Function at 0x140004370
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x18]
sub rsp, 0x108
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x40], rax
xor esi, esi
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rdi
lea rdi, [0x140000000]
mov qword [r11 - 0x28], r12
mov r12, rcx
mov qword [r11 - 0x30], r13
mov r13, qword [rbp + 0x50]
mov qword [rdx], rsi
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov qword [r8], rsi
mov r15, qword [0x1400a6710]
mov qword [rbp - 0x70], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x68], rsi
mov dword [rbp - 0x60], esi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x50], rsi
mov qword [rbp - 0x80], rsi
mov dword [rsp + 0x6c], esi
test r15, r15
je 0x140004554
mov rax, qword [r15 + 0x10]
lea rcx, str.check__p__s__s
mov qword [rsp + 0x48], rax
lea rdx, str.lookup_key
mov rax, qword [r15 + 8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, 0x7d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rcx
lea rcx, str.C:__w1_s_ssh_pkcs11_client.c
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov rbx, qword [r15]
test r12, r12
je 0x140004513
test rbx, rbx
je 0x140004513
mov edx, dword [r12]
cmp edx, dword [rbx]
jne 0x140004513
mov r14, qword [0x14005d3c0]
mov rcx, rsi
test r14, r14
je 0x1400044c2
mov rax, r14
cmp dword [rax + 0x18], edx
je 0x140004499
mov rax, qword [rdi + rcx*8 + 0x5d3c8]
inc rcx
test rax, rax
jne 0x140004482
jmp 0x1400044c2
test rax, rax
je 0x1400044c2
cmp dword [rax + 0x20], esi
je 0x1400044c2
mov rdx, qword [rbx + 0x80]
mov rcx, qword [r12 + 0x80]
call fcn.14001b530
test eax, eax
je 0x140004513
mov r14, qword [0x14005d3c0]
mov r9d, dword [r12]
mov ecx, dword [rbx]
call fcn.14001b130
mov ecx, r9d
mov edi, eax
call fcn.14001b130
cmp eax, edi
lea rdi, [0x140000000]
jne 0x140004506
mov rcx, rsi
test r14, r14
je 0x140004506
mov rax, r14
nop dword [rax]
cmp dword [rax + 0x18], r9d
je 0x14000451c
mov rax, qword [rdi + rcx*8 + 0x5d3c8]
inc rcx
test rax, rax
jne 0x1400044f0
mov eax, esi
test eax, eax
jne 0x140004537
lea rdi, [0x140000000]
mov r15, qword [r15 + 0x18]
jmp 0x1400043fa
test rax, rax
je 0x140004506
mov rax, qword [rax + 0x30]
mov rdx, rbx
mov rcx, r12
call qword [rax + 0x18]
mov r14, qword [0x14005d3c0]
jmp 0x140004508
mov rbx, qword [r15]
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x140004563
mov r15d, 1
mov dword [rsp + 0x6c], r15d
jmp 0x1400048de
mov rbx, rsi
lea rdi, [0x140000000]
mov qword [rsp + 0x58], rbx
lea r9, [rsp + 0x60]
mov rcx, r12
lea r8, [rbp - 0x78]
call fcn.14001b9e0
test eax, eax
je 0x14000469c
mov qword [rsp + 0x60], rsi
mov rdi, rsi
lea rax, str.cannot_retrieve_and_deserialize_key_from_registry
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.sign_blob
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x191
mov dword [rsp + 0x20], 2
call fcn.14001ae20
mov esi, 0xffffffff
mov rax, qword [rbp - 0x80]
mov r15, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
test rax, rax
je 0x1400045ef
mov rcx, rax
call fcn.14003d000
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x140004600
mov rcx, rax
call fcn.14003d000
test rdi, rdi
je 0x14000460d
mov rcx, rdi
call fcn.14001f200
cmp dword [rsp + 0x6c], 0
jne 0x140004635
test rbx, rbx
je 0x140004635
mov rcx, rbx
call fcn.14001b3f0
xor eax, eax
mov ecx, 0xa8
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14003d000
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x100]
test rax, rax
je 0x140004657
mov rcx, rax
call fcn.14003d000
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140004666
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140004675
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140004684
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.1400313f0
add rsp, 0x108
pop rsi
pop rbp
ret
cmp qword [0x14005da38], rsi
mov rcx, rsi
je 0x1400046af
mov rcx, qword [rdi + 0x5da28]
mov r15, qword [rsp + 0x60]
mov r14, qword [rbp - 0x78]
mov r8, r15
mov rdx, r14
call fcn.14001bc70
mov qword [rsp + 0x60], rax
mov r12, rax
test r14, r14
je 0x1400046e2
xor eax, eax
mov rdi, r14
mov rcx, r15
rep stosb byte [rdi], al
mov rcx, r14
call fcn.14003d000
test r12, r12
je 0x140004581
cmp dword [r13 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x58], rcx
mov edi, esi
jg 0x14000477b
mov rcx, qword [r13 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140004581
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x58], rsi
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140004769
mov dword [rsp + 0x38], eax
lea rdx, str.get_user_root
lea rax, str.unable_to_open_users_registry_hive__ERROR____d
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov qword [rsp + 0x28], rsi
mov r8d, 0x52
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov edi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
jne 0x140004581
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x48]
mov r9d, 0x20109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004581
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov r9d, 0x20109
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004581
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004581
mov ecx, dword [rbp - 0x60]
call fcn.14003d014
mov qword [rbp - 0x68], rax
mov rdi, rax
test rax, rax
je 0x140004581
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004581
mov r8d, dword [rbp - 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], esi
lea r9, [rbp - 0x80]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, r13
call fcn.140003750
test eax, eax
jne 0x140004581
mov r14, qword [rbp - 0x80]
mov edi, dword [rsp + 0x68]
test r14, r14
je 0x140004581
cmp rdi, 0x8000000
ja 0x140004581
mov r15d, 1
mov ecx, 0x40
mov edx, r15d
call fcn.14003d9fc
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140004581
lea rdx, [rsp + 0x58]
mov qword [rax + 0x20], rdi
mov rcx, rax
mov qword [rax + 0x18], rdi
mov qword [rax + 0x28], rdi
mov dword [rax + 0x30], r15d
mov dword [rax + 0x34], r15d
mov qword [rax + 0x38], rsi
mov qword [rax + 8], r14
mov qword [rax], rsi
mov qword [rsp + 0x60], r12
call fcn.14001e920
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x140004aac
mov r14, qword [0x14005d3c0]
mov eax, dword [rbp + 0x48]
test al, 2
je 0x1400048ee
lea r13, str.rsa_sha2_256
jmp 0x1400048fb
test al, 4
lea r13, str.rsa_sha2_512
cmove r13, rsi
test rbx, rbx
jne 0x140004904
mov eax, esi
jmp 0x140004918
mov ecx, dword [rbx]
call fcn.14001b130
add eax, 0xfffffff6
test eax, 0xfffffffd
mov eax, esi
sete al
test eax, eax
lea r12, str.internal
cmove r12, rsi
test rbx, rbx
je 0x140004933
cmp qword [rbx + 0x88], rsi
jne 0x140004936
mov r15d, esi
mov rax, qword [rsp + 0x78]
mov rdi, qword [rbp + 0x40]
mov qword [rax], rsi
mov rax, qword [rsp + 0x70]
mov qword [rax], rsi
cmp rdi, 0x100000
ja 0x140004a6d
test rbx, rbx
je 0x140004a6d
test r14, r14
je 0x14000499b
mov edx, dword [rbx]
lea rax, [0x140000000]
mov rcx, rsi
cmp dword [r14 + 0x18], edx
jne 0x14000498b
mov eax, dword [r14 + 0x1c]
test eax, eax
je 0x14000499e
cmp eax, dword [rbx + 0x18]
je 0x14000499e
lea rax, [0x140000000]
mov r14, qword [rax + rcx*8 + 0x5d3c8]
inc rcx
test r14, r14
jne 0x140004971
mov r14, rsi
test r14, r14
je 0x140004a6d
mov rcx, rbx
call fcn.14001caa0
test eax, eax
jne 0x140004a6d
test rbx, rbx
je 0x1400049cd
mov ecx, dword [rbx]
call fcn.14001b130
add eax, 0xfffffff6
test eax, 0xfffffffd
je 0x140004a18
mov rax, qword [r14 + 0x30]
cmp qword [rax + 0x50], rsi
jne 0x1400049de
mov edi, 0xffffffc6
jmp 0x140004a4e
lfence
mov rax, qword [r14 + 0x30]
mov rbx, qword [rsp + 0x58]
mov r9, qword [rbp - 0x70]
mov rcx, rbx
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
call qword [rax + 0x50]
jmp 0x140004a4c
lfence
mov rcx, qword [rbp - 0x70]
mov rbx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x70]
mov rdx, rbx
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.14000b7c0
mov edi, eax
test r15d, r15d
je 0x140004a5f
mov rcx, rbx
call fcn.14001c280
test eax, eax
jne 0x140004a6d
test edi, edi
jne 0x140004a6d
mov rdi, qword [rsp + 0x50]
jmp 0x1400045be
lea rax, str.cannot_sign_using_retrieved_key
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.sign_blob
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x1a1
mov dword [rsp + 0x20], 2
call fcn.14001ae20
mov rdi, qword [rsp + 0x50]
jmp 0x1400045b9
mov rdi, qword [rsp + 0x50]
jmp 0x140004584