Function at 0x100002fdc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbp, rdx
lea rax, [rsp + 0x70]
lea rdx, [0x100001380]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
je 0x10000303a
xor al, al
jmp 0x1000034f3
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [0x1000013e0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12b, 0x30
cmp eax, edi
jne 0x100003163
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x100003163
mov r8d, edi
lea rdx, [rsp + 0x89]
mov cl, byte [rdx - 1]
cmp cl, r12b
jl 0x1000030ec
cmp cl, 0x39
jg 0x1000030ec
sub cl, r12b
jmp 0x10000310c
cmp cl, 0x61
jl 0x1000030fb
cmp cl, 0x66
jg 0x1000030fb
sub cl, 0x57
jmp 0x10000310c
cmp cl, 0x41
jl 0x10000310a
cmp cl, 0x46
jg 0x10000310a
sub cl, 0x37
jmp 0x10000310c
mov cl, 0xff
mov al, byte [rdx]
cmp al, r12b
jl 0x10000311c
cmp al, 0x39
jg 0x10000311c
sub al, r12b
jmp 0x100003136
cmp al, 0x61
jl 0x100003128
cmp al, 0x66
jg 0x100003128
sub al, 0x57
jmp 0x100003136
cmp al, 0x41
jl 0x100003134
cmp al, 0x46
jg 0x100003134
sub al, 0x37
jmp 0x100003136
mov al, 0xff
cmp cl, 0xf
ja 0x10000320d
cmp al, 0xf
ja 0x10000320d
shl cl, 4
add r8d, 2
add rdx, 2
add cl, al
mov byte [rsi], cl
inc rsi
cmp r8d, 8
jb 0x1000030da
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [0x1000013d4]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x10000328c
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x10000328c
mov r8d, edi
lea rdx, [rsp + 0x89]
mov cl, byte [rdx - 1]
cmp cl, r12b
jl 0x10000321d
cmp cl, 0x39
jg 0x10000321d
sub cl, r12b
jmp 0x10000323d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100003033
cmp cl, 0x61
jl 0x10000322c
cmp cl, 0x66
jg 0x10000322c
sub cl, 0x57
jmp 0x10000323d
cmp cl, 0x41
jl 0x10000323b
cmp cl, 0x46
jg 0x10000323b
sub cl, 0x37
jmp 0x10000323d
mov cl, 0xff
mov al, byte [rdx]
cmp al, r12b
jl 0x10000324d
cmp al, 0x39
jg 0x10000324d
sub al, r12b
jmp 0x100003267
cmp al, 0x61
jl 0x100003259
cmp al, 0x66
jg 0x100003259
sub al, 0x57
jmp 0x100003267
cmp al, 0x41
jl 0x100003265
cmp al, 0x46
jg 0x100003265
sub al, 0x37
jmp 0x100003267
mov al, 0xff
cmp cl, 0xf
ja 0x10000320d
cmp al, 0xf
ja 0x10000320d
shl cl, 4
add r8d, 2
add rdx, 2
add cl, al
mov byte [rsi], cl
inc rsi
cmp r8d, 8
jb 0x1000031fb
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [0x1000013dc]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000033ad
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000033ad
mov r8d, edi
lea rdx, [rsp + 0x89]
mov cl, byte [rdx - 1]
cmp cl, r12b
jl 0x100003336
cmp cl, 0x39
jg 0x100003336
sub cl, r12b
jmp 0x100003356
cmp cl, 0x61
jl 0x100003345
cmp cl, 0x66
jg 0x100003345
sub cl, 0x57
jmp 0x100003356
cmp cl, 0x41
jl 0x100003354
cmp cl, 0x46
jg 0x100003354
sub cl, 0x37
jmp 0x100003356
mov cl, 0xff
mov al, byte [rdx]
cmp al, r12b
jl 0x100003366
cmp al, 0x39
jg 0x100003366
sub al, r12b
jmp 0x100003380
cmp al, 0x61
jl 0x100003372
cmp al, 0x66
jg 0x100003372
sub al, 0x57
jmp 0x100003380
cmp al, 0x41
jl 0x10000337e
cmp al, 0x46
jg 0x10000337e
sub al, 0x37
jmp 0x100003380
mov al, 0xff
cmp cl, 0xf
ja 0x10000320d
cmp al, 0xf
ja 0x10000320d
shl cl, 4
add r8d, 2
add rdx, 2
add cl, al
mov byte [rsi], cl
inc rsi
cmp r8d, 8
jb 0x100003324
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [0x1000013cc]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000034c2
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000034c2
mov r8d, edi
lea rdx, [rsp + 0x89]
mov al, byte [rdx - 1]
cmp al, r12b
jl 0x100003456
cmp al, 0x39
jg 0x100003456
sub al, r12b
jmp 0x100003470
cmp al, 0x61
jl 0x100003462
cmp al, 0x66
jg 0x100003462
sub al, 0x57
jmp 0x100003470
cmp al, 0x41
jl 0x10000346e
cmp al, 0x46
jg 0x10000346e
sub al, 0x37
jmp 0x100003470
mov al, 0xff
mov cl, byte [rdx]
cmp cl, r12b
jl 0x100003481
cmp cl, 0x39
jg 0x100003481
sub cl, r12b
jmp 0x1000034a1
cmp cl, 0x61
jl 0x100003490
cmp cl, 0x66
jg 0x100003490
sub cl, 0x57
jmp 0x1000034a1
cmp cl, 0x41
jl 0x10000349f
cmp cl, 0x46
jg 0x10000349f
sub cl, 0x37
jmp 0x1000034a1
mov cl, 0xff
cmp al, 0xf
ja 0x1000034e5
cmp cl, 0xf
ja 0x1000034e5
shl al, 4
add r8d, 2
add rdx, 2
add al, cl
mov byte [rsi], al
inc rsi
cmp r8d, 8
jb 0x100003445
mov edx, 0x10
lea rax, [0x100006120]
movzx ecx, byte [rdi + rax]
mov al, byte [rsp + rdi + 0x78]
inc rdi
sub rdx, 1
mov byte [rcx + rbp], al
jne 0x1000034c7
mov dil, 1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1000038f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret