Function at 0x100006dd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x130
and qword [rsp + 0x30], 0
mov rsi, rdx
lea rax, [rsp + 0x30]
mov r12, r8
mov r13, rcx
lea rdx, [0x100001ec0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100006ec2
and dword [rsp + 0x168], eax
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x168]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
xor ebx, ebx
cmp dword [rsp + 0x168], ebx
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100006ec2
mov rcx, qword [0x100010130]
lea rdi, [0x100010130]
cmp rcx, rdi
je 0x100007226
cmp byte [rcx + 0x19], 3
jb 0x100007226
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xe]
lea r8, [0x1000018b8]
mov r9, rsi
call fcn.10000237c
jmp 0x100007226
mov ebx, 0x2f8
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x1000071f8
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [0x100010720]
lea r9, [0x100008328]
mov r8, r13
mov edx, 0x72
mov qword [rbp], rsi
mov qword [rbp + 8], r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rbx, rax
lea rdi, [0x100010130]
cmp rax, 3
je 0x100006f2d
cmp rax, 4
jne 0x100006f62
mov rcx, qword [0x100010130]
cmp rcx, rdi
je 0x100006f54
cmp byte [rcx + 0x19], 4
jb 0x100006f54
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018b8]
mov edx, 0x14
call fcn.100002358
mov rcx, qword [rbp]
mov edx, 1
call fcn.10000a13c
cmp rbx, 1
je 0x100006fa6
cmp rbx, 3
je 0x100006fa6
mov rcx, qword [0x100010130]
cmp rcx, rdi
je 0x100006f98
cmp byte [rcx + 0x19], 3
jb 0x100006f98
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018b8]
mov edx, 0x10
mov r9, rsi
call fcn.10000237c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100007226
mov rcx, qword [0x100010130]
cmp rcx, rdi
je 0x100006fd0
cmp byte [rcx + 0x19], 4
jb 0x100006fd0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018b8]
mov edx, 0x11
mov r9, rsi
call fcn.10000237c
mov ebx, 0x60
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
and dword [rsp + 0xd8], 0
and dword [rsp + 0xe0], 0
lea rax, [rsp + 0x110]
xor esi, esi
mov qword [rsp + 0xb8], r13
mov dword [rsp + 0xb0], ebx
mov rbx, qword [0x100010720]
lea r13d, [rsi + 0x68]
lea rcx, [rsp + 0x40]
mov r8, r13
xor edx, edx
mov dword [rsp + 0xb4], 0x4004
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], 0x6c
mov qword [rsp + 0xc8], 0x86
mov qword [rsp + 0xe8], rax
call sub.msvcrt.dll_memset
mov qword [rsp + 0x48], rbx
lea rax, [0x10000724c]
lea ebx, [rsi + 0x66]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], 0x1000
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x50], 0x6a
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
call qword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
mov qword [rsp + 0x110], rax
test rax, rax
je 0x1000070b6
inc dword [rsp + 0xd8]
lea esi, [rbx - 0x65]
cmp dword [r12 + 0x10], 0
je 0x10000712c
lea rcx, [rsp + 0x40]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [0x100010720]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [0x100007c98]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], 0x1000
mov qword [rsp + 0x50], 0x6f
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
call qword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
movsxd rcx, esi
mov qword [rsp + rcx*8 + 0x110], rax
test rax, rax
je 0x10000712c
inc esi
inc dword [rsp + 0xd8]
lea rcx, [rsp + 0x40]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [0x100010720]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [0x100007e20]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], 0x1000
mov qword [rsp + 0x50], 0x70
mov qword [rsp + 0x88], 0x92
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
call qword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
movsxd rcx, esi
mov qword [rsp + rcx*8 + 0x110], rax
test rax, rax
je 0x10000719e
inc esi
inc dword [rsp + 0xd8]
test esi, esi
je 0x1000071b6
lea rcx, [rsp + 0xb0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
cmp rax, 0xffffffffffffffff
jne 0x100007226
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x100010130]
cmp rax, rdi
je 0x100007226
cmp byte [rax + 0x19], 2
jb 0x100007226
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100010130]
lea r8, [0x1000018b8]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x12
call fcn.10000252c
jmp 0x100007226
mov rcx, qword [0x100010130]
lea rdi, [0x100010130]
cmp rcx, rdi
je 0x100007226
cmp byte [rcx + 0x19], 2
jb 0x100007226
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018b8]
mov edx, 0xf
call fcn.100002358
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret