Function at 0x16704
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x488
mov rax, qword [0x0002b100]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rsi, qword [rsp + 0x4e0]
xor r12d, r12d
mov rdi, r9
mov rbp, rdx
mov rbx, rcx
cmp rcx, r12
je 0x1674e
mov eax, 0x208
cmp word [rcx + 2], ax
jb 0x169cf
mov qword [rsp + 0x50], r8
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r13d, 0x30
mov edx, 0x20019
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r12d
jge 0x167d3
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x20019
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r12d
jl 0x169cf
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea rax, [rsp + 0x38]
lea ebp, [r9 + 2]
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov r8d, ebp
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x169c4
mov eax, dword [rsp + 0x38]
cmp eax, r12d
je 0x169c4
add eax, 4
mov ecx, 0x400
mov dword [rsp + 0x38], eax
cmp eax, ecx
jae 0x169c4
mov dword [rsp + 0x38], ecx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x71]
xor edx, edx
mov byte [rsp + 0x70], r12b
call fcn.00025100
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rdx, rdi
mov dword [rsp + 0x20], 0x3fc
mov dword [rsp + 0x3c], r12d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r12d
jl 0x169c4
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffff4
cmp eax, 0x1fc
ja 0x169c4
mov r8d, dword [rsp + 0x78]
cmp r8d, eax
ja 0x169c4
cmp rbx, r12
je 0x16a44
or r13, 0xffffffffffffffff
cmp rsi, r12
je 0x168c2
xor eax, eax
mov rcx, r13
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
add edx, edx
jmp 0x168c4
mov edx, ebp
movzx eax, word [rbx + 2]
lea ecx, [r8 + rdx]
add rcx, rbp
cmp rcx, rax
ja 0x169c4
mov rax, qword [rbx + 8]
mov ecx, 0x22
mov word [rax], cx
cmp rsi, r12
je 0x1690a
mov rax, qword [rbx + 8]
mov rcx, rsi
mov word [rax], r12w
mov rdi, qword [rbx + 8]
movzx eax, word [rcx]
add rcx, rbp
mov word [rdi], ax
add rdi, rbp
cmp ax, r12w
jne 0x168f8
mov rax, qword [rbx + 8]
mov r8d, dword [rsp + 0x78]
mov edi, edx
lea rcx, [rdi + rax]
lea rdx, [rsp + 0x7c]
call fcn.00024c10
mov edx, dword [rsp + 0x78]
mov rax, qword [rbx + 8]
mov r9, qword [rsp + 0x4e8]
add rdx, rdi
mov word [rdx + rax], r12w
cmp r9, r12
je 0x16a2c
mov r8, qword [rbx + 8]
xor eax, eax
mov rcx, r13
mov rdi, r8
repne scasw ax, word [rdi]
mov rdi, r9
not rcx
lea r10, [rcx - 1]
mov rcx, r13
repne scasw ax, word [rdi]
movzx eax, word [rbx + 2]
not rcx
shr eax, 1
lea edx, [rcx + r10 + 1]
cmp edx, eax
jae 0x169c4
mov edx, 0x5c
cmp word [r9], dx
je 0x169f1
cmp word [r9], 0x2f
je 0x169f1
lea eax, [r10 - 1]
cmp word [r8 + rax*2], dx
je 0x169af
cmp word [r8 + rax*2], 0x2f
je 0x169af
mov eax, r10d
lea ecx, [r10 + 1]
mov word [r8 + rax*2], dx
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r12w
mov r8, r9
movzx edx, word [rbx + 2]
mov rcx, qword [rbx + 8]
call fcn.00014838
cmp eax, r12d
jge 0x16a2c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.00024bb0
add rsp, 0x488
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea eax, [r10 - 1]
cmp word [r8 + rax*2], dx
je 0x16a04
cmp word [r8 + rax*2], 0x2f
jne 0x16a09
mov word [r8 + rax*2], r12w
movzx edx, word [rbx + 2]
mov rcx, qword [rbx + 8]
mov r8, r9
call fcn.00014838
cmp eax, r12d
jl 0x169c4
cmp rsi, r12
jne 0x16a2c
lea r8, [0x000252d0]
jmp 0x169b2
mov rdi, qword [rbx + 8]
xor eax, eax
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add cx, cx
mov word [rbx], cx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x169d1