Function at 0x140001710
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 8], rax
xor esi, esi
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x38], rdx
mov r13d, esi
mov dword [rsp + 0x30], esi
mov dword [rbp - 0x30], esi
test rdx, rdx
je 0x140001750
mov dword [rdx], esi
nop dword [rax]
lea rdx, str.RegistryMachine
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], esi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x78], rsi
mov edx, 0x20019
mov dword [rbp - 0x78], 0x40
lea rcx, [rsp + 0x40]
movdqu xmmword [rbp - 0x70], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x140001aaf
xor eax, eax
mov qword [rsp + 0x150], rdi
mov r9d, 0x30
lea rdi, [rbp - 0x28]
mov ecx, 0x30
lea r8, [rbp - 0x28]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rbp - 0x30]
lea edx, [r9 - 0x2e]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
test eax, eax
je 0x1400017f8
cmp eax, 0x80000005
jne 0x140001aa7
mov eax, dword [rbp - 0x10]
test eax, eax
je 0x140001aa7
mov qword [rsp + 0x140], rbx
mov ebx, dword [rbp - 0x14]
test ebx, ebx
je 0x140001a9f
mov qword [rsp + 0x158], r12
xor edx, edx
lea r12, [rax + 0x1a]
mov qword [rsp + 0x110], r15
mov rax, qword gs:[0x30]
mov r8, r12
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
test rax, rax
je 0x140001a8f
mov rdi, rax
mov rcx, r12
xor eax, eax
mov r9, r15
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
cmp eax, 0x8000001a
je 0x140001a73
lea rcx, [0x1400093b0]
mov qword [rsp + 0x118], r14
mov r11d, 0xffffffff
nop dword [rax]
test eax, eax
js 0x140001a6b
mov eax, dword [rbp - 0x10]
add eax, 2
cmp dword [r15 + 0xc], eax
ja 0x140001a6b
lea r14, [r15 + 0x10]
mov r8d, 3
mov r9, rcx
cmp r14, rcx
je 0x140001926
test r14, r14
je 0x14000199a
mov r10, r14
sub r10, rcx
nop dword [rax]
movzx ecx, word [r10 + r9]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
cmova dx, cx
movzx ecx, word [r9 - 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edi, [rcx + 0x20]
cmova di, cx
dec r8
test dx, dx
je 0x14000191c
cmp dx, di
jne 0x14000191c
test r8, r8
jne 0x1400018e0
movzx eax, di
movzx ecx, dx
sub ecx, eax
jne 0x14000199a
lea rdi, [r15 + 0x16]
mov rdx, rsi
test rdi, rdi
je 0x14000196f
movzx eax, word [rdi]
test ax, ax
je 0x14000196a
nop word [rax + rax]
lea ecx, [rax - 0x30]
cmp cx, 9
ja 0x14000196a
lea rdx, [rdx + rdx*4]
movzx ecx, ax
lea rdx, [rdx - 0x18]
lea rdx, [rcx + rdx*2]
cmp rdx, r11
ja 0x14000199a
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140001940
cmp edx, r11d
je 0x14000199a
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rdx, r14
call fcn.140001160
test eax, eax
jns 0x14000198e
mov eax, 0xffffffff
add ebx, eax
jmp 0x14000199d
cmp dword [rsp + 0x30], esi
jne 0x1400019ee
mov r11d, 0xffffffff
add ebx, r11d
inc r13d
test ebx, ebx
je 0x140001a6b
xor eax, eax
mov rdi, r15
mov rcx, r12
mov r9, r15
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, r13d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov r11d, 0xffffffff
lea rcx, [0x1400093b0]
cmp eax, 0x8000001a
jne 0x1400018a0
jmp 0x140001a6b
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov rdx, r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], esi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x60]
mov qword [rbp - 0x58], rdi
mov edx, 0x20019
mov dword [rbp - 0x48], 0x40
lea rcx, [rsp + 0x48]
movdqu xmmword [rbp - 0x40], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x140001a6b
mov rcx, qword [rsp + 0x48]
call fcn.1400014a0
mov rcx, qword [rsp + 0x38]
mov esi, 1
mov dword [rcx], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x118]
mov rax, qword gs:[0x30]
mov r8, r15
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r15, qword [rsp + 0x110]
mov r12, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x120]
test rcx, rcx
je 0x140001ac7
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400081d0
add rsp, 0x128
pop rsi
pop rbp
ret