Function at 0x140016800
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x140054100]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov qword [rbp - 0x50], rdx
mov rdi, rcx
mov r14b, 1
lea rcx, [rsp + 0x40]
call fcn.140014060
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.http:__client.web.aol.com_toolbarfiles_Prod_Configs_
lea rdx, str._s__s__s_s
lea rcx, [rbp - 0x68]
call fcn.14000c330
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
je 0x1400168d6
mov rcx, r15
call qword [0x140041438]
test eax, eax
jne 0x1400168dd
lea r15, str.ietbres.zip
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx - 0x10]
or r12, 0xffffffffffffffff
test eax, eax
je 0x1400170ca
js 0x1400170ca
lea rdx, [0x1400461c8]
call fcn.1400277a8
mov rsi, rax
test rax, rax
je 0x1400170ca
sub rsi, qword [rsp + 0x40]
sar rsi, 1
cmp esi, r12d
je 0x1400170ca
mov r8d, esi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.14000fd10
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000bac0
lea rbx, [rax + 0x18]
mov qword [rbp - 0x20], rbx
xor r13d, r13d
test rbx, rbx
jne 0x140016953
mov ecx, r13d
jmp 0x140016964
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14000b480
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140016991
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400169b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000fce0
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000bac0
lea rbx, [rax + 0x18]
mov qword [rbp - 0x18], rbx
test rbx, rbx
jne 0x1400169e1
mov ecx, r13d
jmp 0x1400169f2
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000b480
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140016a1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140016a3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x48]
movsxd rbx, dword [rdi - 0x10]
test ebx, ebx
jns 0x140016a56
mov ecx, 0x80070057
call fcn.1400040f0
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140016a78
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.14000ba60
mov rdi, qword [rsp + 0x48]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140027f04
cmp ebx, dword [rdi - 0xc]
jg 0x1400170bf
mov dword [rdi - 0x10], ebx
mov word [rdi + rbx*2], r13w
lea r8, str..attempts
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.14001aca0
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000bac0
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140016ae1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r8d, r8d
lea rdx, str.config
lea rcx, [0x14005a9f0]
call fcn.14000dff0
mov rsi, rax
mov rdi, qword [rsp + 0x78]
test rax, rax
je 0x140016b5d
mov dword [rbp - 0x60], 4
mov dword [rbp - 0x80], 4
mov dword [rsp + 0x58], r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140016b5d
mov esi, dword [rsp + 0x58]
cmp esi, 0xa
jl 0x140016b60
xor r14b, r14b
jmp 0x1400170a2
mov esi, r13d
mov r8, qword [rsp + 0x40]
lea rdx, str.config
lea rcx, [0x14005a9f0]
call fcn.14000dce0
movsxd rcx, eax
mov qword [rsp + 0x60], rcx
xor ecx, ecx
call fcn.140027b10
mov qword [rsp + 0x68], rax
mov rcx, qword [0x14005a908]
cmp qword [rsp + 0x60], rcx
jl 0x140016c6c
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.1400282c0
mov ebx, r13d
test eax, eax
cmove ebx, dword [rbp - 4]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.1400282c0
mov ecx, r13d
test eax, eax
cmove ecx, dword [rbp + 0x4c]
cmp ebx, ecx
jne 0x140016c67
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x90]
call fcn.1400282c0
test eax, eax
jne 0x140016bf3
mov ebx, dword [rbp + 0xa0]
inc ebx
jmp 0x140016bf6
mov ebx, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x18]
call fcn.1400282c0
test eax, eax
jne 0x140016c0f
mov eax, dword [rbp + 0x28]
inc eax
jmp 0x140016c12
mov eax, r13d
cmp ebx, eax
jne 0x140016c67
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.1400282c0
test eax, eax
jne 0x140016c33
mov ebx, dword [rbp + 0x7c]
add ebx, 0x76c
jmp 0x140016c36
mov ebx, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xb8]
call fcn.1400282c0
test eax, eax
jne 0x140016c58
mov eax, dword [rbp + 0xcc]
add eax, 0x76c
jmp 0x140016c5b
mov eax, r13d
cmp ebx, eax
jne 0x140016c67
xor r14b, r14b
jmp 0x1400170a2
mov rax, qword [rsp + 0x68]
mov dword [rbp - 0x70], eax
mov r13, qword [rsp + 0x40]
mov r8b, 1
lea rdx, str.config
lea rcx, [0x14005a9f0]
call fcn.14000dff0
mov rbx, rax
test rax, rax
je 0x140016cc1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rsi + 1]
mov dword [rbp - 0x78], eax
mov r8b, 1
lea rdx, str.config
lea rcx, [0x14005a9f0]
call fcn.14000dff0
mov rbx, rax
test rax, rax
je 0x140016d14
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
mov rbx, qword [rsp + 0x70]
mov r9, rbx
mov r13, qword [rbp - 0x50]
mov r8, r13
lea rdx, [0x1400461f8]
lea rcx, [rsp + 0x30]
call fcn.14000c330
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov rsi, qword [rbp - 0x68]
mov r8, rsi
lea rdx, str._s__s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000c330
lea rcx, [rsp + 0x50]
call fcn.140014600
nop
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400167a0
test eax, eax
jne 0x14001703b
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8, r13
lea rdx, [0x140046228]
lea rcx, [rsp + 0x30]
call fcn.14000c330
lea rcx, [rsp + 0x30]
call fcn.14001aac0
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000c330
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400167a0
test eax, eax
jne 0x14001703b
lea rcx, [rbp - 0x58]
call fcn.140013e20
nop
xor r8d, r8d
mov r13d, r8d
test rbx, rbx
setne r13b
test r13d, r13d
jne 0x140016e4e
mov ecx, 0x80004005
call fcn.1400040f0
int3
mov r9, qword [rbp - 0x58]
mov rax, r9
mov rdx, rbx
sub rdx, r9
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140016e77
add rax, 2
test cx, cx
jne 0x140016e60
mov eax, r8d
jmp 0x140016e7c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140016ec7
mov qword [rsp + 0x20], rdi
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000c330
lea rcx, [rsp + 0x30]
call fcn.14001aac0
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400167a0
test eax, eax
jg 0x14001701b
mov rdi, qword [rsp + 0x30]
lea rcx, [rbp - 0x48]
call fcn.140013e20
nop
xor r8d, r8d
mov ecx, r8d
mov rax, qword [rbp - 0x58]
test rax, rax
setne cl
test ecx, ecx
jne 0x140016ef0
mov ecx, 0x80004005
call fcn.1400040f0
int3
mov r9, qword [rbp - 0x48]
mov rcx, r9
sub rax, r9
nop word [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140016f17
add rcx, 2
test dx, dx
jne 0x140016f00
mov eax, r8d
jmp 0x140016f1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140016f9e
test r13d, r13d
jne 0x140016f35
mov ecx, 0x80004005
call fcn.1400040f0
int3
mov rax, r9
sub rbx, r9
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rbx]
jne 0x140016f57
add rax, 2
test cx, cx
jne 0x140016f40
mov eax, r8d
jmp 0x140016f5c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140016f9e
mov qword [rsp + 0x20], rdi
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000c330
lea rcx, [rsp + 0x30]
call fcn.14001aac0
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400167a0
test eax, eax
jg 0x140016ffb
mov r9, r15
mov r8, qword [rbp - 0x50]
lea rdx, [0x140046258]
lea rcx, [rsp + 0x30]
call fcn.14000c330
lea rcx, [rsp + 0x30]
call fcn.14001aac0
mov r9, qword [rsp + 0x30]
mov r8, rsi
lea rdx, str._s__s
lea rcx, [rsp + 0x38]
call fcn.14000c330
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400167a0
movzx r14d, r14b
test eax, eax
mov r8d, 0
cmove r14d, r8d
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001701b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001703b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001705c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001707d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001709d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x78]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400170cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400170cd
mov ecx, 0x80070057
call fcn.1400040f0
int3
xor r14b, r14b
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400170ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001710f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001712f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14001714f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, r14b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140026aa0
add rsp, 0x1f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret