Function at 0x1000096c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
xor esi, esi
mov rbx, r8
mov rax, rcx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x6c], esi
cmp rcx, rsi
je 0x100009b93
cmp rdx, rsi
je 0x100009b93
cmp rbx, rsi
je 0x100009b93
cmp r9, rsi
je 0x100009b93
mov r15, qword [rsp + 0x108]
cmp r15, rsi
je 0x100009b93
mov r13d, dword [rsp + 0x100]
lea ebp, [rsi + 1]
cmp r13d, esi
je 0x100009750
cmp r13d, ebp
jne 0x10000975c
cmp dword [r15], ebp
jne 0x10000975c
xor eax, eax
jmp 0x100009ba1
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp eax, esi
je 0x1000097ac
mov ecx, eax
jmp 0x100009b9a
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x6c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp eax, esi
jne 0x1000097a5
mov ecx, dword [rsp + 0x68]
mov edx, dword [rsp + 0x6c]
cmp r13d, esi
je 0x100009807
cmp r13d, ebp
jne 0x10000981d
mov eax, dword [rsp + 0x64]
cmp dword [rsp + 0x60], eax
jne 0x100009b8b
cmp ecx, edx
jne 0x100009b8b
add edx, ebp
add ecx, ebp
mov dword [rsp + 0x6c], edx
mov dword [rsp + 0x68], ecx
cmp edx, ecx
jbe 0x100009833
mov dword [rsp + 0x68], edx
jmp 0x100009837
mov dword [rsp + 0x6c], ecx
call fcn.10000f834
mov rbp, rax
mov qword [rsp + 0x78], rax
cmp rax, rsi
jne 0x10000985c
mov ebx, 0xe
mov ecx, ebx
call fcn.100002fe8
mov eax, ebx
jmp 0x100009ba1
call fcn.10000f834
mov r14, rax
mov qword [rsp + 0x80], rax
cmp rax, rsi
jne 0x100009883
cmp dword [rbp], 9
jne 0x100009849
lea rcx, [rsp + 0x78]
call fcn.10000f8d4
jmp 0x100009849
mov ecx, dword [rsp + 0x68]
add ecx, ecx
call fcn.10000ef18
mov r12, rax
mov qword [rsp + 0x88], rax
cmp rax, rsi
jne 0x1000098b3
cmp dword [r14], 9
jne 0x100009871
lea rcx, [rsp + 0x80]
call fcn.10000f8d4
jmp 0x100009871
mov edi, esi
mov ebx, 0xe
cmp dword [rsp + 0x60], esi
jbe 0x100009932
mov r13, qword [rsp + 0xe0]
test edi, edi
jne 0x10000992a
mov eax, dword [rsp + 0x68]
mov rdi, r12
lea r9, [rsp + 0x70]
mov rcx, rax
mov dword [rsp + 0x70], eax
xor eax, eax
and qword [rsp + 0x38], rax
and qword [rsp + 0x30], rax
and qword [rsp + 0x28], rax
and qword [rsp + 0x20], rax
add rcx, rcx
mov r8, r12
rep stosb byte [rdi], al
mov rcx, r13
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x100009922
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.10000f950
cmp eax, 0xffffffff
cmove edi, ebx
inc esi
cmp esi, dword [rsp + 0x60]
jb 0x1000098c8
mov r13d, dword [rsp + 0x100]
xor esi, esi
cmp dword [rsp + 0x64], esi
jbe 0x1000099ac
mov r15, qword [rsp + 0xf0]
test edi, edi
jne 0x1000099a4
mov eax, dword [rsp + 0x6c]
mov rdi, r12
lea r9, [rsp + 0x70]
mov rcx, rax
mov dword [rsp + 0x70], eax
xor eax, eax
and qword [rsp + 0x38], rax
and qword [rsp + 0x30], rax
and qword [rsp + 0x28], rax
and qword [rsp + 0x20], rax
add rcx, rcx
mov r8, r12
rep stosb byte [rdi], al
mov rcx, r15
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x10000999c
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call fcn.10000f950
cmp eax, 0xffffffff
cmove edi, ebx
inc esi
cmp esi, dword [rsp + 0x64]
jb 0x100009942
mov r15, qword [rsp + 0x108]
lea rcx, [rsp + 0x88]
call fcn.10000ee3c
mov eax, dword [rsp + 0x60]
xor esi, esi
test eax, eax
je 0x100009a85
test edi, edi
jne 0x100009a85
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call fcn.10000f5c4
test rax, rax
jne 0x1000099e5
xor ebx, ebx
jmp 0x1000099f2
cmp dword [rax + 4], 0x20000
jne 0x1000099e1
mov rbx, qword [rax + 0x10]
and dword [rsp + 0x20], 0
mov r9d, 1
mov r8, rbx
mov edx, 0x20000
mov rcx, r14
call fcn.10000f738
mov r12d, eax
cmp eax, 0xffffffff
je 0x100009a77
mov r9, qword [rsp + 0xf8]
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call fcn.100009bbc
mov edi, eax
test eax, eax
jne 0x100009a79
mov edx, esi
mov rcx, rbp
call fcn.10000fae8
mov edx, r12d
mov rcx, r14
call fcn.10000fae8
mov eax, dword [rsp + 0x60]
or ecx, 0xffffffff
add eax, ecx
add dword [rsp + 0x64], ecx
mov dword [rsp + 0x60], eax
jmp 0x100009a7d
inc esi
mov eax, dword [rsp + 0x60]
cmp esi, eax
jb 0x1000099c7
xor ebx, ebx
test eax, eax
je 0x100009af6
mov r14, qword [rsp + 0xe0]
test edi, edi
jne 0x100009aee
xor r8d, r8d
mov edx, ebx
mov rcx, rbp
call fcn.10000f5c4
test rax, rax
jne 0x100009aae
xor r8d, r8d
jmp 0x100009abb
cmp dword [rax + 4], 0x20000
jne 0x100009aa9
mov r8, qword [rax + 0x10]
cmp r13d, 3
je 0x100009ac7
cmp r13d, 4
jne 0x100009adf
mov rdx, qword [rsp + 0xe8]
mov r9d, 1
mov rcx, r14
call fcn.100009fac
mov edi, eax
inc ebx
mov dword [r15], 1
cmp ebx, dword [rsp + 0x60]
jb 0x100009a93
mov r14, qword [rsp + 0x80]
xor ebx, ebx
cmp dword [rsp + 0x64], ebx
jbe 0x100009b66
mov rbp, qword [rsp + 0xf0]
test edi, edi
jne 0x100009b61
xor r8d, r8d
mov edx, ebx
mov rcx, r14
call fcn.10000f5c4
test rax, rax
jne 0x100009b21
xor r8d, r8d
jmp 0x100009b2e
cmp dword [rax + 4], 0x20000
jne 0x100009b1c
mov r8, qword [rax + 0x10]
cmp r13d, 3
je 0x100009b3a
cmp r13d, 4
jne 0x100009b52
mov rdx, qword [rsp + 0xf8]
mov r9d, 2
mov rcx, rbp
call fcn.100009fac
mov edi, eax
inc ebx
mov dword [r15], 1
cmp ebx, dword [rsp + 0x64]
jb 0x100009b06
mov rbp, qword [rsp + 0x78]
cmp dword [rbp], 9
jne 0x100009b76
lea rcx, [rsp + 0x78]
call fcn.10000f8d4
cmp dword [r14], 9
jne 0x100009b98
lea rcx, [rsp + 0x80]
call fcn.10000f8d4
jmp 0x100009b98
mov dword [r15], ebp
jmp 0x100009755
mov edi, 0x57
mov ecx, edi
call fcn.100002fe8
mov eax, edi
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret