Function at 0x140017740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14002f198]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rdx
mov r13, rcx
lea rdx, [0x14002b924]
lea rcx, [rsp + 0x40]
mov edi, r8d
call fcn.14001ade0
mov ebx, 0xa0
lea rax, [rsp + 0x40]
mov r8d, ebx
nop word [rax + rax]
xor r10d, r10d
lea rsi, [0x14002b7e4]
mov r12d, 0x7ffffffe
cmp word [rax], r10w
je 0x1400177c1
add rax, 2
dec r8
jne 0x1400177a0
jmp 0x140017823
test r8, r8
je 0x140017823
mov rax, rbx
mov rdx, rbx
sub rax, r8
mov r8, rsi
sub rdx, rax
test r15, r15
lea rcx, [rsp + rax*2 + 0x40]
cmovne r8, r15
cmp rdx, 1
jbe 0x140017823
test rdx, rdx
je 0x14001781b
mov r9, r12
sub r9, rdx
sub r8, rcx
lea rax, [r9 + rdx]
test rax, rax
je 0x140017816
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140017816
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400177f5
jmp 0x14001781b
test rdx, rdx
jne 0x14001781f
sub rcx, 2
mov word [rcx], r10w
lea rax, [rsp + 0x30]
lea r14, [r13 + 0x100]
lea r9, [rsp + 0x38]
mov rcx, qword [r14]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], r10d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001787a
cmp dword [rsp + 0x38], 4
jne 0x14001787a
cmp dword [rsp + 0x30], 4
cmove edi, dword [rsp + 0x34]
lea r8, [0x14002b928]
lea rax, [rsp + 0x40]
mov rdx, rbx
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7fffff5e]
test rax, rax
je 0x1400178b5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400178b5
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140017891
jmp 0x1400178ba
test rdx, rdx
jne 0x1400178be
sub rcx, 2
xor r10d, r10d
lea rax, [rsp + 0x40]
mov word [rcx], r10w
mov rcx, rbx
nop dword [rax]
cmp word [rax], r10w
je 0x1400178e1
add rax, 2
dec rcx
jne 0x1400178d0
jmp 0x140017943
test rcx, rcx
je 0x140017943
mov rax, rbx
mov rdx, rbx
mov r9, rsi
sub rax, rcx
sub rdx, rax
test r15, r15
cmovne r9, r15
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x140017943
test rdx, rdx
je 0x14001793b
mov r8, r12
sub r8, rdx
sub r9, rcx
lea rax, [r8 + rdx]
test rax, rax
je 0x140017936
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140017936
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140017915
jmp 0x14001793b
test rdx, rdx
jne 0x14001793f
sub rcx, 2
mov word [rcx], r10w
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r10d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017993
cmp dword [rsp + 0x34], 4
jne 0x140017993
cmp dword [rsp + 0x30], 4
cmove edi, dword [rsp + 0x38]
lea rax, [r13 + 2]
mov r8, rsi
mov rdx, rbx
test rax, rax
lea rcx, [rsp + 0x40]
cmovne r8, rax
lea rax, [rsp + 0x40]
sub r8, rax
lea rax, [rdx + 0x7fffff5e]
test rax, rax
je 0x1400179d5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400179d5
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400179b1
jmp 0x1400179da
test rdx, rdx
jne 0x1400179de
sub rcx, 2
xor r10d, r10d
lea rax, [rsp + 0x40]
mov word [rcx], r10w
mov rcx, rbx
nop dword [rax]
cmp word [rax], r10w
je 0x140017a01
add rax, 2
dec rcx
jne 0x1400179f0
jmp 0x140017a63
test rcx, rcx
je 0x140017a63
mov rax, rbx
mov rdx, rbx
mov r9, rsi
sub rax, rcx
sub rdx, rax
test r15, r15
cmovne r9, r15
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x140017a63
test rdx, rdx
je 0x140017a5b
mov r8, r12
sub r8, rdx
sub r9, rcx
lea rax, [r8 + rdx]
test rax, rax
je 0x140017a56
movzx eax, word [rcx + r9]
test ax, ax
je 0x140017a56
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140017a35
jmp 0x140017a5b
test rdx, rdx
jne 0x140017a5f
sub rcx, 2
mov word [rcx], r10w
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r10d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017ab3
cmp dword [rsp + 0x34], 4
jne 0x140017ab3
cmp dword [rsp + 0x30], 4
cmove edi, dword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x40]
sub r13, rax
lea rax, [rdx + 0x7fffff5e]
test rax, rax
je 0x140017ae7
movzx eax, word [rcx + r13]
test ax, ax
je 0x140017ae7
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140017ac3
jmp 0x140017aec
test rdx, rdx
jne 0x140017af0
sub rcx, 2
xor edx, edx
lea rax, [rsp + 0x40]
mov word [rcx], dx
mov rcx, rbx
nop dword [rax]
cmp word [rax], dx
je 0x140017b10
add rax, 2
dec rcx
jne 0x140017b00
jmp 0x140017b6c
test rcx, rcx
je 0x140017b6c
mov rax, rbx
sub rax, rcx
sub rbx, rax
test r15, r15
cmovne rsi, r15
lea rcx, [rsp + rax*2 + 0x40]
cmp rbx, 1
jbe 0x140017b6c
test rbx, rbx
je 0x140017b65
sub r12, rbx
sub rsi, rcx
nop dword [rax + rax]
lea rax, [rbx + r12]
test rax, rax
je 0x140017b60
movzx eax, word [rcx + rsi]
test ax, ax
je 0x140017b60
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x140017b40
jmp 0x140017b65
test rbx, rbx
jne 0x140017b69
sub rcx, 2
mov word [rcx], dx
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017bbc
cmp dword [rsp + 0x34], 4
jne 0x140017bbc
cmp dword [rsp + 0x30], 4
mov eax, dword [rsp + 0x38]
je 0x140017bbe
mov eax, edi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14001cea0
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret