Function at 0x10004690c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x100083218]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r12d, r12d
mov rbp, rcx
mov rsi, r8
mov rdi, rdx
mov ebx, 0x206
lea rcx, [rsp + 0x62]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov word [rsp + 0x60], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x272]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x270], r12w
call sub.msvcrt.dll_memset
mov al, byte [0x100084fb0]
mov dword [rsp + 0x40], 1
cmp al, r12b
jne 0x100046999
mov eax, 0x80070015
jmp 0x100046bac
cmp rdi, r12
je 0x100046ba7
cmp rsi, r12
je 0x100046ba7
mov rcx, rbp
call fcn.10004646c
cmp eax, r12d
je 0x10004698f
lea rcx, [0x100084fa8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lea rdx, [rsp + 0x48]
lea rcx, [0x100083328]
call qword [sym.imp.ole32.dll_StringFromCLSID]
lea rcx, [0x100084fa8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp ebx, r12d
jl 0x100046b83
lea r8, [0x10007d670]
lea rax, [rsp + 0x60]
mov r13d, 0x104
lea rcx, [rsp + 0x60]
mov ebx, r12d
sub r8, rax
mov rdx, r13
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100046a33
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100046a33
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100046a0f
cmp rdx, r12
jne 0x100046a41
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x100046b83
lea r8, [0x10007a724]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100005af0
cmp eax, r12d
mov ebx, eax
jl 0x100046b83
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100005af0
cmp eax, r12d
mov ebx, eax
jl 0x100046b83
mov eax, dword [rsi]
lea rdx, [rsp + 0x60]
mov r9d, 2
add eax, eax
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov r13d, 0x80070000
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100046b83
lea rax, [rsp + 0x50]
lea rdx, [0x100078b20]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100046b83
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x270]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100046b83
mov edx, dword [rsi]
lea r8, [0x10007d694]
mov rcx, rdi
call fcn.100005af0
cmp eax, r12d
mov ebx, eax
jl 0x100046b83
mov edx, dword [rsi]
lea r8, [rsp + 0x270]
mov rcx, rdi
call fcn.100005af0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x100046b93
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100046ba3
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x100046bac
mov eax, 0x80070057
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000010c0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret