Function at 0x4373b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
test rsi, rsi
jne 0x437520
xor rsi, rsi
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x27e]
mov r9d, 0x20a
call sub.advapi32.dll_RegEnumKeyW
mov edi, eax
test edi, edi
je 0x437404
cmp edi, 0x103
jne 0x43751a
xor rdi, rdi
jmp 0x43751a
cmp word [rbp + 0x27e], 0x2e
je 0x4374fb
lea rcx, [rbp + 0x27e]
call fcn.00426d10
mov r13d, eax
lea rcx, [rbp + 0x27e]
lea rdx, [0x0043768c]
call fcn.00426d50
lea rcx, [rbp + 0x74]
lea rdx, [0x004376b4]
call fcn.00426d30
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
jne 0x4374af
mov r13d, r13d
mov word [rbp + r13*2 + 0x27e], 0
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x004376f4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
mov rcx, qword [rbp + 0x488]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
jne 0x4374fb
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
lea rax, [rbp + 0x27e]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x004376f6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042c130
mov rax, qword [0x0044d3e8]
cmp dword [rax], 0
je 0x437512
mov eax, 1
jmp 0x43767b
add esi, 1
jmp 0x4373d2
nop
jmp 0x437679
cmp word [rsi], 0x2e
jne 0x437552
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437714]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440100
mov eax, 0x7b
jmp 0x43767b
mov rcx, rsi
xor rdx, rdx
call fcn.00440b90
mov rsi, rax
mov rcx, rsi
mov dx, 0x20
call fcn.00426ca0
test rax, rax
je 0x437576
mov word [rax], 0
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [rbp + 0x27e]
lea rdx, [0x00437798]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00426e70
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x4375dc
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437714]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440100
mov eax, edi
jmp 0x43767b
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x004376f4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x437658
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x004376f6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042c130
jmp 0x437679
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437714]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00440100
mov eax, edi
lea rsp, [rbp + 0x490]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret