Function at 0x1017680
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
lea rax, [r11 + 8]
xor r14d, r14d
mov rdi, rcx
mov qword [r11 - 0x58], rax
lea rax, [r11 + 0x10]
lea rbx, [0x01007040]
mov qword [r11 - 0x60], rax
mov rsi, 0xffffffff80000001
lea r9d, [r14 + 0x18]
lea r8, [0x01007008]
mov rdx, rbx
mov rcx, rsi
mov qword [r11 - 0x68], r14
mov qword [r11 + 0x18], r14
mov dword [r11 + 8], 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, r14d
jne 0x101770e
mov ecx, dword [rsp + 0x98]
mov eax, ecx
and eax, 1
mov dword [rdi + 0xbc], eax
mov eax, ecx
shr ecx, 2
shr eax, 1
and eax, 1
and ecx, 1
mov dword [rdi + 0xc4], ecx
mov dword [rdi + 0xc0], eax
jmp 0x1017726
mov dword [rdi + 0xbc], 1
mov dword [rdi + 0xc0], r14d
mov dword [rdi + 0xc4], r14d
cmp dword [rdi + 0xc4], r14d
je 0x10177e4
lea rax, [rsp + 0x90]
mov ebp, 0x20
lea r8, [0x01006fd8]
mov qword [rsp + 0x30], rax
mov rdx, rbx
mov rcx, rsi
mov r9d, ebp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x90], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, r14d
jne 0x10177dd
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rdi + 0xc8], rax
cmp rax, r14
je 0x10177dd
lea r10, [rsp + 0x90]
lea r8, [0x01006fd8]
mov r9d, ebp
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
cmp eax, r14d
je 0x10177e4
mov rcx, qword [rdi + 0xc8]
cmp rcx, r14
je 0x10177d6
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rdi + 0xc8], r14
mov qword [rdi + 0xc8], r14
mov dword [rdi + 0xc4], r14d
lea rcx, [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x01031110]
xor edx, edx
call fcn.0101bb20
mov rbx, rax
cmp rax, r14
jne 0x101780e
mov esi, 0x80004005
jmp 0x101790b
cmp dword [rax + 0x1c], 1
jne 0x1017804
mov rdx, rax
mov rcx, rdi
call fcn.0101792c
cmp eax, r14d
mov esi, eax
jl 0x101790b
cmp dword [rbx + 0x5c], r14d
jne 0x101786f
mov rcx, qword [0x01031110]
mov edx, 2
call fcn.0101bb20
mov rbx, rax
cmp rax, r14
je 0x101786f
mov rdx, rax
mov rcx, rdi
call fcn.01017a78
cmp eax, r14d
je 0x101786f
mov rdx, rbx
mov rcx, rdi
call fcn.0101792c
cmp eax, r14d
mov esi, eax
jl 0x101790b
mov rbx, qword [0x01031110]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x48], r14b
lea rax, [rbx + 0x28]
mov qword [rsp + 0x40], rax
call fcn.01015798
mov r12d, dword [rbx + 0x20]
cmp byte [rsp + 0x48], r14b
je 0x10178a4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebp, r14d
cmp r12d, r14d
jbe 0x101790b
mov rcx, qword [0x01031110]
lea r8, [rsp + 0xa0]
mov edx, ebp
call fcn.0101ba68
cmp eax, r14d
mov esi, eax
jl 0x101790b
mov rbx, qword [rsp + 0xa0]
cmp rbx, r14
je 0x1017904
cmp dword [rbx + 0x54], r14d
jne 0x1017904
cmp dword [rbx + 0x5c], r14d
jne 0x1017904
mov rdx, rbx
mov rcx, rdi
call fcn.01017a78
cmp eax, r14d
je 0x1017904
mov rdx, rbx
mov rcx, rdi
call fcn.0101792c
cmp eax, r14d
mov esi, eax
jl 0x101790b
inc ebp
cmp ebp, r12d
jb 0x10178ac
lea rcx, [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret