Function at 0x140016920
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1420]
mov eax, 0x1520
call fcn.14002d600
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1570], rbx
mov rax, qword [0x140050900]
xor rax, rsp
mov qword [rbp + 0x1410], rax
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x74], 0x104
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rcx, rsi
call fcn.140014a08
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400169b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140016a1a
lea rdx, str.Failed_to_open_registry_key__s
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov r8, r14
cmovle ebx, eax
mov ecx, ebx
call fcn.140009844
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140016a13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x140016cce
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x74]
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140016a71
lea rdx, str.Failed_to_examine_registry_key__s
jmp 0x1400169ea
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140016cbc
mov r14d, r12d
mov edi, 0x80070000
movabs r13, 0x333333333333332
mov dword [rsp + 0x78], 0xff
mov word [rbp], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
lea r8, [rbp]
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x140016cf8
cmp dword [rsp + 0x6c], 1
jne 0x140016b95
mov word [rbp + 0x410], r12w
mov dword [rsp + 0x68], 0x1000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rbp]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x140016c7d
lea rax, [rbp]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x410]
mov qword [rbp - 0x78], rax
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
mov r15, qword [rbx + 8]
lea r9, [rbp - 0x80]
mov r8, r15
mov rdx, rbx
call fcn.140017c9c
mov rdx, qword [rsi + 0x10]
mov rcx, r13
sub rcx, rdx
cmp rcx, 1
jb 0x140016d22
lea rcx, [rdx + 1]
mov qword [rsi + 0x10], rcx
mov qword [rbx + 8], rax
mov qword [r15], rax
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140014d34
jmp 0x140016cae
cmp dword [rsp + 0x6c], 4
jne 0x140016cae
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x7c], 4
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140016c7d
mov edx, dword [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.14001166c
nop
lea rcx, [rbp]
mov qword [rbp - 0x48], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
mov r15, qword [rbx + 8]
lea r9, [rbp - 0x48]
mov r8, r15
mov rdx, rbx
call fcn.140017d04
mov rdx, qword [rsi + 0x10]
mov rcx, r13
sub rcx, rdx
cmp rcx, 1
jb 0x140016d15
lea rcx, [rdx + 1]
mov qword [rsi + 0x10], rcx
mov qword [rbx + 8], rax
mov qword [r15], rax
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.140014d34
nop
lea rcx, [rbp - 0x40]
call fcn.14000a110
nop
lea rcx, [rbp - 0x20]
call fcn.14000a110
jmp 0x140016cae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx r8d, bx
or r8d, edi
test ebx, ebx
cmovle r8d, ebx
movzx ecx, ax
or ecx, edi
test eax, eax
lea rdx, str.Failed_to_read_registry_value_hr0x_08x
cmovle ecx, eax
call fcn.140009844
inc r14d
cmp r14d, dword [rsp + 0x70]
jb 0x140016a8f
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140016ccc
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x1410]
xor rcx, rsp
call fcn.14002c310
mov rbx, qword [rsp + 0x1570]
add rsp, 0x1520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
lea rdx, str.Failed_to_enumerate_registry_key
mov ecx, ebx
call fcn.140009844
jmp 0x140016a03
lea rcx, str.list_T__too_long
call fcn.14000fd94
nop
lea rcx, str.list_T__too_long
call fcn.14000fd94
int3