Function at 0x140016460
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x348]
sub rsp, 0x430
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov ebx, r14d
mov dword [rsp + 0x30], ebx
nop word [rax + rax]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x210]
call fcn.14005b890
lea r8, [rbp + 0x210]
mov edx, ebx
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x100]
call fcn.14005b890
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x100]
call fcn.140013050
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x10]
call fcn.14005b890
xor bl, bl
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x210]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400165be
mov dword [rsp + 0x34], r14d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 0x102
ja 0x1400165b3
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14001678e
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400165e0
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140016638
cmp eax, 0xc
je 0x1400167b8
cmp eax, 0x16
je 0x1400167ad
cmp eax, 0x22
je 0x1400167ad
cmp eax, 0x50
jne 0x1400167a2
mov rcx, qword [rsp + 0x60]
call fcn.140015e80
movzx ebx, al
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140016659
call fcn.14005d86c
test bl, bl
je 0x14001678e
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x30]
cmp byte [rcx + 0x19], 0
jne 0x14001668c
cmp dword [rcx + 0x20], edx
jae 0x140016680
mov rcx, qword [rcx + 0x10]
jmp 0x140016686
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140016675
cmp rbx, rax
je 0x140016696
cmp edx, dword [rbx + 0x20]
jae 0x1400166cb
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c20
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140018c60
mov rbx, qword [rsp + 0x48]
cmp byte [rbp - 0x10], 0
jne 0x1400166d6
mov r8, r14
jmp 0x1400166ea
lea rax, [rbp - 0x10]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400166e0
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x10]
call fcn.140002500
mov ebx, dword [rsp + 0x30]
cmp ebx, edi
je 0x14001678a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140016715
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140016761
cmp eax, 0xc
je 0x1400167d9
cmp eax, 0x16
je 0x1400167ce
cmp eax, 0x22
je 0x1400167ce
cmp eax, 0x50
jne 0x1400167c3
mov r9d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140016d40
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140016786
call fcn.14005d86c
mov ebx, dword [rsp + 0x30]
inc edi
jmp 0x140016792
mov ebx, dword [rsp + 0x30]
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 9
ja 0x1400167e4
jmp 0x1400164b0
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14003aa30
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret