Function at 0x1400163f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14002a7b8]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r14, rcx
xor r13d, r13d
mov ebx, r13d
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov esi, 0x20019
mov r9d, esi
xor r8d, r8d
lea rdx, [0x140021920]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016804
mov rbx, qword [rsp + 0x60]
mov qword [rbp - 0x50], rbx
mov edi, r13d
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, qword [r14 + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400167f2
mov r12, qword [rsp + 0x68]
mov qword [rbp - 0x68], r12
lea rcx, [rsp + 0x58]
call fcn.140015e5c
nop
mov eax, r13d
mov qword [rbp - 0x30], rax
mov r9d, 0x7fffffff
mov ecx, r9d
lea rdx, [0x140021a58]
cmp word [rdx], r13w
je 0x1400164f7
add rdx, 2
sub rcx, 1
jne 0x1400164e7
test rcx, rcx
je 0x140016504
mov rdx, r9
sub rdx, rcx
jmp 0x140016507
mov rdx, r13
mov qword [rbp - 8], rdx
test rcx, rcx
je 0x1400167c4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140016557
mov r8, r9
cmp word [rcx], r13w
je 0x140016531
add rcx, 2
sub r8, 1
jne 0x140016521
mov rax, r8
neg rax
sbb ecx, ecx
not ecx
and ecx, 0x80070057
test r8, r8
je 0x14001654e
mov rax, r9
sub rax, r8
jmp 0x140016551
mov rax, r13
mov qword [rbp - 0x30], rax
jmp 0x14001655c
mov ecx, 0x80070057
test ecx, ecx
js 0x1400167c4
add rax, rdx
or rbx, 0xffffffffffffffff
cmp rax, rdx
cmovae rbx, rax
jb 0x1400167c4
mov rdi, r13
mov qword [rsp + 0x78], r13
test rbx, rbx
jne 0x14001658a
mov rcx, r13
jmp 0x1400165a1
xor edx, edx
or rax, 0xffffffffffffffff
div rbx
cmp rax, 2
jb 0x1400167b6
lea rcx, [rbx + rbx]
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400167b6
mov r9, qword [rsp + 0x58]
lea r8, [0x140021a58]
mov rdx, rbx
mov rcx, rax
call fcn.140004524
test eax, eax
js 0x1400167b6
mov rsi, r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov r15, r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov ebx, 0x2001f
mov r9d, ebx
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016792
mov r15, qword [rsp + 0x70]
mov qword [rbp - 0x28], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
mov r8, qword [r14 + 0x40]
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140010e4c
mov rsi, qword [rbp - 0x80]
test eax, eax
jne 0x140016792
mov r14d, r13d
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], r13d
mov rbx, r13
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea r8, [rbp]
mov edx, r14d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400166b7
cmp eax, 0xea
jne 0x14001672a
mov ecx, dword [rsp + 0x40]
test rcx, rcx
jne 0x1400166c5
mov rcx, r13
jmp 0x1400166d8
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x140016785
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140016785
mov dword [rsp + 0x44], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea r8, [rbp]
mov edx, r14d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140016752
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x48]
xor r8d, r8d
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001675f
cmp eax, 0x103
je 0x140016775
cmp r14d, 0x64
ja 0x140016775
inc r14d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x50], r13
jmp 0x140016664
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x50], r13
jmp 0x140016792
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x50], r13
test r15, r15
je 0x1400167a4
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r13
test rsi, rsi
je 0x1400167b6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x80], r13
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x78], r13
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400167ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x50]
test rdi, rdi
je 0x140016804
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x68], r13
test rbx, rbx
je 0x140016816
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14001d6c0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret