Function at 0x140017010
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov rsi, rcx
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140017671
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001767c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x39]
call fcn.140017720
test al, al
jne 0x140017132
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140017687
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x1400170c9
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x1400170e6
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400170d0
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017104
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14001711f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000ce10
nop
mov rcx, rax
test rax, rax
je 0x140017692
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x140017177
movzx edx, dx
lea rcx, [rbp - 0x29]
call fcn.14000d4c0
jmp 0x140017197
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140017180
mov r8d, eax
lea rcx, [rbp - 0x29]
call fcn.14000fd40
nop
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov dword [rbp - 0x11], r15d
mov qword [rbp - 9], r15
mov r9d, 0x20019
mov rbx, qword [rbp - 0x29]
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x19]
call fcn.14000da90
test eax, eax
je 0x140017258
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001769d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x140017206
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x140017226
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140017210
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140017236
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400170e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400170e6
mov r14d, r15d
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400176a8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
mov edx, 0x104
mov dword [rbp + 0x6f], edx
test edx, edx
js 0x140017666
mov r8d, 1
mov rax, qword [rbp - 0x59]
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x1400172ab
lea rcx, [rbp - 0x59]
call fcn.14000e630
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x6f]
mov r8, qword [rbp - 0x59]
mov edx, r14d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r14d
test eax, eax
jne 0x1400172e3
mov bl, 1
jmp 0x1400172e5
xor bl, bl
mov rcx, qword [rbp - 0x59]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x14001765b
mov rcx, qword [rbp - 0x59]
cmp eax, dword [rcx - 0xc]
jg 0x14001765b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x59]
mov word [rax + rcx*2], r15w
test bl, bl
je 0x1400175ff
mov dword [rbp + 0x6f], 0x104
mov qword [rbp - 0x31], r15
lea rdx, [rbp - 0x31]
mov rcx, qword [rbp - 0x59]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp qword [rbp - 0x31], 0
jne 0x140017345
mov edx, dword [rbp + 0x6f]
jmp 0x140017282
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140017700
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400176f5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov dword [rbp + 0x7f], r15d
mov dword [rbp + 0x77], r15d
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x7f]
xor r8d, r8d
mov rdx, qword [rbp - 0x31]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400174bd
lea rax, [rbp - 0x51]
mov qword [rbp - 1], rax
mov qword [rbp + 7], r15
mov dword [rbp + 0xf], edi
mov edx, dword [rbp + 0x77]
test edx, edx
js 0x1400176d4
mov ecx, 1
mov rbx, qword [rbp - 0x51]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140017400
lea rcx, [rbp - 0x51]
call fcn.14000e630
mov rbx, qword [rbp - 0x51]
mov qword [rbp + 7], rbx
mov edx, dword [rbp + 0x7f]
test edx, edx
js 0x1400176c9
mov ecx, 1
mov r8, qword [rbp - 0x49]
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edx
or eax, ecx
jge 0x140017433
lea rcx, [rbp - 0x49]
call fcn.14000e630
mov r8, qword [rbp - 0x49]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
mov rdx, qword [rbp - 0x31]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
nop
mov rcx, qword [rbp - 0x49]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x1400176be
mov rcx, qword [rbp - 0x49]
cmp eax, dword [rcx - 0xc]
jg 0x1400176be
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x49]
mov word [rax + rcx*2], r15w
mov rcx, qword [rbp - 0x51]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b7e14
test eax, eax
js 0x1400176b3
mov rcx, qword [rbp - 0x51]
cmp eax, dword [rcx - 0xc]
jg 0x1400176b3
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x51]
mov word [rax + rcx*2], r15w
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x49]
test rax, rax
je 0x1400176ea
mov rcx, qword [rbp - 0x41]
sub rax, rcx
nop dword [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x1400174f5
add rcx, 2
test edx, edx
jne 0x1400174e0
mov rcx, qword [rbp - 0x51]
test r8d, r8d
jne 0x14001752d
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x1400176df
mov rdx, rcx
sub rax, rcx
movzx r9d, word [rdx]
movzx r8d, word [rdx + rax]
sub r9d, r8d
jne 0x140017528
add rdx, 2
test r8d, r8d
jne 0x140017511
test r9d, r9d
je 0x140017574
lea rdx, [rcx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017547
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jle 0x140017563
mov edx, dword [rbp + 0x6f]
jmp 0x140017282
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, dword [rbp + 0x6f]
jmp 0x140017282
mov rcx, qword [rbp - 0x59]
add rcx, 0xffffffffffffffe8
call fcn.14000c440
add rax, 0x18
mov qword [rsi], rax
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400175a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400175c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400175e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400175f2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
jmp 0x14001723a
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001770b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x14001763a
movzx edx, dx
mov rcx, rsi
call fcn.14000d4c0
jmp 0x140017656
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140017640
mov r8d, eax
mov rcx, rsi
call fcn.14000fd40
nop
jmp 0x1400175c4
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3