Function at 0x4368a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
test rsi, rsi
jne 0x436a10
xor rsi, rsi
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x27e]
mov r9d, 0x20a
call sub.advapi32.dll_RegEnumKeyW
mov edi, eax
test edi, edi
je 0x4368f4
cmp edi, 0x103
jne 0x436a0a
xor rdi, rdi
jmp 0x436a0a
cmp word [rbp + 0x27e], 0x2e
je 0x4369eb
lea rcx, [rbp + 0x27e]
call fcn.00426280
mov r13d, eax
lea rcx, [rbp + 0x27e]
lea rdx, [0x00436b7c]
call fcn.004262c0
lea rcx, [rbp + 0x74]
lea rdx, [0x00436ba4]
call fcn.004262a0
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
jne 0x43699f
mov r13d, r13d
mov word [rbp + r13*2 + 0x27e], 0
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00436be4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
mov rcx, qword [rbp + 0x488]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
jne 0x4369eb
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
lea rax, [rbp + 0x27e]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00436be6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042b650
mov rax, qword [0x0044c358]
cmp dword [rax], 0
je 0x436a02
mov eax, 1
jmp 0x436b6b
add esi, 1
jmp 0x4368c2
nop
jmp 0x436b69
cmp word [rsi], 0x2e
jne 0x436a42
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00436c04]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043f4f0
mov eax, 0x7b
jmp 0x436b6b
mov rcx, rsi
xor rdx, rdx
call fcn.0043fee0
mov rsi, rax
mov rcx, rsi
mov dx, 0x20
call fcn.00426210
test rax, rax
je 0x436a66
mov word [rax], 0
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [rbp + 0x27e]
lea rdx, [0x00436c88]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.004263b0
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x436acc
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00436c04]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043f4f0
mov eax, edi
jmp 0x436b6b
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00436be4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x436b48
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00436be6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042b650
jmp 0x436b69
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00436c04]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043f4f0
mov eax, edi
lea rsp, [rbp + 0x490]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret