Function at 0x437e20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
test rsi, rsi
jne 0x437f90
xor rsi, rsi
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x27e]
mov r9d, 0x20a
call sub.advapi32.dll_RegEnumKeyW
mov edi, eax
test edi, edi
je 0x437e74
cmp edi, 0x103
jne 0x437f8a
xor rdi, rdi
jmp 0x437f8a
cmp word [rbp + 0x27e], 0x2e
je 0x437f6b
lea rcx, [rbp + 0x27e]
call fcn.00427780
mov r13d, eax
lea rcx, [rbp + 0x27e]
lea rdx, [0x004380fc]
call fcn.004277c0
lea rcx, [rbp + 0x74]
lea rdx, [0x00438124]
call fcn.004277a0
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
jne 0x437f1f
mov r13d, r13d
mov word [rbp + r13*2 + 0x27e], 0
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00438164]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
mov rcx, qword [rbp + 0x488]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
jne 0x437f6b
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
lea rax, [rbp + 0x27e]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00438166]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042cba0
mov rax, qword [0x0044e4b8]
cmp dword [rax], 0
je 0x437f82
mov eax, 1
jmp 0x4380eb
add esi, 1
jmp 0x437e42
nop
jmp 0x4380e9
cmp word [rsi], 0x2e
jne 0x437fc2
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00438184]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440b70
mov eax, 0x7b
jmp 0x4380eb
mov rcx, rsi
xor rdx, rdx
call fcn.00441600
mov rsi, rax
mov rcx, rsi
mov dx, 0x20
call fcn.00427710
test rax, rax
je 0x437fe6
mov word [rax], 0
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [rbp + 0x27e]
lea rdx, [0x00438208]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.004278e0
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x43804c
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00438184]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440b70
mov eax, edi
jmp 0x4380eb
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00438164]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x4380c8
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00438166]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042cba0
jmp 0x4380e9
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00438184]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440b70
mov eax, edi
lea rsp, [rbp + 0x490]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret