Function at 0x140016780
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
add rcx, 0x31a0
call fcn.140002ba0
xor ecx, ecx
mov dword [rbx + 0x3219], 0
lea rax, [rsp + 0x64]
mov byte [rbx + 0x3230], cl
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x50]
mov word [rbx + 0x3151], cx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov byte [rbx + 0x3153], cl
mov word [rbx + 0x3157], cx
mov byte [rbx + 0x3179], cl
mov word [rbx + 0x3172], cx
mov byte [rbx + 0x3194], cl
mov byte [rbx + 0x318c], cl
mov byte [rbx + 0x316e], cl
mov qword [rbx + 0x3180], rcx
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
mov byte [rbx + 0x321d], 1
mov dword [rbx + 0x3220], 0x400
mov qword [rbx + 0x3224], 0xf
mov byte [rbx + 0x3698], 1
mov dword [rbx + 0x31b0], 0x1388
mov word [rbx + 0x3192], 0x100
mov word [rbx + 0x3154], 1
mov word [rbx + 0x31c0], 0x100
mov dword [rbx + 0x318d], 0x1000000
mov dword [rbx + 0x312c], 0x3e8
mov dword [rbx + 0x3130], 0x3e8
mov dword [rbx + 0x315a], 0x1000100
mov dword [rbx + 0x3164], 0x10000
mov dword [rbx + 0x315e], 0x1000101
mov byte [rbx + 0x3162], 1
mov byte [rbx + 0x3159], 1
mov dword [rbx + 0x3148], 0x1fa4
mov word [rbx + 0x316c], 1
mov byte [rbx + 0x316a], 1
mov dword [rbx + 0x3134], 0x2710
mov word [rbx + 0x316f], 1
mov dword [rbx + 0x3174], 1
mov dword [rbx + 0x3195], 0x1010101
mov byte [rbx + 0x3191], 1
mov byte [rbx + 0x31bd], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140016981
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ThemeLocked
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016976
cmp dword [rsp + 0x58], 4
jne 0x140016976
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x5c], 0
setne cl
jmp 0x140016983
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor cl, cl
mov eax, 0x31b4
mov rdx, rbx
mov byte [rbx + rax], cl
mov rcx, rbx
mov dword [rbx + 0x31b5], 0x1010101
mov dword [rbx + 0x31b9], 0x1010101
mov byte [rbx + 0x31be], 1
mov word [rbx + 0x31c3], 0x101
mov byte [rbx + 0x3169], 0
mov dword [rbx + 0x314c], 0x7530
mov byte [rbx + 0x3150], 0
call fcn.1400262b0
xorps xmm0, xmm0
mov word [rbx + 0x31e8], 0x100
mov byte [rbx + 0x31ea], 1
lea rcx, [rbx + 0x3278]
mov byte [rbx + 0x31c2], 0
lea rdx, str.Bitsum_Highest_Performance
mov dword [rbx + 0x31ec], 0x12c
mov r8, 0xffffffffffffffff
movups xmmword [rbx + 0x31f0], xmm0
mov byte [rbx + 0x3218], 1
mov byte [rbx + 0x31bf], 1
inc r8
cmp word [rdx + r8*2], 0
jne 0x140016a20
call fcn.140002210
lea rcx, [rbx + 0x31d0]
mov dword [rbx + 0x31a8], 0x41
mov dword [rbx + 0x31ac], 0xc4
mov byte [rbx + 0x31c5], 0
mov dword [rbx + 0x31c8], 0x384
call fcn.140002ba0
mov rcx, rbx
mov dword [rbx + 0x322c], 0x8000
mov byte [rbx + 0x3163], 0
mov byte [rbx + 0x3168], 1
call fcn.140028080
call fcn.140016aa0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x70
pop rbx
ret