Function at 0x140016490
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x348]
sub rsp, 0x430
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14009f008]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov ebx, r14d
mov dword [rsp + 0x30], ebx
nop word [rax + rax]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x210]
call fcn.14005b700
lea r8, [rbp + 0x210]
mov edx, ebx
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x100]
call fcn.14005b700
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x100]
call fcn.140013080
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x10]
call fcn.14005b700
xor bl, bl
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x210]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400165ee
mov dword [rsp + 0x34], r14d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 0x102
ja 0x1400165e3
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x100]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400167be
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140016610
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140016668
cmp eax, 0xc
je 0x1400167e8
cmp eax, 0x16
je 0x1400167dd
cmp eax, 0x22
je 0x1400167dd
cmp eax, 0x50
jne 0x1400167d2
mov rcx, qword [rsp + 0x60]
call fcn.140015eb0
movzx ebx, al
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140016689
call fcn.14005d6dc
test bl, bl
je 0x1400167be
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x30]
cmp byte [rcx + 0x19], 0
jne 0x1400166bc
cmp dword [rcx + 0x20], edx
jae 0x1400166b0
mov rcx, qword [rcx + 0x10]
jmp 0x1400166b6
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400166a5
cmp rbx, rax
je 0x1400166c6
cmp edx, dword [rbx + 0x20]
jae 0x1400166fb
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c50
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140018c90
mov rbx, qword [rsp + 0x48]
cmp byte [rbp - 0x10], 0
jne 0x140016706
mov r8, r14
jmp 0x14001671a
lea rax, [rbp - 0x10]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140016710
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x10]
call fcn.140002500
mov ebx, dword [rsp + 0x30]
cmp ebx, edi
je 0x1400167ba
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140016745
inc ebx
lea r8, [rsp + 0x68]
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp - 0x10]
mov rcx, qword [rsp + 0x60]
call fcn.140001490
test eax, eax
je 0x140016791
cmp eax, 0xc
je 0x140016809
cmp eax, 0x16
je 0x1400167fe
cmp eax, 0x22
je 0x1400167fe
cmp eax, 0x50
jne 0x1400167f3
mov r9d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140016d70
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x1400167b6
call fcn.14005d6dc
mov ebx, dword [rsp + 0x30]
inc edi
jmp 0x1400167c2
mov ebx, dword [rsp + 0x30]
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 9
ja 0x140016814
jmp 0x1400164e0
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14003a8a0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret