Function at 0x1600c3500
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rax, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x68]
mov r9d, 8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov rbp, rdx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
xor ebx, ebx
mov esi, eax
test eax, eax
jne 0x1600c368b
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x60], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test eax, eax
jne 0x1600c3609
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x80]
call fcn.1600c3500
mov esi, eax
test eax, eax
je 0x1600c3672
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x2b8]
lea r8, [rsp + 0x80]
mov r9, rbp
mov dword [rsp + 0x20], esi
lea rdx, str.MSS:__DeleteSubKeyTree_call_failed_to_delete_reg_key_tree__ls_under__ls___error_0x_X.
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteSubKeyTree
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xaa
jmp 0x1600c3663
cmp esi, 0x103
je 0x1600c367c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x2b8]
lea rdx, str.MSS:__DeleteSubKeyTree_call_failed_to_enumerate_reg_subkeys_for__ls___error_0x_X.
mov r9d, esi
mov r8, rbp
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteSubKeyTree
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], VariantTimeToSystemTime
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
xor ebx, ebx
test esi, esi
je 0x1600c3554
jmp 0x1600c367e
mov esi, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1600c36f8
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1600c36f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x2b8]
lea rdx, str.MSS:__DeleteSubKeyTree_call_failed_to_open_reg_key__ls___error_0x_X.
mov r9d, esi
mov r8, rbp
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteSubKeyTree
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xbf
call fcn.1600ecb60
xor ebx, ebx
jmp 0x1600c36f8
mov esi, ebx
test esi, esi
jne 0x1600c3770
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.1600c33c8
mov esi, eax
test eax, eax
je 0x1600c3779
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x2b8]
lea rdx, str.MSS:__DeleteSubKeyTree_call_failed_to_delete_reg_key__ls___error_0x_X.
mov r9d, esi
mov r8, rbp
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteSubKeyTree
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], CreateErrorInfo
call fcn.1600ecb60
jmp 0x1600c3779
lea eax, [rsi - 2]
cmp eax, 1
cmovbe esi, ebx
mov eax, esi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret