Function at 0x10004670c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x100046b48
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x4a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x490], rax
and qword [rsp + 0x60], 0
and dword [rsp + 0x50], 0
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x10004675e
test r8, r8
je 0x100046b22
mov r9, rcx
mov r13d, 0x103
lea r8, [0x100020670]
lea rcx, [rsp + 0x70]
mov rdx, r13
call fcn.10002e570
test eax, eax
js 0x100046b22
lea r9, [0x10001edf0]
lea r8, [0x100027298]
lea rcx, [rsp + 0x280]
mov rdx, r13
mov qword [rsp + 0x20], rdi
call fcn.10002e570
mov r13d, 1
test eax, eax
js 0x100046851
mov rcx, qword [0x10004d400]
and qword [rsp + 0x58], rbx
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x280]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100046851
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x280]
lea rdx, [0x1000204b0]
xor r8d, r8d
mov dword [rsp + 0x50], 0x208
mov dword [rsp + 0x54], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100046846
cmp dword [rsp + 0x54], r13d
jne 0x100046846
lea rdx, [0x10001c8c0]
lea rcx, [rsp + 0x280]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
cmove ebx, r13d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100046b22
or r14, 0xffffffffffffffff
mov dword [rsp + 0x54], r13d
test rsi, rsi
je 0x100046adc
lea eax, [r14 + 0x7c]
cmp ax, word [rsi]
jne 0x100046adc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x100001da8]
xor r8d, r8d
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100046992
cmp dword [rsp + 0x54], r13d
jne 0x100046992
test ebx, ebx
jne 0x100046945
lea rcx, [rsp + 0x70]
mov edx, r13d
call fcn.100046468
test eax, eax
jne 0x100046945
lea rdx, [0x1000271d0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100046945
lea rdx, [0x100027220]
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1000469c8
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.100046468
test eax, eax
jne 0x100046992
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r14
repne scasw ax, word [rdi]
lea rdx, [0x100027270]
mov r9d, r13d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100001da8]
mov r9d, r13d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and qword [rsp + 0x68], 0
lea r8, [0x1000272c0]
lea rcx, [rsp + 0x70]
mov r9, rsi
mov edx, 0x103
call fcn.10002e570
lea rdx, [rsp + 0x68]
mov rdi, 0xffffffff80000000
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x70]
mov r9d, r13d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100046adc
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100046ad1
cmp dword [rsp + 0x54], r13d
jne 0x100046ad1
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100046ad1
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 4]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [0x1000272e0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r13d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x100046b17
xor eax, eax
mov rcx, r14
mov rdi, rbp
repne scasw ax, word [rdi]
lea rdx, [0x1000206b0]
mov r9d, r13d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x4e8]
add rsp, 0x4a0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret