Function at 0x100043ddc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x100080218]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r12d, r12d
mov rbp, rcx
mov rsi, r8
mov rdi, rdx
mov ebx, 0x206
lea rcx, [rsp + 0x62]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov word [rsp + 0x60], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x272]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x270], r12w
call sub.msvcrt.dll_memset
mov al, byte [0x100081fb0]
mov dword [rsp + 0x40], 1
cmp al, r12b
jne 0x100043e69
mov eax, 0x80070015
jmp 0x10004407c
cmp rdi, r12
je 0x100044077
cmp rsi, r12
je 0x100044077
mov rcx, rbp
call fcn.100043938
cmp eax, r12d
je 0x100043e5f
lea rcx, [0x100081fa8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lea rdx, [rsp + 0x48]
lea rcx, [0x100080328]
call qword [sym.imp.ole32.dll_StringFromCLSID]
lea rcx, [0x100081fa8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp ebx, r12d
jl 0x100044053
lea r8, [0x10007a160]
lea rax, [rsp + 0x60]
mov r13d, 0x104
lea rcx, [rsp + 0x60]
mov ebx, r12d
sub r8, rax
mov rdx, r13
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100043f03
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100043f03
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100043edf
cmp rdx, r12
jne 0x100043f11
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x100044053
lea r8, [0x1000775d4]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100005b84
cmp eax, r12d
mov ebx, eax
jl 0x100044053
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100005b84
cmp eax, r12d
mov ebx, eax
jl 0x100044053
mov eax, dword [rsi]
lea rdx, [rsp + 0x60]
mov r9d, 2
add eax, eax
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov r13d, 0x80070000
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100044053
lea rax, [rsp + 0x50]
lea rdx, [0x1000759c0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100044053
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x270]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100044053
mov edx, dword [rsi]
lea r8, [0x10007a184]
mov rcx, rdi
call fcn.100005b84
cmp eax, r12d
mov ebx, eax
jl 0x100044053
mov edx, dword [rsi]
lea r8, [rsp + 0x270]
mov rcx, rdi
call fcn.100005b84
mov ebx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x100044063
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100044073
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x10004407c
mov eax, 0x80070057
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000010b0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret