Function at 0x4058a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rax, [rsp + 0x94]
mov qword [rsp + 0x108], rdx
mov rbp, rcx
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x110], r8d
xor r8d, r8d
mov dword [rsp + 0x118], r9d
xor r9d, r9d
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x84], eax
test eax, eax
jne 0x405c28
mov eax, dword [rsp + 0x118]
or eax, dword [rsp + 0x94]
je 0x40595f
mov rdx, qword [rsp + 0x108]
lea rcx, [0x004094e8]
call sym.output_string
mov ecx, 0x200
mov esi, 0x800
mov rdi, qword [sym.imp.ucrtbase.dll_malloc]
mov ebx, 0x100
lea r15, [rsp + 0x98]
lea r14, [rsp + 0x9c]
mov qword [rsp + 0x88], rdi
call rdi
mov ecx, 0x800
mov r12, rax
call rdi
xor edi, edi
mov r13, rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x68], rax
mov rax, qword [sym.imp.ucrtbase.dll_realloc]
mov qword [rsp + 0x78], rax
nop word [rax + rax]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], r14
mov r9, r15
mov r8, r12
mov dword [rsp + 0x98], ebx
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x9c], esi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
je 0x405a38
cmp eax, 0xea
jne 0x405a80
mov r8d, dword [rsp + 0x9c]
cmp r8d, esi
jbe 0x405a60
mov dword [rsp + 0x70], r8d
mov edx, r8d
mov rcx, r13
mov rax, qword [rsp + 0x78]
call rax
mov r8d, dword [rsp + 0x70]
mov r13, rax
mov esi, r8d
jmp 0x4059c0
mov edx, dword [rsp + 0xa4]
mov r8, r13
mov rcx, r12
add edi, 1
mov r9d, dword [rsp + 0x9c]
call sym.output_value
jmp 0x4059c0
lea edx, [rbx + rbx]
mov rcx, r12
mov rbx, rdx
add rdx, rdx
call qword [sym.imp.ucrtbase.dll_realloc]
mov r12, rax
jmp 0x4059c0
mov rcx, r13
mov r13, qword [sym.imp.ucrtbase.dll_free]
call r13
mov rcx, r12
call r13
or edi, dword [rsp + 0x118]
jne 0x405bf0
mov edx, dword [rsp + 0x90]
test edx, edx
jne 0x405ad0
mov eax, dword [rsp + 0x84]
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x88]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0x108]
cmp word [rax], 0
je 0x405c7f
mov rbx, rax
nop word [rax + rax]
add rbx, 2
cmp word [rbx], 0
jne 0x405b00
sub rbx, qword [rsp + 0x108]
sar rbx, 1
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], r13
xor esi, esi
mov rdi, qword [sym.imp.advapi32.dll_RegEnumKeyExW]
mov qword [rsp + 0x70], rax
mov r15, qword [rsp + 0x108]
lea r14, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x101
mov r9, r14
mov r8, r12
mov edx, esi
mov qword [rsp + 0x38], 0
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x405c40
mov eax, dword [rsp + 0x110]
test eax, eax
je 0x405c10
mov r9d, dword [rsp + 0xa0]
mov r8, r12
mov edx, ebx
mov rcx, r15
call sym.build_subkey_path
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9d, dword [0x0040d0a0]
mov r13, rax
mov rax, qword [rsp + 0x70]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x405c50
mov rax, qword [rsp + 0x68]
mov rcx, r13
call rax
add esi, 1
jmp 0x405b40
lea rcx, [0x004094c2]
call sym.output_string
mov edx, dword [rsp + 0x90]
test edx, edx
je 0x405aab
jmp 0x405ad0
mov r8, r12
mov rdx, r15
lea rcx, str._1_2_n
call sym.output_string
jmp 0x405be0
mov dword [rsp + 0x84], 1
jmp 0x405aab
mov r13, qword [rsp + 0x68]
mov rcx, r12
call r13
jmp 0x405aab
mov r9d, 1
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
mov rdx, r13
call sym.query_all
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x405bd6
xor ebx, ebx
jmp 0x405b15