Function at 0x100103ff8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, r8
mov r12, rdx
mov rbx, rcx
lea r14, [0x10003c720]
mov qword [rsp + 0x48], r14
lea r15, [0x10003cf80]
mov qword [rsp + 0x50], r15
lea rdi, [0x10003c708]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], 0x42c
mov esi, 0xb
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x68], 0xff
xor r13d, r13d
mov word [rax - 0x220], r13w
mov byte [rax - 0x21e], r13b
mov byte [rax - 0x21d], 1
xor edx, edx
lea r8d, [rsi + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x260]
call fcn.1000e8000
nop
mov rcx, rbx
call fcn.1001043fc
cmp dword [rbx + 0x10], 7
je 0x10010411c
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], 0x433
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r13w
mov byte [rsp + 0xea], r13b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rsi + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, [0x10003cff0]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x260]
call fcn.1000e9e30
int3
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x40], eax
lea rcx, [0x10000d460]
mov qword [rsp + 0xf0], rcx
mov rdx, rax
shr rdx, 1
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0xf8], rax
cmp rax, r13
jne 0x10010416f
mov dword [rsp + 0x44], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll__CxxThrowException
int3
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x310], eax
mov dword [rsp + 0x328], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x328]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x310]
mov r8, qword [rbx + 0x20]
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp eax, r13d
je 0x100104315
cmp eax, 0x103
je 0x100104276
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
lea rax, [0x10003c708]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x454
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r13w
mov byte [rsp + 0xea], r13b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
movzx r8d, si
or r8d, 0x80070000
cmp esi, r13d
cmovle r8d, esi
mov eax, dword [rsp + 0x310]
mov dword [rsp + 0x38], eax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
lea r9, [0x10003d100]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x260]
call fcn.1000e9e30
int3
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], r15
lea rax, [0x10003c708]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x120], 0x452
mov dword [rsp + 0x124], 0xb
mov dword [rsp + 0x128], 0xff
mov word [rsp + 0x1a8], r13w
mov byte [rsp + 0x1aa], r13b
mov byte [rsp + 0x1ab], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll_memset
mov r11d, dword [rbx + 8]
mov dword [rsp + 0x28], r11d
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x20], eax
lea r9, [0x10003cd70]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x260]
call fcn.1000e9e30
int3
mov ebx, dword [rbx + 0x10]
mov esi, dword [rsp + 0x328]
cmp esi, ebx
je 0x1001043be
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1b8], r15
lea rax, [0x10003c708]
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x1c8], 0x44c
mov dword [rsp + 0x1cc], 0xb
mov dword [rsp + 0x1d0], 0xff
mov word [rsp + 0x250], r13w
mov byte [rsp + 0x252], r13b
mov byte [rsp + 0x253], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x1d8]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
lea r9, [0x10003d070]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x260]
call fcn.1000e9e30
int3
mov qword [r12], rdi
mov eax, dword [rsp + 0x40]
shr eax, 1
mov dword [rbp], eax
lea rcx, [rsp + 0x260]
call fcn.1000e80ec
mov rbx, qword [rsp + 0x318]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret