Function at 0x1400168e8
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140038b10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0xf2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x1e8], 0
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 4], 0
mov eax, 0xac
mov word [rbp + 0x28], ax
mov eax, 0xae
mov word [rbp + 0x2a], ax
lea rax, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionUACCOMAutoApprovalList
mov qword [rbp + 0x30], rax
mov dword [rbp + 0xa4], 0xc0000001
mov qword [rbp + 0xe8], 0
mov dword [rbp + 0x104], 0
mov dword [rbp + 0x144], 0x1000
cmp qword [rbp + 0x3b8], 0
je 0x140038bcb
mov rax, qword [rbp + 0x3b8]
mov dword [rax], 0
mov dword [rbp + 0x58], 0x30
mov qword [rbp + 0x60], 0
mov dword [rbp + 0x70], 0x40
lea rax, [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
lea r8, [rbp + 0x58]
mov edx, 1
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x140038c22
mov dword [rbp + 0x374], 1
jmp 0x140038c2c
mov dword [rbp + 0x374], 0
mov eax, dword [rbp + 0x374]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140038dac
mov rdx, qword [rbp + 0x3b0]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [rbp + 0x144]
add rax, 0x24
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
add rax, 0xf
cmp rax, qword [rbp + 0x378]
ja 0x140038c82
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14001600a
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 0x380], rax
lea r8, [rbp + 0x1e8]
mov rdx, qword [rbp + 0x378]
mov rcx, qword [rbp + 0x380]
call fcn.1400166cc
add qword [rbp + 0x380], 0x20
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x144]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x168]
xor r8d, r8d
mov edx, dword [rbp + 0x104]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
jl 0x140038d8d
mov rax, qword [rbp + 0x168]
movzx eax, word [rax + 8]
mov word [rbp + 0x18a], ax
mov rax, qword [rbp + 0x168]
add rax, 0xc
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x168]
movzx eax, word [rax + 8]
mov word [rbp + 0x188], ax
mov r8b, 1
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
movzx eax, al
test eax, eax
je 0x140038d7d
mov rax, qword [rbp + 0x3b8]
mov dword [rax], 1
jmp 0x140038d9f
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
jmp 0x140038d8f
jmp 0x140038d9f
cmp dword [rbp + 0xa4], 0x8000001a
jne 0x140038cd8
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400553d0]
mov r8, qword [rbp + 0x1e8]
call fcn.1400166db
mov eax, edi
mov rcx, qword [rbp + 0x388]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret