Function at 0x1001028e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r13, r8
mov r12, rdx
mov rbp, rcx
lea r15, [0x10003c720]
mov qword [rsp + 0x60], r15
lea rdi, [0x10003c970]
mov qword [rsp + 0x68], rdi
lea rsi, [0x10003c708]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x18c
mov dword [rsp + 0x7c], 0xb
mov dword [rax - 0x148], 0xff
xor r14d, r14d
mov word [rax - 0xc8], r14w
mov byte [rax - 0xc6], r14b
mov byte [rax - 0xc5], 1
xor edx, edx
lea r8d, [r14 + 0x78]
lea rcx, [rax - 0x140]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x120]
call fcn.1000e8000
nop
mov qword [r13], r14
mov dword [rsp + 0x1d0], r14d
mov dword [rsp + 0x1e0], r14d
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x1d0]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x100102a1c
lea rax, [0x100008440]
mov qword [rsp + 0x20], rax
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0x120]
call fcn.1000e8634
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
xor al, al
jmp 0x100102d10
cmp eax, r14d
je 0x100102adf
cmp eax, 0xea
je 0x100102adf
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x1ac
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r14w
mov byte [rsp + 0x102], r14b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
movzx r8d, bx
or r8d, 0x80070000
cmp ebx, r14d
cmovle r8d, ebx
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], r12
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x10003c9b0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x120]
call fcn.1000e9e30
int3
mov ebx, dword [rsp + 0x1d0]
cmp ebx, 1
je 0x100102b89
cmp ebx, 2
je 0x100102b89
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x1b2
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r14w
mov byte [rsp + 0x102], r14b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], r12
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, [0x10003ca20]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x120]
call fcn.1000e9e30
int3
lea rax, [0x100035878]
mov qword [rsp + 0x110], rax
mov edi, dword [rsp + 0x1e0]
shr edi, 1
mov esi, edi
lea rcx, [rdi + rdi + 2]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbx, rax
mov qword [rsp + 0x118], rax
cmp rax, r14
jne 0x100102bd8
mov dword [rsp + 0x58], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x50], r14d
lea eax, [rdi + rdi]
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x100102cca
mov qword [rsp + 0x60], r15
lea rax, [0x10003c970]
mov qword [rsp + 0x68], rax
lea rax, [0x10003c708]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x1c7
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r14w
mov byte [rsp + 0x102], r14b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
movzx r8d, di
or r8d, 0x80070000
cmp edi, r14d
cmovle r8d, edi
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], r12
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x10003c9b0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x120]
call fcn.1000e9e30
int3
mov word [rbx + rsi*2], r14w
mov qword [r13], rbx
lea rcx, [0x100008430]
mov qword [rsp + 0x20], rcx
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0x120]
call fcn.1000e8634
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
mov al, 1
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret