Function at 0x140175da0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14017603c
test edx, edx
je 0x14017603c
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.140289490
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14032b598]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r14d, r14d
test eax, eax
jne 0x140175fc8
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x398], rdi
mov edi, r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140175fb5
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140175f79
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14032b5d8]
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140175f6e
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.140289490
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x150]
call fcn.140176070
test eax, eax
je 0x140175f6e
cmp byte [rsp + 0x60], r14b
je 0x140175f25
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x140175f6e
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x140175f60
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x140175f60
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x140175f40
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r14b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r14
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140175e70
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x398]
cmp byte [rsp + 0x60], r14b
je 0x14017603c
lea rax, [rsi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
mov edx, r14d
mov r9d, 0x80070057
mov rcx, rsi
cmova edx, r9d
test edx, edx
js 0x140176033
test esi, esi
je 0x14017601c
sub r8, rcx
lea rdx, [rsp + 0x60]
sub rdx, rbx
nop
lea rax, [r8 + rcx]
test rax, rax
je 0x14017601c
movzx eax, byte [rdx + rbx]
test al, al
je 0x14017601c
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140176000
test rcx, rcx
lea rax, [rbx - 1]
mov edx, 0x8007007a
cmovne rax, rbx
cmovne edx, r14d
mov byte [rax], r14b
not edx
shr edx, 0x1f
mov eax, edx
jmp 0x14017603e
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rsi
pop rbp
ret