Function at 0x402bb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
cmp word [r8], 0
mov qword [rsp + 0x130], r8
mov rdi, rcx
mov rbp, rdx
mov rax, r8
mov dword [rsp + 0x138], r9d
je 0x4034eb
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x402bf0
sub rax, qword [rsp + 0x130]
sar rax, 1
lea ecx, [rax + 7]
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
movsxd rcx, ecx
mov qword [rsp + 0x88], rax
add rcx, rcx
call rax
mov r12, rax
mov rax, qword [rsp + 0x130]
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x402c30
sub rax, qword [rsp + 0x130]
sar rax, 1
lea edx, [rax + 7]
movsxd rdx, edx
mov r9, qword [rsp + 0x130]
lea r8, str._r_n__s__r_n
mov rcx, r12
call sym.swprintf
cmp word [r12], 0
je 0x40350e
mov r8, r12
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x402c78
sub r8d, r12d
and r8d, 0xfffffffe
lea rax, [rsp + 0xc8]
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov r9, rax
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r12
mov qword [rsp + 0x78], rax
call rax
mov rsi, qword [rsp + 0x88]
mov ecx, 0x200
call rsi
mov ecx, 0x800
mov r13, rax
call rsi
mov dword [rsp + 0x4c], 0x100
xor esi, esi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xc4]
mov dword [rsp + 0xa0], 0x800
mov qword [rsp + 0x98], rax
nop word [rax + rax]
mov eax, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x60]
mov r8, r13
mov edx, esi
mov qword [rsp + 0x20], 0
mov rcx, rbp
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
call qword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
je 0x402dd0
cmp eax, 0xea
jne 0x403338
mov ebx, dword [rsp + 0xbc]
cmp ebx, dword [rsp + 0xa0]
jbe 0x4031a8
mov rcx, qword [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.ucrtbase.dll_realloc]
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0x40], rax
jmp 0x402d38
mov r15d, dword [rsp + 0xbc]
lea rdx, [0x00409140]
mov ebx, dword [rsp + 0xc0]
mov rax, rdx
mov r14, r15
test r13, r13
je 0x402e00
cmp word [r13], 0
jne 0x403258
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x402e00
sub rax, rdx
lea rdx, [0x00409140]
sar rax, 1
mov r8, rdx
cdqe
mov qword [rsp + 0xc8], rax
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x402e28
sub r8d, edx
mov r9, qword [rsp + 0x98]
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
and r8d, 0xfffffffe
lea rdx, [0x00409140]
call rax
mov r10, qword [rsp + 0xc8]
cmp ebx, 1
je 0x4030b0
cmp ebx, 4
je 0x4031c8
mov dword [rsp + 0x80], r10d
cmp ebx, 3
jne 0x4031d9
lea rax, [0x00409146]
mov r10, rax
nop dword [rax]
add r10, 2
cmp word [r10], 0
jne 0x402e98
sub r10, rax
lea rax, [0x00409146]
sar r10, 1
mov r8, rax
movsxd rbx, r10d
nop word cs:[rax + rax]
add r8, 2
cmp word [r8], 0
jne 0x402ec0
sub r8d, eax
mov r9, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
and r8d, 0xfffffffe
lea rdx, [0x00409146]
call rax
test r14d, r14d
je 0x403157
mov r10d, dword [rsp + 0x80]
lea ecx, [r14 + r14*2]
mov rax, qword [rsp + 0x88]
sub r14d, 1
add rcx, rcx
add r10d, ebx
mov dword [rsp + 0x90], r10d
call rax
mov rcx, r14
xor r14d, r14d
mov r10d, dword [rsp + 0x90]
mov r12, rax
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0xa4], esi
mov qword [rsp + 0xa8], r13
mov r13, r14
mov r14, qword [rsp + 0x58]
add r15, rax
add rcx, rax
mov qword [rsp + 0x128], rbp
mov rbx, rax
mov qword [rsp + 0x80], r15
mov rsi, rcx
lea r15, str._02x
mov ebp, r10d
jmp 0x402f92
add rbx, 1
cmp qword [rsp + 0x80], rbx
je 0x403080
movzx r9d, byte [rbx]
lea rcx, [r12 + r13*2]
mov r8, r15
mov edx, 3
call sym.swprintf
cdqe
add rax, r13
cmp rsi, rbx
je 0x403080
mov edx, 0x2c
xor ecx, ecx
lea r13, [rax + 1]
add ebp, 3
mov word [r12 + rax*2], dx
mov word [r12 + rax*2 + 2], cx
cmp ebp, 0x4c
jbe 0x402f80
cmp word [r12], 0
je 0x4034d3
mov r8, r12
nop word [rax + rax]
add r8, 2
cmp word [r8], 0
jne 0x402fe8
sub r8d, r12d
and r8d, 0xfffffffe
mov rax, qword [rsp + 0x50]
mov r9, r14
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rax
lea r8, str._r_n
nop word [rax + rax]
add r8, 2
cmp word [r8], 0
jne 0x403020
lea rax, str._r_n
mov r9, r14
mov rcx, rdi
xor r13d, r13d
mov qword [rsp + 0x90], rax
sub r8d, dword [rsp + 0x90]
mov rdx, rax
add rbx, 1
mov rax, qword [rsp + 0x50]
and r8d, 0xfffffffe
mov ebp, 2
mov qword [rsp + 0x20], 0
call rax
cmp qword [rsp + 0x80], rbx
jne 0x402f92
nop dword [rax]
cmp word [r12], 0
mov esi, dword [rsp + 0xa4]
mov r8, r12
mov r13, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0x128]
jne 0x403120
xor r8d, r8d
jmp 0x403132
mov rax, r15
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
shr rax, 1
sub rax, 1
test r15, r15
cmovne r15, rax
mov rdx, r15
call sym.escape_string
mov r14, rax
mov rax, qword [rsp + 0xc8]
lea r15, [rax + 3]
mov rax, qword [rsp + 0x88]
lea rcx, [r15 + r15]
call rax
mov r9, r14
lea r8, [0x00409180]
mov rdx, r15
mov rcx, rax
mov r12, rax
call sym.swprintf
mov rax, qword [rsp + 0x78]
mov rcx, r14
call rax
cmp word [r12], 0
mov r8, r12
je 0x4030a2
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x403120
sub r8d, r12d
and r8d, 0xfffffffe
mov rcx, rdi
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, r12
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x78]
mov rcx, r12
call rax
lea rax, [0x0040915c]
mov r8, rax
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x403168
sub r8d, eax
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], 0
and r8d, 0xfffffffe
lea rdx, [0x0040915c]
add esi, 1
call rax
jmp 0x402d38
shl dword [rsp + 0x4c], 1
mov edx, dword [rsp + 0x4c]
mov rcx, r13
add rdx, rdx
call qword [sym.imp.ucrtbase.dll_realloc]
mov r13, rax
jmp 0x402d38
mov dword [rsp + 0x80], r10d
test r15, r15
jne 0x4034a0
mov ecx, 0x1e
mov rax, qword [rsp + 0x88]
call rax
mov r9d, ebx
lea r8, str.hex__x_:
mov edx, 0xf
mov r12, rax
mov rcx, rax
call sym.swprintf
cmp word [r12], 0
movsxd rbx, eax
je 0x4034db
mov r8, r12
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x403218
sub r8d, r12d
and r8d, 0xfffffffe
mov rcx, rdi
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, r12
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x78]
mov rcx, r12
call rax
jmp 0x402ef1
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0xb8]
mov rcx, r13
call sym.escape_string
mov r12, rax
mov rax, qword [rsp + 0xc8]
lea rdx, [rax + 4]
mov rax, qword [rsp + 0x88]
lea rcx, [rdx + rdx]
mov qword [rsp + 0x80], rdx
call rax
mov rdx, qword [rsp + 0x80]
mov r9, r12
lea r8, [0x00409174]
mov rcx, rax
mov qword [rsp + 0x80], rax
call sym.swprintf
mov r10, qword [rsp + 0x80]
cdqe
cmp word [r10], 0
mov qword [rsp + 0xc8], rax
je 0x4034e3
mov r8, r10
nop dword [rax + rax]
add r8, 2
cmp word [r8], 0
jne 0x4032d8
sub r8d, r10d
and r8d, 0xfffffffe
mov rdx, r10
mov qword [rsp + 0x80], r10
mov rcx, rdi
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x98]
mov qword [rsp + 0x20], 0
call rax
mov r10, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rcx, r10
call rax
mov rax, qword [rsp + 0x78]
mov rcx, r12
call rax
jmp 0x402e5c
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x78]
call rsi
mov rcx, r13
call rsi
mov rax, qword [rsp + 0x88]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0x130]
cmp word [rax], 0
je 0x403516
mov rbx, rax
add rbx, 2
cmp word [rbx], 0
jne 0x403370
sub rbx, qword [rsp + 0x130]
sar rbx, 1
mov r15d, dword [rsp + 0x138]
mov qword [rsp + 0x120], rdi
xor esi, esi
mov r13, qword [sym.imp.advapi32.dll_RegEnumKeyExW]
mov r14, qword [rsp + 0x98]
or r15d, 0x20019
mov dword [rsp + 0xc4], 0x101
mov r9, r14
mov r8, r12
mov edx, esi
mov qword [rsp + 0x38], 0
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r13
test eax, eax
jne 0x403480
mov r9d, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x130]
mov r8, r12
mov edx, ebx
call sym.build_subkey_path
xor r8d, r8d
mov r9d, r15d
mov rdx, r12
mov rdi, rax
mov rax, qword [rsp + 0x58]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x403448
mov rax, qword [rsp + 0x78]
mov rcx, rdi
add esi, 1
call rax
jmp 0x4033ad
mov rcx, qword [rsp + 0x120]
mov r9d, dword [rsp + 0x138]
mov r8, rdi
mov rdx, qword [rsp + 0xc8]
call sym.export_registry_data
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x40342f
mov rax, qword [rsp + 0x78]
mov rcx, r12
call rax
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x88]
mov ecx, 0x1e
call rax
lea r8, str.dword:_08x
mov edx, 0xf
mov r12, rax
mov rax, qword [rsp + 0x40]
mov rcx, r12
mov r9d, dword [rax]
call sym.swprintf
jmp 0x403112
xor r8d, r8d
jmp 0x402ffa
xor r8d, r8d
jmp 0x40322a
xor r8d, r8d
jmp 0x4032ea
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov ecx, 0xe
mov qword [rsp + 0x88], rax
call rax
mov edx, 7
mov r12, rax
jmp 0x402c4b
xor r8d, r8d
jmp 0x402c8a
xor ebx, ebx
jmp 0x403385