Function at 0x4b4500
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r8d, 0x2001
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov r9d, edx
mov rsi, rdx
mov rdx, rcx
lea rcx, [0x005eea20]
call fcn.004ad7d0
movsxd rbx, eax
test ebx, ebx
js 0x4b44c0
mov rcx, qword [0x005f2a60]
lea r9, [rsp + 0x34]
mov r8d, ebx
mov qword [rsp + 0x20], 0
lea rdx, [0x005eea20]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
cmp rbx, rsi
je 0x4b44ae
mov dword [0x005f2a50], 1
mov rax, qword [rsp + 0x38]
xor rax, qword [rdi]
jne 0x4b44f3
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rcx, str._invalid_
call sub.msvcrt.dll_wcslen
mov rcx, qword [0x005f2a60]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, eax
lea rdx, str._invalid_
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x4b44ae
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]
push r15
mov eax, 0x1128
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r12d, r12d
xor ebp, ebp
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
lea r15, [0x00591328]
mov rdi, qword [rax]
mov qword [rsp + 0x1118], rdi
xor edi, edi
lea r14, [rsp + 0x44]
mov dword [rsp + 0x34], r12d
lea rsi, [rsp + 0x110]
mov r12, r14
mov r14, rsi
mov r8d, 0x1000
mov rcx, qword [0x005f2a40]
lea rdx, [r14 + rdi]
mov r9, r12
mov qword [rsp + 0x20], 0
sub r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b45f0
call r13
cmp eax, 0xe9
je 0x4b4596
call r13
cmp eax, 0x6d
jne 0x4b455a
mov eax, dword [0x005f2a50]
mov dword [rsp + 0x48], 0
test eax, eax
jne 0x4b4850
mov rcx, qword [0x005f2a40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rdi, qword [rsp + 0x1118]
xor rdi, qword [rax]
jne 0x4b4d53
xor eax, eax
add rsp, 0x1128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add ebx, dword [rsp + 0x44]
xor esi, esi
xor r9d, r9d
mov dword [rsp + 0x44], ebx
movsxd rax, esi
add rax, r14
cmp esi, ebx
jae 0x4b4636
movzx edx, byte [rax]
lea edi, [rsi + 1]
mov ecx, edx
mov r8d, edx
cmp ebp, 0x1b
je 0x4b4720
cmp ebp, 0x5b
je 0x4b476a
test ebp, ebp
je 0x4b4980
mov esi, edi
add rax, 1
cmp esi, ebx
jb 0x4b4607
test ebp, ebp
sete al
cmp r9d, esi
jge 0x4b4990
test al, al
je 0x4b4990
lea eax, [rsi - 1]
movsxd rdx, eax
movzx edx, byte [rsp + rdx + 0x110]
test dl, dl
js 0x4b4ad0
mov edx, esi
movsxd rcx, r9d
sub edx, r9d
add rcx, r14
movsxd rdx, edx
call fcn.004b4440
mov eax, esi
mov edx, dword [rsp + 0x44]
mov ebx, edx
sub ebx, eax
cmp eax, edx
jb 0x4b4b90
xor ebp, ebp
movsxd rdi, ebx
jmp 0x4b455a
cmp r9d, edi
jl 0x4b4ab8
mov qword [rsp + 0x70], 0
mov ebx, dword [rsp + 0x44]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
cmp ebx, esi
jbe 0x4b4bb4
movsxd rax, esi
mov dword [rsp + 0x34], 0
mov r9d, edi
lea edi, [rsi + 1]
movzx edx, byte [rsp + rax + 0x110]
cmp edx, 0x5b
je 0x4b4750
cmp ebx, edi
jbe 0x4b4b20
movsxd rax, edi
lea esi, [rdi + 1]
movzx edx, byte [rsp + rax + 0x110]
cmp edx, 0x1b
je 0x4b4698
mov ebx, dword [rsp + 0x44]
xor ebp, ebp
jmp 0x4b45fd
cmp ebx, edi
jbe 0x4b4ba6
movsxd rax, edi
add edi, 1
movzx r8d, byte [rsp + rax + 0x110]
mov ecx, r8d
lea eax, [r8 - 0x30]
cmp eax, 9
ja 0x4b47a0
movsxd rdx, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x44]
mov esi, edi
mov ebp, 0x5b
mov ecx, dword [rsp + rdx*4 + 0x70]
lea ecx, [rcx + rcx*4]
lea eax, [rax + rcx*2]
mov dword [rsp + rdx*4 + 0x70], eax
jmp 0x4b45fd
cmp r8d, 0x3b
jne 0x4b47d0
add dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x44]
cmp eax, 0xf
jg 0x4b4725
mov esi, edi
mov ebp, 0x5b
jmp 0x4b45fd
cmp cl, 0x4b
je 0x4b4b30
cmp cl, 0x6d
jne 0x4b49a0
movzx ebx, word [0x005f2a5a]
movzx ecx, word [0x005f2a58]
xor ebp, ebp
xor r10d, r10d
movsxd rdx, dword [rsp + 0x34]
mov r11d, dword [0x005f2a54]
mov eax, ebx
mov word [rsp + 0x3a], cx
and eax, 7
lea r9, [rsp + rdx*4 + 0x74]
mov esi, r11d
mov edx, ecx
mov word [rsp + 0x3c], ax
mov eax, ebx
and eax, 0x70
mov word [rsp + 0x3e], ax
lea rax, [rsp + 0x70]
nop dword [rax]
mov r8d, dword [rax]
cmp r8d, 0x31
ja case.0x4b4847.3
mov ecx, r8d
movsxd rcx, dword [r15 + rcx*4]
add rcx, r15
jmp rcx
movzx eax, byte [0x00576618]
test al, 1
je 0x4b4a70
mov rax, qword [0x00576610]
test rax, rax
je 0x4b48e0
xor edx, edx
mov rcx, qword [0x005f2a60]
mov dword [rsp + 0xb0], 0x54
lea r8, [rsp + 0xb0]
call rax
test eax, eax
je 0x4b4970
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x48], eax
test al, 4
jne 0x4b45ac
lea rcx, str._nWarning:_Your_console_font_probably_doesnt_support_Unicode._If_you_experience_strange_characters_in_the_output__consider_switching_to_a_TrueType_font_such_as_Consolas__n
call sub.msvcrt.dll_wcslen
mov rcx, qword [0x005f2a60]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, eax
lea rdx, str._nWarning:_Your_console_font_probably_doesnt_support_Unicode._If_you_experience_strange_characters_in_the_output__consider_switching_to_a_TrueType_font_such_as_Consolas__n
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x4b45ac
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x28
mov rax, qword [0x00576610]
test rax, rax
jne 0x4b486b
lea rax, [rsp + 0x50]
xor r8d, r8d
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, str.Console
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b4970
lea rax, [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, str.FontFamily
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x48]
jmp 0x4b489c
mov eax, edi
mov edi, esi
mov esi, eax
jmp 0x4b473b
xor ebx, ebx
xor edi, edi
jmp 0x4b455a
cmp dword [rsp + 0x44], edi
jbe 0x4b4a63
movsxd rax, edi
lea esi, [rdi + 1]
mov r9d, edi
movzx edx, byte [rsp + rax + 0x110]
jmp 0x4b473b
and edx, 0xffffff8f
mov r10d, 1
or dx, word [rsp + 0x3e]
nop
add rax, 4
cmp r9, rax
jne 0x4b4830
test r10b, r10b
je 0x4b4d49
mov word [0x005f2a58], dx
test bpl, bpl
je 0x4b49fb
mov dword [0x005f2a54], esi
mov r11d, esi
test r11d, r11d
je 0x4b4a49
mov eax, edx
and eax, 0xffffff88
mov ecx, eax
or ecx, 0x40
test dl, 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20
test dl, 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10
test dl, 1
cmovne eax, ecx
mov ecx, eax
or ecx, 4
test dl, 0x40
cmovne eax, ecx
mov ecx, eax
or ecx, 2
test dl, 0x20
cmovne eax, ecx
mov ecx, eax
or ecx, 1
and edx, 0x10
cmovne eax, ecx
mov edx, eax
mov rcx, qword [0x005f2a60]
movzx edx, dx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp dword [rsp + 0x44], edi
ja 0x4b49aa
xor ebp, ebp
xor ebx, ebx
xor edi, edi
jmp 0x4b455a
or eax, 1
mov rcx, qword [str.kernel32.dll]
mov r8d, 0x800
xor edx, edx
mov byte [0x00576618], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, rax
test rax, rax
je 0x4b485f
mov rdx, qword [str.GetCurrentConsoleFontEx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00576610], rax
jmp 0x4b4866
mov edx, edi
movsxd rcx, r9d
sub edx, r9d
add rcx, r14
movsxd rdx, edx
call fcn.004b4440
jmp 0x4b46a1
cmp dl, 0xbf
ja 0x4b4af0
lea edx, [rsi - 2]
cmp eax, r9d
jle 0x4b4b00
movsxd rax, edx
cmp byte [rsp + rax + 0x110], 0xdf
jbe 0x4b4b00
mov eax, edx
nop dword [rax]
cmp eax, r9d
jle 0x4b4677
mov esi, eax
jmp 0x4b4662
cmp r9d, edx
jge 0x4b4662
lea eax, [rsi - 3]
movsxd rdx, eax
cmp byte [rsp + rdx + 0x110], 0xef
jbe 0x4b4662
jmp 0x4b4af0
mov esi, edi
mov eax, 1
xor ebp, ebp
jmp 0x4b463b
mov rcx, qword [0x005f2a60]
test rcx, rcx
je 0x4b49a0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx r8d, word [rsp + 0x50]
movsx eax, word [rsp + 0x54]
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x20], rdx
mov r9d, dword [rsp + 0x54]
mov edx, 0x20
sub r8d, eax
mov rcx, qword [0x005f2a60]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
cmp dword [rsp + 0x44], edi
ja 0x4b49aa
jmp 0x4b4a63
cdqe
mov r8d, ebx
mov rcx, r14
lea rdx, [r14 + rax]
call sub.msvcrt.dll_memmove
jmp 0x4b4687
mov ebp, 0x5b
xor ebx, ebx
xor edi, edi
jmp 0x4b455a
mov dword [rsp + 0x34], 0
mov ebp, 0x1b
xor ebx, ebx
xor edi, edi
jmp 0x4b455a
or dl, 0x80
mov r10d, 1
jmp case.0x4b4847.3
and edx, 0xfffffff7
mov r10d, 1
jmp case.0x4b4847.3
or edx, 8
mov r10d, 1
jmp case.0x4b4847.3
or edx, 0x70
mov r10d, 1
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x30
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x50
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x10
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x60
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x20
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
or edx, 0x40
jmp case.0x4b4847.3
and edx, 0xffffff8f
mov r10d, 1
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or dx, word [rsp + 0x3c]
jmp case.0x4b4847.3
or edx, 7
mov r10d, 1
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 3
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 5
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 1
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 6
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 2
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
or edx, 4
jmp case.0x4b4847.3
and edx, 0xfffffff8
mov r10d, 1
jmp case.0x4b4847.3
mov ebp, 1
xor esi, esi
jmp case.0x4b4847.3
and dl, 0x7f
mov r10d, 1
jmp case.0x4b4847.3
mov ebp, 1
mov esi, 1
jmp case.0x4b4847.3
mov esi, r8d
mov edx, ebx
mov ebp, 1
mov r10d, 1
jmp case.0x4b4847.3
movzx edx, word [rsp + 0x3a]
jmp 0x4b49ed
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]