Function at 0x1800173c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x88
mov qword [rbp + 7], 0xfffffffffffffffe
mov r12, r9
mov r15, r8
mov r13, rdx
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x31], esi
mov qword [rbp - 0x29], rsi
mov dword [rbp - 0x21], esi
mov qword [rbp - 0x19], rsi
mov rcx, qword [r9]
sub rcx, 0x18
call fcn.180004fa8
add rax, 0x18
mov qword [rdi], rax
lea r14d, [rsi + 1]
mov dword [rbp - 0x31], r14d
mov rax, qword [r15]
cmp dword [rax - 0x10], esi
je 0x180017473
mov r8, r15
lea rdx, [0x180030b68]
lea rcx, [rbp - 0x11]
call fcn.180012f9c
nop
mov rdx, rax
mov rcx, r15
call fcn.18000cc64
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r14d
jg 0x180017473
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 1]
call fcn.18001650c
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.180004578
mov r9d, 0x20019
mov r8, qword [rax]
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x29]
call fcn.1800057d8
mov ebx, eax
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1800174c7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800174e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
mov rbx, qword [rbp - 0x29]
jne 0x1800175d6
mov dword [rbp - 0x39], esi
mov dword [rbp - 0x35], esi
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x2d]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180017530
mov eax, dword [rbp - 0x2d]
dec eax
cmp eax, r14d
ja 0x180017530
mov esi, dword [rbp - 0x39]
shr esi, 1
mov dword [rbp - 0x35], esi
lea edx, [rsi + 1]
test edx, edx
jns 0x180017542
mov ecx, 0x80070057
call fcn.180004f88
int3
mov rax, qword [rdi]
sub r14d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, r14d
jge 0x18001755b
mov rcx, rdi
call fcn.180005910
lea r9, [rbp - 0x35]
mov r8, qword [rdi]
mov rdx, qword [r13]
lea rcx, [rbp - 0x29]
call fcn.180013d80
mov esi, eax
mov rcx, qword [rdi]
xor r14d, r14d
test rcx, rcx
jne 0x180017581
mov eax, r14d
jmp 0x18001758e
movsxd rdx, dword [rcx - 0xc]
call fcn.18001ccb8
test eax, eax
js 0x1800175cb
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1800175cb
mov dword [rcx - 0x10], eax
movsxd rdx, eax
mov rax, qword [rdi]
mov word [rax + rdx*2], r14w
test esi, esi
je 0x1800175b3
mov rdx, r12
mov rcx, rdi
call fcn.18000cc64
xor esi, esi
test rbx, rbx
je 0x1800175d6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
mov qword [rbp - 0x29], rbx
jmp 0x1800175d6
mov ecx, 0x80070057
call fcn.180004f88
nop
test rbx, rbx
je 0x1800175e5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r13]
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x180017607
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x180017625
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x180017643
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret