Function at 0x180016f70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r13
push r14
sub rsp, 0x2e8
xor r14d, r14d
lea rax, [rax + 0x18]
mov r13, rcx
mov qword [rax], r14
mov dword [rcx + 0x1990], r14d
lea rdx, str.SoftwareCLASSESFASTPROXY
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001727f
mov qword [rsp + 0x318], rbx
mov qword [rsp + 0x2e0], rbp
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2c8], r12
mov qword [rsp + 0x2c0], r15
lea r15d, [r14 + 1]
mov r12d, r14d
nop word [rax + rax]
mov rcx, qword [rsp + 0x310]
lea rax, [rsp + 0x300]
lea r9, [rsp + 0x308]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
lea r8, [rsp + 0x1c0]
mov qword [rsp + 0x30], rax
mov edx, r12d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x308], 0x100
mov dword [rsp + 0x300], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x18001723f
lea rcx, [rsp + 0xc0]
mov ebp, r14d
mov rdi, r14
mov esi, r14d
mov rbx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
test eax, eax
jle 0x18001722f
mov edx, esi
cmp rbx, r8
jge 0x1800170ae
nop
cmp byte [rsp + rbx + 0xc0], 0x3a
je 0x1800170a6
inc rbx
inc edx
cmp rbx, r8
jl 0x180017090
jmp 0x1800170ae
mov byte [rsp + rbx + 0xc0], r14b
movsxd rax, esi
inc rdi
inc rbx
lea rcx, [rsp + rax + 0xc0]
inc ebp
lea esi, [rdx + 1]
mov qword [rsp + rdi*8 + 0x38], rcx
cmp rdi, 0x10
je 0x1800170d4
cmp rbx, r8
jl 0x180017088
cmp ebp, 6
jne 0x18001722f
mov rcx, qword [rsp + 0x48]
mov r8, r14
mov r9d, r14d
movzx r10d, byte [rcx]
cmp r10b, 0x2d
cmove r8, r15
add r8, rcx
movzx edx, byte [r8]
test dl, dl
je 0x180017122
nop
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x18001722f
inc r8
movsx eax, dl
lea ecx, [r9 + r9*4]
movzx edx, byte [r8]
lea r9d, [rax + rcx*2 - 0x30]
test dl, dl
jne 0x180017100
cmp r10b, 0x2d
jne 0x18001712b
neg r9d
mov rcx, qword [rsp + 0x50]
mov r10, r14
mov r8d, r14d
movzx r11d, byte [rcx]
cmp r11b, 0x2d
cmove r10, r15
add r10, rcx
movzx edx, byte [r10]
test dl, dl
je 0x180017172
nop dword [rax]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x18001722f
inc r10
movsx eax, dl
lea ecx, [r8 + r8*4]
movzx edx, byte [r10]
lea r8d, [rax + rcx*2 - 0x30]
test dl, dl
jne 0x180017150
cmp r11b, 0x2d
jne 0x18001717b
neg r8d
movsxd rax, dword [r13 + 0x1990]
mov rdx, qword [rsp + 0x40]
imul rax, rax, 0xc4
mov word [rax + r13 + 0x112], r9w
movsxd rax, dword [r13 + 0x1990]
imul rax, rax, 0xc4
mov word [rax + r13 + 0x110], r8w
movsxd rax, dword [r13 + 0x1990]
mov r8d, 0x40
imul rax, rax, 0xc4
lea rcx, [rax + r13 + 0x114]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
movsxd r11, dword [r13 + 0x1990]
mov rdx, qword [rsp + 0x58]
imul r11, r11, 0xc4
lea rcx, [r11 + r13 + 0x154]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
movsxd r11, dword [r13 + 0x1990]
mov rdx, qword [rsp + 0x60]
imul r11, r11, 0xc4
lea rcx, [r11 + r13 + 0x194]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
inc dword [r13 + 0x1990]
cmp dword [r13 + 0x1990], 0x20
jge 0x18001723f
inc r12d
cmp r12d, 0x3e8
jl 0x180017000
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2c8]
mov rdi, qword [rsp + 0x2d0]
mov rsi, qword [rsp + 0x2d8]
mov rbp, qword [rsp + 0x2e0]
mov rbx, qword [rsp + 0x318]
xor eax, eax
add rsp, 0x2e8
pop r14
pop r13
ret