Function at 0x17aef90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rsi
mov eax, 0x1930
call fcn.0119a4f0
sub rsp, rax
mov rax, qword [0x039f1190]
xor rax, rsp
mov qword [rsp + 0x18f0], rax
mov qword [rsp + 0x1958], rbx
mov qword [rsp + 0x1928], rbp
mov qword [rsp + 0x1920], rdi
mov qword [rsp + 0x1918], r12
mov qword [rsp + 0x1910], r13
mov qword [rsp + 0x1908], r14
xor r14d, r14d
test edx, edx
movsxd r13, edx
mov rbx, r8
mov rdi, rcx
mov esi, 0x80004005
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x60], r14
mov ebp, r14d
mov r12d, r13d
je 0x17af016
mov r8, r12
xor edx, edx
mov rcx, rbx
add r8, r8
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0xee0]
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x17af048
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x017afa90]
call fcn.017ae780
jmp 0x17af51c
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x14f0]
lea r9, [rsp + 0x6d0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x12f0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xee0]
mov r8d, 3
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.MSVCR80.dll__wsplitpath_s]
lea r8, [rsp + 0x6d0]
lea rcx, [rsp + 0xad0]
mov edx, 0x100
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
lea r8, [0x017afa78]
lea rcx, [rsp + 0xad0]
mov edx, 0x100
call qword [sym.imp.MSVCR80.dll_wcscat_s]
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rdx
lea rdx, [0x017afa30]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x17af51c
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x1900], r15
mov qword [rsp + 0x20], r14
mov r15d, r14d
mov dword [rsp + 0x58], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x17af4d7
nop
nop
test eax, eax
jne 0x17af5aa
lea r9, [rsp + 0xa0]
lea r8, [0x017af9c0]
lea rcx, [rsp + 0x2b0]
mov edx, 0x104
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17af485
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x2b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov word [rsp + 0x4b6], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x17af485
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c0]
lea r8, [rsp + 0xcd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x17af472
nop
cmp eax, 0xea
je 0x17af40e
test eax, eax
jne 0x17af587
cmp dword [rsp + 0x68], 1
jne 0x17af40e
mov eax, dword [rsp + 0x50]
and eax, 0xfffffffe
cmp eax, 0x208
ja 0x17af40e
lea rsi, [rsp + 0xcd0]
lea rdi, [0x017af9a8]
mov ecx, 8
repe cmpsw word [rsi], word [rdi]
jne 0x17af40e
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x10f0]
lea r9, [rsp + 0x8d0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x16f0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x4c0]
mov r8d, 3
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.MSVCR80.dll__wsplitpath_s]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x88]
mov r8d, 3
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17af40e
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0x6d0]
mov r8d, 0x100
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
je 0x17af33e
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0xad0]
mov r8d, 0x100
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17af40e
lea rsi, [rsp + 0xa0]
lea rdi, [0x01580b90]
mov ecx, reloc.WS2_32.dll_socket
repe cmpsw word [rsi], word [rdi]
je 0x17af3ef
lea rsi, [rsp + 0xa0]
lea rdi, [0x01580bd0]
mov ecx, VariantTimeToDosDateTime
repe cmpsw word [rsi], word [rdi]
je 0x17af3ef
lea rdx, [0x01580bc0]
lea rcx, [rsp + 0xa0]
mov r8d, 7
call qword [sym.imp.MSVCR80.dll_wcsncmp]
test eax, eax
jne 0x17af3d1
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, r12
jae 0x17af3d1
lea r8, [rsp + 0xa0]
mov rdx, r12
mov rcx, rbx
add ebp, 1
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
mov word [rbx + r13*2 - 2], 0
jmp 0x17af40e
lea r8, [rsp + 0x4c0]
lea rdx, [rsp + 0xa0]
lea rcx, [0x017af8b0]
call fcn.017ae780
jmp 0x17af40e
lea r8, [rsp + 0xa0]
mov rdx, r12
mov rcx, rbx
add ebp, 1
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
mov word [rbx + r13*2 - 2], 0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
add r14d, 1
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c0]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
lea r8, [rsp + 0xcd0]
mov qword [rsp + 0x28], rax
mov edx, r14d
mov dword [rsp + 0x54], 0x104
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x17af230
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
add r15d, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xa0]
mov edx, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x58], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x17af160
test ebp, ebp
jne 0x17af502
lea rcx, [0x017af7f0]
call fcn.017ae780
lea r8, [0x01580b90]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, r13d
add ecx, 0xffffffff
mov word [rbx + rcx*2], 0
lea rcx, [0x017af760]
mov rdx, rbx
call fcn.017ae780
mov esi, r14d
mov r15, qword [rsp + 0x1900]
mov rcx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x1908]
mov r13, qword [rsp + 0x1910]
test rcx, rcx
mov r12, qword [rsp + 0x1918]
mov rdi, qword [rsp + 0x1920]
mov rbp, qword [rsp + 0x1928]
mov rbx, qword [rsp + 0x1958]
je 0x17af55c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x17af56c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x18f0]
xor rcx, rsp
call fcn.01003340
add rsp, 0x1930
pop rsi
ret
lea r8, [rsp + 0x2b0]
lea rcx, [0x017af690]
mov r9d, r15d
mov edx, eax
call fcn.017ae780
mov esi, 0x80004005
jmp 0x17af514
lea rcx, [0x017af5d0]
mov r8d, r15d
mov edx, eax
call fcn.017ae780
mov esi, 0x80004005
jmp 0x17af514