Function at 0x180016de0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
lea r13d, [rdx - 0xc]
xor r10d, r10d
mov r14, r9
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov r12d, edx
cmp edx, r13d
jbe 0x1800170f1
mov ebx, dword [rbp + 0x6f]
lea r15d, [rdx - 0x7e]
lea rdx, [0x180000000]
lea r9d, [r10 + 0x56]
lea r8d, [r10 + 0x69]
nop dword [rax]
cmp r15d, 0x12
ja case.0x180016e55.7
mov ecx, dword [rdx + r15*4 + 0x172a4]
add rcx, rdx
jmp rcx
mov r9, qword [r14]
lea rax, [rbp - 0xd]
mov word [rbp - 0xf], r10w
mov edx, 1
lea r8, [r9 + 4]
sub r9, rax
nop
lea rax, [r9 + rdx*2]
movzx ecx, word [rbp + rax - 0xd]
lea r8, [r8 + 4]
add cx, word [rbp + rdx*2 - 0x11]
mov word [rbp + rdx*2 - 0xf], cx
add cx, word [r8 - 4]
mov word [rbp + rdx*2 - 0xd], cx
add rdx, 2
cmp rdx, 0xf
jl 0x180016e70
cmp dword [rdi], 0
mov edx, r10d
jle 0x180016edd
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea r8, [rsi + rax*2]
movsx rax, word [rsi + rax*2]
test ax, ax
je 0x180016ed7
movsx rcx, word [rbp + rax*2 - 0x11]
mov rax, qword [r14 + 8]
mov word [rax + rcx*2], dx
movsx rax, word [r8]
inc word [rbp + rax*2 - 0x11]
inc edx
cmp edx, dword [rdi]
jl 0x180016eb0
mov dword [rbp - 0x79], ebx
jmp 0x1800170cc
mov rcx, qword [r14]
mov edx, 1
add rcx, 2
movsx eax, word [rcx]
add ebx, ebx
sub ebx, eax
js 0x18001717d
inc rdx
add rcx, 2
cmp rdx, 0xf
jle 0x180016ef1
jmp 0x1800170d8
mov r8d, 1
mov dword [rbp - 0x71], 0x56
lea rdx, [0x18009b4cc]
lea rcx, [rbp - 0x6f]
call fcn.18006f0ec
xor r10d, r10d
mov dword [rbp - 0x6d], 0x370038
jmp 0x1800170cc
mov rdx, qword [r14]
lea rax, [rdx + 0x1e]
cmp rdx, r14
ja 0x180016f67
cmp rax, r14
jb 0x180016f67
mov rcx, r10
mov rax, qword [r14]
mov word [rcx + rax], r10w
add rcx, 2
cmp rcx, 0x1e
jle 0x180016f50
jmp 0x1800170d8
movzx ecx, r10w
mov eax, ecx
shl ecx, 0x10
or ecx, eax
movd xmm0, ecx
pshufd xmm0, xmm0, 0
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
jmp 0x1800170d8
mov r8d, 5
mov word [rbp - 0x5f], r10w
lea rdx, [0x18009b4e8]
lea rcx, [rbp - 0x5f]
call fcn.18006f0ec
xor r10d, r10d
jmp 0x1800170cc
mov ebx, 1
jmp case.0x180016e55.7
mov word [rbp - 0x61], r8w
jmp case.0x180016e55.7
mov r8d, 3
lea rdx, [0x18009b51e]
lea rcx, [rbp - 0x51]
call fcn.18006f0ec
xor r10d, r10d
mov word [rbp - 0x4b], r10w
jmp 0x1800170cc
mov r8d, 1
mov word [rbp - 0x69], r10w
lea rdx, [0x18009b5b8]
lea rcx, [rbp - 0x69]
call fcn.18006f0ec
mov eax, dword [0x18009b5d0]
xor r10d, r10d
mov dword [rbp - 0x67], eax
movzx eax, word [0x18009b5d4]
mov word [rbp - 0x63], ax
mov word [rbp - 0x61], r10w
jmp 0x1800170cc
mov r8d, dword [rdi]
mov edx, r10d
test r8d, r8d
jle 0x180017048
nop dword [rax + rax]
mov eax, edx
inc edx
movsx rcx, word [rsi + rax*2]
mov rax, qword [r14]
inc word [rax + rcx*2]
mov r8d, dword [rdi]
cmp edx, r8d
jl 0x180017030
mov rax, qword [r14]
movsx ecx, word [rax]
cmp ecx, r8d
jne 0x1800170d2
mov eax, r10d
jmp 0x180017249
mov r8d, 3
lea rdx, [0x18009b5f4]
lea rcx, [rbp - 0x4b]
call fcn.18006f0ec
mov eax, dword [0x18009b622]
xor r10d, r10d
mov dword [rbp - 0x45], eax
movzx eax, word [0x18009b626]
mov word [rbp - 0x41], ax
mov word [rbp - 0x3f], r10w
jmp 0x1800170cc
mov r8d, 1
mov word [rbp - 0x55], r10w
lea rdx, [0x18009b6f4]
lea rcx, [rbp - 0x55]
call fcn.18006f0ec
xor eax, eax
lea rdx, [0x18009b748]
lea rcx, [rbp - 0x53]
mov word [rbp - 0x53], ax
lea r8d, [rax + 1]
call fcn.18006f0ec
xor r10d, r10d
mov word [rbp - 0x51], r10w
mov r9d, 0x56
mov r8d, 0x69
lea rdx, [0x180000000]
dec r12d
dec r15d
cmp r12d, r13d
ja 0x180016e40
mov ebx, dword [rbp + 0x6f]
lea esi, [rbx + 0x4d4]
cmp ebx, esi
jae 0x180017246
mov r13d, dword [rbp + 0x6f]
mov ecx, 0x65
movzx edi, byte [rbp + 0x6f]
mov r15, qword [rbp - 0x79]
mov r12, qword [rbp - 0x79]
lea edx, [rcx + 0xf]
lea r8d, [rcx + 3]
nop dword [rax + rax]
cmp ebx, 0x220
ja 0x1800171c5
je 0x1800171b6
mov eax, ebx
sub eax, 0x84
je 0x1800171a9
sub eax, 0xc
je 0x180017246
sub eax, 0x5b
je 0x180017194
sub eax, 0x67
je 0x180017184
cmp eax, 0x67
jne 0x180017232
mov dword [rbp - 0x25], 0x680073
mov dword [rbp - 0x21], 0x740020
mov dword [rbp - 0x1d], 0x6b006f
mov dword [rbp - 0x19], 0x6e0065
mov word [rbp - 0x15], r10w
jmp 0x180017232
mov eax, ebx
jmp 0x180017249
mov dword [rbp - 0x2b], 0x720066
mov word [rbp - 0x27], cx
jmp 0x180017232
mov word [rbp - 0x33], r8w
mov dword [rbp - 0x31], 0x720020
mov word [rbp - 0x2d], cx
jmp 0x180017232
mov dword [rbp - 0x39], 0x690057
mov word [rbp - 0x35], dx
jmp 0x180017232
mov dil, 1
mov r15, r10
mov r12, 0xffffffff80000001
jmp 0x180017232
mov eax, ebx
sub eax, 0x2ee
je 0x18001728f
sub eax, 0x67
je 0x18001727a
sub eax, 0x67
je 0x1800171f7
sub eax, 0x67
je 0x1800171ec
cmp eax, 0x67
je 0x180017246
jmp 0x180017232
cmp qword [r14 + 0x40], 0
setne byte [rbp - 0x79]
jmp 0x180017232
mov r9d, r13d
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x71]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
lea rdx, [rbp + 0xf]
mov rcx, r15
mov rbx, rax
call sub.IMM32.dll_ImmGetCompositionWindow
test rbx, rbx
jne 0x18001726a
xor dil, dil
mov ebx, dword [rbp + 0x6f]
mov r8d, 0x68
lea edx, [r8 + 0xc]
lea ecx, [rdx - 0xf]
add ebx, 0x67
mov r10d, 0
mov dword [rbp + 0x6f], ebx
cmp ebx, esi
jb 0x180017120
mov eax, dword [rbp - 0x79]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test dil, dil
je 0x180017222
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x180017222
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
mov r13d, r10d
mov dword [rbp + 0x27], eax
jmp 0x180017232
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [r14 + 0x40], rax
jmp 0x180017225