Function at 0x100039098
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebp, ebp
mov r13, rdx
mov r15, rcx
cmp rdx, rbp
je 0x1000395fd
mov rcx, rdx
call fcn.100030aa8
or esi, 0xffffffff
cmp eax, esi
jne 0x1000395fd
lea ecx, [rbp + 0x70]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, rbp
je 0x1000390fd
lea rcx, [rax + 0x40]
call fcn.10002fbf0
lea rcx, [rbx + 0x50]
call fcn.10002fbf0
lea rcx, [rbx + 0x60]
call fcn.10002fbf0
jmp 0x100039100
mov rbx, rbp
mov qword [rsp + 0x38], rbx
cmp rbx, rbp
je 0x1000395fd
lea rdx, [0x100025780]
mov rcx, rbx
mov r8d, 0x40
call sub.msvcrt.dll_memcpy
lea rcx, [rbx + 0x40]
mov r8d, esi
mov rdx, r13
call fcn.10002fd60
cmp eax, ebp
jge 0x10003915e
lea rcx, [rbx + 0x60]
call fcn.100030020
lea rcx, [rbx + 0x50]
call fcn.100030020
lea rcx, [rbx + 0x40]
call fcn.100030020
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1000395fd
mov rax, qword [rbx + 0x40]
lea rcx, [rsp + 0x60]
mov qword [rbx], rax
call fcn.10002fbf0
lea rdx, [0x100024528]
lea rcx, [rsp + 0x60]
mov r8d, esi
call fcn.10002fd60
lea rcx, [rsp + 0x60]
mov r8d, esi
mov rdx, r13
call fcn.10002fe84
mov r12, qword [rsp + 0x60]
mov eax, ebp
cmp r12, rbp
je 0x1000391a7
cmp word [r12], bp
setne al
lea r14, [0x10001fd00]
cmp al, bpl
je 0x100039368
lea rcx, [rsp + 0x50]
call fcn.10002fbf0
lea rcx, [rsp + 0x50]
call fcn.100030020
cmp r12, rbp
je 0x1000391eb
lea r9, [0x1000257c0]
lea rcx, [rsp + 0x50]
mov r8, r12
mov rdx, 0xffffffff80000000
call fcn.100030254
mov rsi, qword [rsp + 0x50]
mov eax, ebp
cmp rsi, rbp
je 0x1000391fd
cmp word [rsi], bp
setne al
cmp al, bpl
je 0x100039250
lea rdx, [0x1000256a0]
mov rcx, rsi
call fcn.10002fba4
cmp al, bpl
je 0x10003921d
mov edi, 2
jmp 0x10003924d
cmp rsi, rbp
je 0x100039250
mov edi, ebp
mov rbp, r14
mov rdx, qword [rbp]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100039246
inc edi
add rbp, 0x18
cmp edi, 6
jb 0x100039227
or edi, 0xffffffff
xor ebp, ebp
cmp edi, 0xffffffff
je 0x100039250
mov dword [rbx + 0x18], edi
lea rcx, [rsp + 0x40]
call fcn.10002fbf0
lea rcx, [rsp + 0x40]
call fcn.100030020
cmp r12, rbp
je 0x100039284
lea r9, [0x1000257e0]
lea rcx, [rsp + 0x40]
mov r8, r12
mov rdx, 0xffffffff80000000
call fcn.100030254
mov rdi, qword [rsp + 0x40]
mov eax, ebp
cmp rdi, rbp
je 0x100039296
cmp word [rdi], bp
setne al
cmp al, bpl
je 0x100039351
mov rsi, rdi
cmp rdi, rbp
je 0x100039307
cmp word [rdi], bp
je 0x1000392c1
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rsi], ax
add rsi, 2
cmp word [rsi], bp
jne 0x1000392ac
mov edx, 0x2f
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rsi, rax
cmp rax, rbp
je 0x1000392df
sub rsi, rdi
sar rsi, 1
jmp 0x1000392e2
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x100039307
lea rbp, [rbx + 0x50]
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call fcn.10002fd60
movsxd r11, esi
lea rcx, [rbx + 0x60]
lea rdx, [rdi + r11*2 + 2]
jmp 0x100039311
lea rbp, [rbx + 0x50]
mov rdx, rdi
mov rcx, rbp
or r8d, 0xffffffff
call fcn.10002fd60
mov rcx, qword [rbp]
xor edx, edx
mov eax, edx
cmp rcx, rdx
je 0x10003932d
cmp word [rcx], dx
setne al
cmp al, dl
je 0x100039335
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x60]
xor ebp, ebp
mov eax, ebp
cmp rcx, rbp
je 0x100039348
cmp word [rcx], bp
setne al
cmp al, bpl
je 0x100039351
mov qword [rbx + 0x10], rcx
lea rcx, [rsp + 0x40]
call fcn.100030020
lea rcx, [rsp + 0x50]
call fcn.100030020
or esi, 0xffffffff
mov eax, ebp
cmp r12, rbp
je 0x100039377
cmp word [r12], bp
setne al
cmp al, bpl
je 0x100039538
lea rcx, [rsp + 0x50]
call fcn.10002fbf0
lea rdx, [0x100025800]
lea rcx, [rsp + 0x50]
mov r8d, esi
call fcn.10002fd60
lea rcx, [rsp + 0x50]
mov r8d, esi
mov rdx, r12
call fcn.10002fe84
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rsi, rbp
mov qword [rsp + 0x40], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000394e6
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
lea rdx, [0x100024928]
mov edi, 4
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc0], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xc0]
cmp r11d, 0x10
jae 0x10003943d
mov dword [rbx + 0x30], r11d
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea rdx, [0x100024b00]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0xb8], ebp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xb8]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and r11d, 0x9f
lea rax, [rsp + 0xc8]
mov dword [rsp + 0xb8], r11d
mov dword [rbx + 0x38], r11d
lea rdx, [0x100024c98]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0xc8], 0x3000
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xc8]
mov dword [rbx + 0x34], r11d
jmp 0x100039520
mov rcx, qword [rbx + 0x50]
lea rdx, [0x1000256a0]
call fcn.10002fba4
cmp al, bpl
jne 0x10003950b
cmp dword [rbx + 0x18], 2
je 0x10003950b
mov edi, 4
mov dword [rbx + 0x30], edi
jmp 0x100039519
mov dword [rbx + 0x30], 0xb
mov dword [rbx + 0x34], 0x3800
mov dword [rbx + 0x38], 0x97
cmp rsi, rbp
je 0x10003952e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x50]
call fcn.100030020
lea rcx, [rsp + 0x50]
call fcn.10002fbf0
lea rcx, [rsp + 0x50]
call fcn.100030020
lea r8, [0x100025870]
lea rcx, [rsp + 0x50]
mov r9, r13
mov rdx, 0xffffffff80000002
call fcn.100030254
mov rsi, qword [rsp + 0x50]
mov eax, ebp
cmp rsi, rbp
je 0x100039579
cmp word [rsi], bp
setne al
cmp al, bpl
je 0x1000395ab
cmp rsi, rbp
je 0x1000395ab
mov edi, ebp
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
je 0x1000395a3
inc edi
add r14, 0x18
cmp edi, 6
jb 0x100039585
or edi, 0xffffffff
cmp edi, 0xffffffff
je 0x1000395ab
mov dword [rbx + 0x1c], edi
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.1000397e0
cmp eax, ebp
jge 0x1000395e9
mov rbx, qword [rsp + 0x38]
cmp rbx, rbp
je 0x1000395e9
lea rcx, [rbx + 0x60]
call fcn.100030020
lea rcx, [rbx + 0x50]
call fcn.100030020
lea rcx, [rbx + 0x40]
call fcn.100030020
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x50]
call fcn.100030020
lea rcx, [rsp + 0x60]
call fcn.100030020
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret