Function at 0x100002054
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
mov eax, 0x20070
call fcn.100005cb0
sub rsp, rax
mov rax, qword [0x100008110]
xor rax, rsp
mov qword [rsp + 0x20060], rax
mov esi, ecx
and qword [rsp + 0x50], 0
mov eax, 0x7fff
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
xor r12d, r12d
and dword [rsp + 0x44], r12d
mov dword [rsp + 0x4c], 4
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r12
mov r9d, 0x20000018
lea r8, [0x100001600]
lea rdx, [0x100001630]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea r13d, [r12 + 1]
cmp dword [rsp + 0x44], r13d
jne 0x100002195
mov r12d, r13d
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x100002163
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x100002163
lea edx, [rdi + 5]
lea r8d, [rdi + 3]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x40020126
mov rcx, qword [0x100008700]
call fcn.100003af8
jmp 0x10000239b
mov edx, 4
lea r8d, [rdx - 2]
and qword [rsp + 0x28], 0
lea rax, [0x100001658]
mov qword [rsp + 0x20], rax
mov r9d, 0x40020126
mov rcx, qword [0x100008700]
call fcn.100003af8
jmp 0x10000239b
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1000021df
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8d, [rsi + 2]
mov edx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r9d, 0xc0020123
mov rcx, qword [0x100008700]
call fcn.100003d94
jmp 0x10000239b
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x100002227
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 2
mov edx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r9d, 0xc0020124
mov rcx, qword [0x100008700]
call fcn.100003d94
jmp 0x10000239b
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x10000228e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8d, [rdi + 3]
mov edx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r9d, 0xc0020127
mov rcx, qword [0x100008700]
call fcn.100003d94
jmp 0x10000239b
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x10060]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x1000022d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 2
mov edx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
mov r9d, 0xc0020124
mov rcx, qword [0x100008700]
call fcn.100003d94
jmp 0x10000239b
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x48]
jne 0x10000236c
mov r8, rax
lea rdx, [rsp + 0x10060]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x10000236c
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.100003590
test eax, eax
jne 0x10000233c
lea r8d, [rax + 2]
mov edx, r13d
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xc0020125
mov rcx, qword [0x100008700]
call fcn.100003af8
jmp 0x10000239b
mov edx, 4
lea r8d, [rdx - 2]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x40020126
mov rcx, qword [0x100008700]
call fcn.100003af8
mov r12d, r13d
jmp 0x10000239b
mov r8d, 2
mov edx, r13d
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x10060]
mov qword [rsp + 0x20], rax
mov r9d, 0xc0020128
mov rcx, qword [0x100008700]
call fcn.100003af8
nop
test rsi, rsi
je 0x1000023a9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x1000023b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rsp + 0x20060]
xor rcx, rsp
call fcn.100005690
lea r11, [rsp + 0x20070]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret