Function at 0x1000c27c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor eax, eax
mov r13, r9
mov r12, r8
mov r14, rdx
mov qword [r11 + 0x40], rax
mov qword [rsp + 0x30], rax
mov rbp, rax
mov rsi, rax
mov rbx, rax
cmp r9, rax
je 0x1000c27fb
mov qword [r9], rax
cmp rdx, rax
je 0x1000c2e0b
cmp r8, rax
je 0x1000c2e0b
cmp r9, rax
je 0x1000c2e0b
mov r15, qword [rsp + 0xa0]
cmp r15, rax
je 0x1000c2e0b
cmp qword [rsp + 0xa8], rax
je 0x1000c2e0b
mov rdi, rdx
or r8, 0xffffffffffffffff
mov rcx, r8
repne scasw ax, word [rdi]
lea rdi, [0x10000c5f0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
lea rbp, [rdx + rcx + 0x39]
xor ecx, ecx
lea rdx, [rbp + rbp]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1000c2898
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0xd501a4
xor ecx, ecx
mov edi, r8d
call fcn.1000b51b8
xor r14d, r14d
jmp 0x1000c2e33
lea r8, [0x10002a510]
mov rdx, rbp
mov rcx, rax
call fcn.100038b1c
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.100038a50
lea r8, [0x100014f4c]
mov rdx, rbp
mov rcx, rdi
call fcn.100038a50
lea r8, [0x10000c5f0]
mov rdx, rbp
mov rcx, rdi
call fcn.100038a50
lea r11, [rsp + 0xb8]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
mov edi, eax
cmp eax, r14d
je 0x1000c2927
mov rcx, qword [rsp + 0x30]
lea r9d, [r14 + 2]
mov r8d, eax
mov edx, 0xe401a4
call fcn.1000b51b8
jmp 0x1000c2e33
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, [0x10000c638]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x88], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2977
mov r8d, eax
mov edx, 0xee01a4
xor r9d, r9d
xor ecx, ecx
jmp 0x1000c291d
cmp dword [rsp + 0x98], 1
je 0x1000c2991
mov r8d, 0x80070057
mov edx, 0xf301a4
mov edi, r8d
jmp 0x1000c2970
mov edx, dword [rsp + 0x88]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
cmp rax, r14
jne 0x1000c29bf
mov r8d, 0x8007000e
mov edx, 0xfc01a4
mov edi, r8d
jmp 0x1000c2db7
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, [0x10000c638]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2a02
mov edx, 0x10501a4
jmp 0x1000c2db4
mov eax, dword [rsp + 0x88]
lea r9, [rsp + 0x98]
lea rdx, [0x10000c618]
shr rax, 1
xor r8d, r8d
mov word [rbp + rax*2], r14w
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2a60
mov edx, 0x11101a4
jmp 0x1000c2db4
cmp dword [rsp + 0x98], 4
je 0x1000c2a7d
mov r8d, 0x80070057
mov edx, 0x11601a4
mov edi, r8d
jmp 0x1000c2db7
cmp dword [r12], r14d
mov r12d, 4
je 0x1000c2af1
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, [0x10000c650]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x88], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2ad4
mov edx, 0x13501a4
jmp 0x1000c2db4
cmp dword [rsp + 0x98], r12d
je 0x1000c2af1
mov r8d, 0x80070057
mov edx, 0x13a01a4
mov edi, r8d
jmp 0x1000c2db7
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
lea rdx, [0x10000c698]
xor r8d, r8d
mov dword [rsp + 0x88], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2b44
mov edx, 0x14601a4
jmp 0x1000c2db4
cmp dword [rsp + 0x98], r12d
je 0x1000c2b61
mov r8d, 0x80070057
mov edx, 0x14b01a4
mov edi, r8d
jmp 0x1000c2db7
mov rdi, qword [rsp + 0xd0]
cmp rdi, r14
je 0x1000c2bfa
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
lea rdx, [0x10000c778]
xor r8d, r8d
mov dword [rsp + 0x88], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
je 0x1000c2bcd
xor r9d, r9d
mov r8d, eax
mov edx, 0x18201a4
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000c2bfa
cmp dword [rsp + 0x98], r12d
je 0x1000c2bea
mov r8d, 0x80070057
mov edx, 0x18901a4
mov edi, r8d
jmp 0x1000c2db7
cmp dword [rsp + 0xb0], r14d
mov eax, r14d
setne al
mov dword [rdi], eax
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea rdi, [0x10000c6f0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x98]
mov rdx, rdi
xor r8d, r8d
mov dword [rsp + 0x88], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1000c2cdb
cmp dword [rsp + 0x98], 1
je 0x1000c2c5d
mov r8d, 0x80070057
mov edx, 0x19c01a4
mov edi, r8d
jmp 0x1000c2db7
mov edx, dword [rsp + 0x88]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, r14
jne 0x1000c2c8b
mov r8d, 0x8007000e
mov edx, 0x1a501a4
mov edi, r8d
jmp 0x1000c2db7
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2cca
mov edx, 0x1ae01a4
jmp 0x1000c2db4
mov eax, dword [rsp + 0x88]
shr rax, 1
mov word [rsi + rax*2], r14w
jmp 0x1000c2cee
xor r9d, r9d
mov r8d, eax
mov edx, 0x1b401a4
mov rcx, rdi
call fcn.1000b51b8
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, [0x10000c720]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x88], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1000c2dd2
cmp dword [rsp + 0x98], 1
je 0x1000c2d4b
mov r8d, 0x80070057
mov edx, 0x1c601a4
mov edi, r8d
jmp 0x1000c2db7
mov edx, dword [rsp + 0x88]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, r14
jne 0x1000c2d76
mov r8d, 0x8007000e
mov edx, 0x1cf01a4
mov edi, r8d
jmp 0x1000c2db7
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rdx, [0x10000c720]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r14d
je 0x1000c2dc3
mov edx, 0x1da01a4
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000c2e25
mov eax, dword [rsp + 0x88]
shr rax, 1
mov word [rbx + rax*2], r14w
mov rax, qword [rsp + 0xc0]
cmp rax, r14
je 0x1000c2dea
cmp rsi, r14
je 0x1000c2dea
mov qword [rax], rsi
mov rsi, r14
mov rax, qword [rsp + 0xc8]
cmp rax, r14
je 0x1000c2e02
cmp rbx, r14
je 0x1000c2e02
mov qword [rax], rbx
mov rbx, r14
mov qword [r13], rbp
mov edi, r14d
jmp 0x1000c2e33
mov edi, 0x80004003
xor r9d, r9d
mov edx, 0xc801a4
mov r8d, edi
xor ecx, ecx
call fcn.1000b51b8
xor r14d, r14d
cmp rbp, r14
je 0x1000c2e33
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x30]
cmp rax, r14
je 0x1000c2e46
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, r14
je 0x1000c2e54
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rsi, r14
je 0x1000c2e62
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb8]
cmp rcx, r14
je 0x1000c2e75
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.1000b7bec