Function at 0x140017b64
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x59], rdx
xor r14d, r14d
mov dword [rbp - 0x71], r14d
test rdx, rdx
je 0x140017eb0
cmp word [rdx], r14w
je 0x140017eb0
mov r8, qword [0x14006a100]
mov rax, qword [r8 + 8]
mov rcx, r8
jmp 0x140017bd1
cmp qword [rax + 0x20], rdx
jae 0x140017bcb
mov rax, qword [rax + 0x10]
jmp 0x140017bd1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r14b
je 0x140017bbf
cmp byte [rcx + 0x19], r14b
jne 0x140017be3
cmp rdx, qword [rcx + 0x20]
jae 0x140017be6
mov rcx, r8
cmp rcx, r8
je 0x140017c04
mov rcx, qword [rcx + 0x28]
sub rcx, 0x18
call fcn.14000688c
add rax, 0x18
mov qword [rdi], rax
jmp 0x140017eca
mov qword [rbp - 0x51], r14
mov dword [rbp - 0x49], r14d
mov qword [rbp - 0x41], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x17], r14
mov r15d, 7
mov qword [rbp + 0x1f], r15
mov word [rbp + 7], r14w
mov rdx, qword [0x140069fe8]
lea rcx, [rbp + 7]
call fcn.140012388
nop
lea r8d, [r15 + 0xe]
lea rdx, str.RegisteredExtensions
lea rcx, [rbp + 7]
call fcn.14001870c
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.140018644
nop
lea r8d, [r15 - 6]
lea rdx, [0x14005bac4]
lea rcx, [rbp - 0x19]
call fcn.14001870c
mov rdx, qword [rbp - 0x59]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x140017c82
lea rcx, [rbp - 0x19]
call fcn.14001870c
call fcn.14000dac4
mov rcx, rax
test rax, rax
je 0x140017f02
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov qword [rbp - 0x61], r14
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017db2
mov dword [rbp - 0x49], r14d
mov rsi, qword [rbp - 0x61]
mov qword [rbp - 0x51], rsi
mov dword [rbp - 0x49], r14d
lea rax, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], r14
or dword [rbp - 0x29], 0xffffffff
mov ecx, 1
mov rbx, qword [rbp - 0x79]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x105
sub eax, edx
or eax, ecx
jge 0x140017d34
lea rcx, [rbp - 0x79]
call fcn.14000681c
mov rbx, qword [rbp - 0x79]
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x6d], 0x20a
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x69]
xor r8d, r8d
lea rdx, str.amd64
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017d81
mov eax, dword [rbp - 0x69]
dec eax
cmp eax, 1
ja 0x140017d81
test rbx, rbx
je 0x140017d81
cmp dword [rbp - 0x6d], r14d
jne 0x140017d81
mov word [rbx], r14w
mov rcx, qword [rbp - 0x79]
movsxd rdx, dword [rcx - 0xc]
call fcn.14002d880
test eax, eax
js 0x140017f13
mov rcx, qword [rbp - 0x79]
cmp eax, dword [rcx - 0xc]
jg 0x140017f13
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x79]
mov word [rax + rcx*2], r14w
lea rdx, [rbp - 0x59]
call fcn.14001814c
mov rcx, rax
lea rdx, [rbp - 0x79]
call fcn.140004474
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000688c
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x71], 1
mov rdx, qword [rbp - 0x79]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017e00
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov ebx, 0x1000
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140017e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rbx
jb 0x140017e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f0d
call fcn.1400246c0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov word [rbp - 0x19], r14w
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140017e8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rbx
jb 0x140017e85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f1e
call fcn.1400246c0
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r15
mov word [rbp + 7], r14w
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140017eaa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r14
mov dword [rbp - 0x49], r14d
jmp 0x140017ed1
call fcn.14000dac4
mov rcx, rax
test rax, rax
je 0x140017ef7
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x71], 1
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140024670
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000d8a4
nop
mov ecx, 0x80004005
call fcn.14000d8a4
nop
call fcn.14002928c
nop
mov ecx, 0x80070057
call fcn.14000d8a4
nop
call fcn.14002928c
int3