Function at 0x100401080
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x10040a040]
lea rdx, str.Usage:__s__OPTION__ACTION_KEY__data...__n_nView_or_edit_the_Win32_registry_n_n
mov rbx, rcx
call sym.fprintf
call sym.__getreent
cmp qword [rax + 0x10], rbx
je 0x1004010c4
call sym.__getreent
cmp qword [rax + 0x18], rbx
je 0x10040112d
call sym.__getreent
xor ecx, ecx
cmp qword [rax + 0x18], rbx
sete cl
call sym.exit
mov r9, rbx
mov r8d, 0x247
mov edx, 1
lea rcx, str.Actions:_n_n_add_KEYSUBKEY_____________add_new_SUBKEY_n_check_KEY__________________exit_0_if_KEY_exists__1_if_not_n_get_KEYVALUE______________prints_VALUE_to_stdout_n_list_KEY___________________list_SUBKEYs_and_VALUEs_n_remove_KEY_________________remove_KEY_n_set_KEYVALUE__data_...____set_VALUE_n_unset_KEYVALUE____________removes_VALUE_from_KEY_n_load_KEYSUBKEY_PATH_______load_hive_from_PATH_into_new_SUBKEY_n_unload_KEYSUBKEY__________unload_hive_and_remove_SUBKEY_n_save_KEYSUBKEY_PATH_______save_SUBKEY_into_new_file_PATH_n_restore_KEYSUBKEY_PATH____restore_SUBKEY_from_file_PATH_n_n
call sym.fwrite
mov r9, rbx
mov r8d, 0x612
mov edx, 1
lea rcx, str.Options_for_list_action:_n_n__k____keys___________print_only_KEYs_n__l____list___________print_only_VALUEs_n__p____postfix________like_ls__p__appends__postfix_to_KEY_names_n_nOptions_for_get_action:_n_n__b____binary_________print_data_as_printable_hex_bytes_n__n____none___________print_data_as_stream_of_bytes_as_stored_in_registry_n__x____hex____________print_numerical_data_as_hex_numbers_n_nOptions_for_set_action:_n_n__b____binary_________set_type_to_REG_BINARY__hex_args_or____n__d____dword__________set_type_to_REG_DWORD_n__D____dword_be_______set_type_to_REG_DWORD_BIG_ENDIAN_n__e____expand_string__set_type_to_REG_EXPAND_SZ_n__i____integer________set_type_to_REG_DWORD_n__m____multi_string___set_type_to_REG_MULTI_SZ_n__n____none___________set_type_to_REG_NONE_n__Q____qword__________set_type_to_REG_QWORD_n__s____string_________set_type_to_REG_SZ_n_nOptions_for_set_and_unset_Actions:_n_n__K_c_____key_separator___c___set_key_value_separator_to__c__instead_of__n_nOptions_for_restore_action:_n_n__f____force____restore_even_if_open_handles_exist_at_or_beneath_the_location_n________________in_the_registry_hierarchy_to_which_KEYSUBKEY_points_n_nOther_Options:_n_n__h____help_____output_usage_information_and_exit_n__q____quiet____no_error_output__just_nonzero_return_if_KEY_VALUE_missing_n__v____verbose__verbose_output__including_VALUE_contents_when_applicable_n__w____wow64____access_64_bit_registry_view__ignored_on_32_bit_Windows__n__W____wow32____access_32_bit_registry_view__ignored_on_32_bit_Windows__n__V____version__output_version_information_and_exit_n_n
call sym.fwrite
mov r9, rbx
mov r8d, 0x243
mov edx, 1
lea rcx, str.KEY_is_in_the_format__host_prefixKEYKEYVALUE__where_host_is_optional_nremote_host_in_either_hostname_or_hostname:_format_and_prefix_is_any_of:_n__root_____HKCR__HKEY_CLASSES_ROOT__local_only__n__config___HKCC__HKEY_CURRENT_CONFIG__local_only__n__user_____HKCU__HKEY_CURRENT_USER__local_only__n__machine__HKLM__HKEY_LOCAL_MACHINE_n__users____HKU___HKEY_USERS_n_nYou_can_use_forward_slash_____as_a_separator_instead_of_backslash__in_nthat_case_backslash_is_treated_as_an_escape_character._nYou_can_also_supply_the_registry_path_prefix__proc_registry_32_64__to_nuse_path_completion._n
call sym.fwrite
mov r8, qword [0x10040a040]
lea rdx, str.Example:_n_s_list__HKLM_SOFTWARE_Classes_MIME_Database_Content_Type_audio_wav_n_n
mov rcx, rbx
call sym.fprintf
jmp 0x1004010a6
mov r8, qword [0x10040a040]
lea rdx, str.ACTION_is_one_of_add__check__get__list__remove__set__unset__load__unload__save_n_nTry___s___help_for_more_information._n
mov rcx, rbx
call sym.fprintf
jmp 0x1004010b1