Function at 0x140001730
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x3a20]
mov eax, 0x3b20
call fcn.140003930
sub rsp, rax
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rbp + 0x3a00], rax
mov r15d, edx
lea rax, [rsp + 0x40]
mov rbx, rcx
mov qword [rsp + 0x50], rcx
lea rdx, str.SYSTEMCurrentControlSetControlServiceGroupOrder
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001a17
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea rdx, str.List
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x12f0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 0x2710
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001a0c
mov qword [rsp + 0x3b10], r14
lea r14, [rbp + 0x12f0]
cmp byte [rbp + 0x12f0], al
je 0x140001a04
mov qword [rsp + 0x3b40], rsi
mov qword [rsp + 0x3b48], rdi
mov qword [rsp + 0x3b50], r12
mov qword [rsp + 0x3b18], r13
lea rdi, [0x14002ab00]
nop word [rax + rax]
lea rax, [rbp + 0x12f0]
mov rcx, r14
sub rcx, rax
mov eax, dword [rsp + 0x34]
cmp rcx, rax
jae 0x1400019df
xor edx, edx
mov rcx, r14
call fcn.140003208
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
mov r9d, 0x20019
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400018d1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x30], 0xfa0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400018c6
mov ebx, dword [rsp + 0x30]
shr ebx, 2
cmp dword [rsp + 0x30], 4
jb 0x1400018c6
mov eax, dword [rsp + 0x60]
inc eax
cmp eax, ebx
cmovb ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
inc ebx
mov dword [rsp + rax*4 + 0x60], 0xdeadbeef
cmp ebx, 1
jbe 0x1400019cd
lea r12, [rsp + 0x64]
lea r13d, [rbx - 1]
nop
cmp rdi, qword [section..data]
mov esi, dword [r12]
jae 0x1400019c0
lea rbx, [0x14002ab18]
nop dword [rax + rax]
cmp dword [rbx + 8], r15d
jne 0x1400019a4
mov rcx, qword [rbx]
mov rdx, r14
call fcn.140003378
test eax, eax
jne 0x1400019a4
cmp esi, 0xdeadbeef
je 0x140001936
cmp dword [rbx + 0xc], esi
jne 0x1400019a4
cmp dword [rbx + 0x10], 0
jne 0x1400019a4
mov r9, qword [rbx - 0x10]
lea rdi, [rbx - 0x18]
test r9, r9
je 0x140001961
mov r8, qword [rdi]
lea rdx, str._s____s__
lea rcx, [rbp + 0xf00]
call fcn.140003560
jmp 0x140001980
mov rax, qword [rdi]
lea r8, [rbp + 0xf00]
sub r8, rax
nop
movzx edx, byte [rax]
lea rax, [rax + 1]
mov byte [r8 + rax - 1], dl
test dl, dl
jne 0x140001970
xor r8d, r8d
cmp esi, 0xdeadbeef
mov rcx, rdi
setne r8b
xor edx, edx
test r14, r14
setne dl
call fcn.1400015f0
mov dword [rbx + 0x10], 1
add rbx, 0x30
lea rax, [rbx - 0x18]
cmp rax, qword [section..data]
jb 0x140001910
lea rdi, [0x14002ab00]
add r12, 4
dec r13
jne 0x1400018f0
mov r14, qword [rsp + 0x48]
inc r14
cmp byte [r14], 0
jne 0x140001820
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x3b18]
mov r12, qword [rsp + 0x3b50]
mov rdi, qword [rsp + 0x3b48]
mov rsi, qword [rsp + 0x3b40]
mov r14, qword [rsp + 0x3b10]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov edx, r15d
mov rcx, rbx
call section..text
mov rcx, qword [rbp + 0x3a00]
xor rcx, rsp
call fcn.140003990
add rsp, 0x3b20
pop r15
pop rbx
pop rbp
ret