Function at 0x10001d854
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x910
mov rax, qword [0x100026108]
xor rax, rsp
mov qword [rsp + 0x900], rax
xor eax, eax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x50], eax
mov rbx, rax
mov r13, rax
mov r15d, eax
lea rax, [rsp + 0x60]
lea r14, [0x1000038d0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, r14
mov qword [rsp + 0x20], rax
mov edi, 1
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x10001d934
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001d91f
lea esi, [rdi + 3]
test byte [rcx + 0x1c], sil
je 0x10001d91f
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 9]
lea r9, [0x100002a48]
lea r8, [0x100001b00]
mov dword [rsp + 0x20], ebp
call fcn.1000071e8
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
xor ebp, ebp
jmp 0x10001dd73
xor ebp, ebp
cmp rsi, rbp
je 0x10001d946
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbx, rsi
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x6f0]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
jne 0x10001dc8a
lea rax, [rsp + 0xc0]
mov esi, 4
sub r14, rax
mov r8d, 0x104
lea rcx, [rsp + 0xc0]
mov edi, ebp
mov rdx, r8
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x10001d9c2
movzx eax, word [r14 + rcx]
cmp ax, bp
je 0x10001d9c2
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001d99f
cmp rdx, rbp
jne 0x10001d9d0
sub rcx, 2
mov edi, 0x8007007a
cmp edi, ebp
mov word [rcx], bp
jl 0x10001ded5
mov eax, dword [rsp + 0x40]
mov rdx, r8
lea rcx, [rsp + 0xc0]
lea r8, [0x100003bf8]
sub rdx, rax
call fcn.100014950
cmp eax, ebp
mov edi, eax
jl 0x10001dead
mov ecx, dword [rsp + 0x40]
mov edx, 0x104
lea r8, [rsp + 0x6f0]
inc ecx
sub rdx, rcx
lea rcx, [rsp + 0xc0]
call fcn.100014950
cmp eax, ebp
mov edi, eax
jl 0x10001de7e
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xc0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jne 0x10001de2e
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x5c]
lea rdx, [0x1000063c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x5c], 0x50
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jne 0x10001de0b
xor ebp, ebp
cmp r13, rbp
je 0x10001dab4
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
cmp rax, rbp
je 0x10001ddc9
cmp rbx, rbp
je 0x10001dc32
mov r9d, 1
mov r8d, 0x400
mov rdx, rax
mov rcx, rbx
call sub.OLEAUT32.dll_VarR8Pow
mov ecx, ebp
mov edx, 1
cmp eax, edx
sete cl
cmp ecx, ebp
je 0x10001dc32
cmp r15d, ebp
jne 0x10001dd40
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r15d, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4e0]
lea rdx, [0x1000063e0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
mov ebp, eax
cmp eax, edi
jne 0x10001dd18
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea rdx, [0x1000063f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
cmp eax, edi
jne 0x10001dce6
mov eax, dword [rsp + 0x68]
xor ebp, ebp
lea r9, [rsp + 0x4e0]
mov edx, 0x104
lea rcx, [rsp + 0x2d0]
cmp eax, ebp
jbe 0x10001dbed
lea r8, [0x100006420]
mov dword [rsp + 0x20], eax
call fcn.100014aa4
cmp eax, ebp
mov edi, eax
jge 0x10001dc03
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
lea edx, [rbp + 0x13]
lea r9, [0x1000037c8]
jmp 0x10001df02
lea r8, [0x100006430]
call fcn.100014aa4
cmp eax, ebp
mov edi, eax
jl 0x10001dcbb
lea rax, [rsp + 0x2d0]
cmp rax, qword [r12]
je 0x10001dc32
mov rcx, qword [r12]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r12], rax
cmp rax, rbp
je 0x10001dcb0
mov rcx, qword [rsp + 0x48]
call qword [entry0]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
inc eax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x6f0]
mov edx, eax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
je 0x10001d98c
cmp eax, 0x103
je 0x10001dd4e
cmp eax, ebp
je 0x10001dd4e
movzx edi, ax
or edi, 0x80070000
cmp eax, ebp
cmovle edi, eax
jmp 0x10001dd62
mov ecx, 0x8007000e
call fcn.10000f92c
int3
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
jmp 0x10001dbe1
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001de67
test byte [rcx + 0x1c], sil
je 0x10001de67
mov edx, SafeArrayGetLBound
lea r9, [0x100002aa0]
jmp 0x10001de53
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001de67
test byte [rcx + 0x1c], sil
je 0x10001de67
mov edx, SafeArrayGetLBound
jmp 0x10001dd0c
mov rcx, qword [r12]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], rbp
mov rcx, qword [r12]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, ebp
mov eax, 1
cmove edi, eax
mov rbx, rbp
cmp r13, rbp
je 0x10001dd73
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x10001dd83
call qword [entry0]
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x10001dd93
call qword [entry0]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rcx, qword [rsp + 0x900]
xor rcx, rsp
call fcn.10001ed20
mov rbx, qword [rsp + 0x960]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, 0x8007000e
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001b00]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9d, 0x8007000e
call fcn.100007084
jmp 0x10001dd62
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001de67
test byte [rcx + 0x1c], sil
je 0x10001de67
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
jmp 0x10001dd0c
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001de67
test byte [rcx + 0x1c], sil
je 0x10001de67
mov edx, SafeArrayDestroy
lea r9, [0x100002a48]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001b00]
mov dword [rsp + 0x20], ebp
call fcn.1000071e8
movzx edi, bp
xor eax, eax
or edi, 0x80070000
cmp ebp, eax
cmovle edi, ebp
xor ebp, ebp
jmp 0x10001dd62
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
mov edx, SafeArrayDestroy
lea r9, [0x100006398]
jmp 0x10001df02
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
mov edx, SafeArrayDestroy
jmp 0x10001dea4
mov rcx, qword [0x100026430]
lea rax, [0x100026430]
cmp rcx, rax
je 0x10001dd62
test byte [rcx + 0x1c], sil
je 0x10001dd62
mov edx, SafeArrayDestroy
lea r9, [0x100003928]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001b00]
mov dword [rsp + 0x20], edi
call fcn.1000071e8
jmp 0x10001dd62