], rbx
mov dword [rsp + 0x118], 0x202
mov dword [rsp + 0x11c], 0x4000
xor r14d, r14d
mov dword [r11 - 0xa8], r14d
mov word [r11 - 0x50], r14w
mov byte [r11 - 0x4e], r14b
mov byte [r11 - 0x4d], 1
mov qword [r11 - 0xa0], r14
mov qword [r11 - 0x98], r14
mov qword [r11 - 0x90], r14
mov qword [r11 - 0x88], r14
mov qword [r11 - 0x80], r14
mov qword [r11 - 0x78], r14
mov qword [r11 - 0x70], r14
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r14
mov qword [r11 - 0x58], r14
lea rax, [r11 - 0xc0]
mov qword [r11 - 0xd0], rax
mov dword [r11 - 0x100], r14d
lea rcx, [0x01004c20]
mov qword [r11 - 0xf8], rcx
mov rax, qword [r11 - 0xb8]
mov qword [r11 - 0xf0], rax
mov r8d, dword [r11 - 0xb0]
mov dword [r11 - 0xe8], r8d
mov eax, dword [rsp + 0x11c]
mov dword [rsp + 0xe4], eax
mov r9d, dword [r11 - 0xa8]
mov dword [r11 - 0xe0], r9d
cmp dword [0x010237e0], r14d
je 0x1016ff3
cmp dword [0x01023800], r14d
je 0x1016ff3
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rdx, qword [r11 - 0xc0]
lea rcx, [0x010237e0]
call fcn.0100f6a0
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp byte [rsp + 0x17b], 0
je 0x1017032
lea rbx, [rsp + 0x128]
mov edi, 0xa
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1017021
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx], r14
add rbx, 8
sub rdi, 1
jne 0x1017010
lea rbx, [0x010048c0]
mov dword [r13], r14d
mov dword [rsp + 0x1d0], r14d
mov dword [rsp + 0x1e0], r14d
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x1d0]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
cmp eax, 2
jne 0x101730b
test r12b, r12b
je 0x1017206
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x218
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsi + 8]
lea r8, [0x01004af0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.01010c20
lea r11, [rsp + 0x50]
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x21b
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
lea r9, [0x01004ac0]
mov r8d, 0x80070057
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.01007cc0
int3
cmp dword [0x010237e0], 0
je 0x1017289
cmp dword [0x01023800], 0
je 0x1017289
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
lea r9, [0x010048a0]
mov r8, qword [rsp + 0xd0]
lea rdx, [0x01004870]
lea rcx, [0x010237e0]
call fcn.0100f1b0
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp dword [0x010237e0], 0
je 0x1017304
cmp dword [0x01023800], 0
je 0x1017304
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
mov r8d, dword [rsp + 0xc8]
lea rdx, [0x01001578]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010237e0]
call fcn.0100f900
xor al, al
jmp 0x1017730
test eax, eax
je 0x1017404
cmp eax, 0xea
je 0x1017404
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x221
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
test r8d, r8d
jle 0x10173be
movzx r8d, r8w
or r8d, 0x80070000
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x01004a60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.010108a0
cmp dword [rsp + 0x1d0], 4
je 0x10174e4
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x227
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x38], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x20], eax
lea r9, [0x01004bb0]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.01007cc0
int3
mov dword [rsp + 0x104], r14d
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0xf0], eax
mov dword [rsp + 0x100], r14d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x104]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
test eax, eax
je 0x1017625
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x23b
mov dword [rsp + 0x64], 0x4000
mov dword [rsp + 0x68], r14d
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
test r8d, r8d
jle 0x10175df
movzx r8d, r8w
or r8d, 0x80070000
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbp
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x01004a60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.010108a0
mov eax, dword [rsp + 0x100]
mov dword [r13], eax
cmp dword [0x010237e0], 0
je 0x10176b3
cmp dword [0x01023800], 0
je 0x10176b3
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
lea r9, [0x010048b0]
mov r8, qword [rsp + 0xd0]
lea rdx, [0x01004870]
lea rcx, [0x010237e0]
call fcn.0100f1b0
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp dword [0x010237e0], 0
je 0x101772e
cmp dword [0x01023800], 0
je 0x101772e
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xe8]
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
mov r8d, dword [rsp + 0xc8]
lea rdx, [0x01001578]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, dword [rsp + 0xe8]
lea rcx, [0x010237e0]
call fcn.0100f900
mov al, 1
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret