Function at 0x100008e70
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xc8
mov rax, rdx
xor edx, edx
mov rbx, r8
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x64], edx
mov dword [rsp + 0x74], edx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], rdx
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x68], edx
mov qword [r11 - 0x40], rdx
mov qword [r11 - 0x48], rdx
cmp rcx, rdx
je 0x1000096a3
cmp rax, rdx
je 0x1000096a3
cmp rbx, rdx
je 0x1000096a3
cmp r9, rdx
je 0x1000096a3
mov rbp, qword [rsp + 0x120]
cmp rbp, rdx
je 0x1000096a3
mov esi, dword [rsp + 0x110]
mov rdx, rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
call fcn.1000096c4
mov edi, eax
xor eax, eax
cmp dword [rsp + 0x118], eax
je 0x1000096a8
cmp edi, eax
jne 0x1000096a8
cmp esi, eax
je 0x100008f29
cmp esi, 1
jne 0x100008f33
cmp dword [rbp], 1
je 0x1000096b1
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ecx, ecx
mov edi, eax
cmp eax, ecx
je 0x100008f8a
mov ecx, eax
jmp 0x1000096aa
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x64], ecx
je 0x100008fa3
cmp eax, ecx
jne 0x100008fa3
mov edi, 0x100
mov dword [rsp + 0x60], edi
jmp 0x100008fb2
mov edi, 0x100
cmp eax, edi
jae 0x100008fb2
add eax, eax
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
je 0x100009009
mov ecx, eax
call fcn.100002fe8
mov eax, ebx
jmp 0x1000096b1
mov edx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x68]
test edx, edx
je 0x10000901d
test eax, eax
jne 0x10000901d
mov eax, edi
jmp 0x100009023
cmp eax, edi
jae 0x100009023
add eax, eax
mov ecx, dword [rsp + 0x60]
test esi, esi
je 0x100009030
cmp esi, 1
jne 0x100009042
cmp dword [rsp + 0x64], edx
jne 0x100009698
cmp ecx, eax
jne 0x100009698
inc eax
inc ecx
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
cmp eax, ecx
jbe 0x100009058
mov dword [rsp + 0x60], eax
jmp 0x10000905c
mov dword [rsp + 0x68], ecx
call fcn.10000f834
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x10000907a
mov ebx, 0xe
mov ecx, ebx
jmp 0x100008ffd
call fcn.10000f834
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x1000090a3
cmp dword [rdi], 9
jne 0x100009071
lea rcx, [rsp + 0x88]
call fcn.10000f8d4
jmp 0x100009071
mov ecx, dword [rsp + 0x60]
add ecx, ecx
call fcn.10000ef18
xor r8d, r8d
mov rbp, rax
mov qword [rsp + 0xb8], rax
cmp rax, r8
jne 0x1000090d5
cmp dword [rbx], 9
jne 0x10000908f
lea rcx, [rsp + 0x80]
call fcn.10000f8d4
jmp 0x10000908f
mov edx, r8d
mov edi, r8d
mov dword [rsp + 0x6c], r8d
mov ebx, 0xe
mov dword [rsp + 0x70], edx
cmp dword [rsp + 0x64], r8d
jbe 0x100009179
mov rsi, qword [rsp + 0x88]
cmp edi, r8d
jne 0x10000916e
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov rcx, rax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x28], r8
add rcx, rcx
xor eax, eax
mov qword [rsp + 0x20], r8
mov rdi, rbp
lea r9, [rsp + 0x78]
mov r8, rbp
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor r8d, r8d
mov edi, eax
cmp eax, r8d
jne 0x10000915e
mov rdx, rbp
mov rcx, rsi
call fcn.10000f950
cmp eax, 0xffffffff
cmove edi, ebx
xor r8d, r8d
mov edx, dword [rsp + 0x70]
inc edx
mov dword [rsp + 0x70], edx
cmp edx, dword [rsp + 0x64]
jb 0x1000090fc
mov esi, dword [rsp + 0x110]
mov dword [rsp + 0x6c], edi
cmp dword [rsp + 0x74], r8d
jbe 0x1000091ff
mov esi, r8d
cmp edi, r8d
jne 0x1000091f4
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov rcx, rax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x28], r8
add rcx, rcx
xor eax, eax
mov qword [rsp + 0x20], r8
mov rdi, rbp
lea r9, [rsp + 0x78]
mov edx, esi
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x100]
mov r8, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor r8d, r8d
mov edi, eax
cmp eax, r8d
jne 0x1000091ec
mov rcx, qword [rsp + 0x80]
mov rdx, rbp
call fcn.10000f950
cmp eax, 0xffffffff
cmove edi, ebx
xor r8d, r8d
inc esi
cmp esi, dword [rsp + 0x74]
jb 0x100009183
mov esi, dword [rsp + 0x110]
mov dword [rsp + 0x6c], edi
lea rcx, [rsp + 0xb8]
call fcn.10000ee3c
test edi, edi
jne 0x100009285
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
mov eax, dword [rsp + 0x60]
lea ecx, [rax + rdx + 5]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
mov eax, dword [rsp + 0x68]
lea ecx, [rax + rdx + 5]
mov dword [rsp + 0x68], ecx
mov ecx, dword [rsp + 0x60]
add ecx, ecx
call fcn.10000ef18
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x100009268
mov edi, ebx
mov dword [rsp + 0x6c], ebx
jmp 0x100009285
mov ecx, dword [rsp + 0x68]
add ecx, ecx
call fcn.10000ef18
test rax, rax
mov qword [rsp + 0xa0], rax
cmove edi, ebx
mov dword [rsp + 0x6c], edi
xor eax, eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x64], eax
jbe 0x100009510
mov rbx, qword [rsp + 0x88]
test edi, edi
jne 0x100009510
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.10000f5c4
test rax, rax
jne 0x1000092bb
xor ebp, ebp
jmp 0x1000092c8
cmp dword [rax + 4], 0x20000
jne 0x1000092b7
mov rbp, qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
and dword [rsp + 0x20], 0
mov r9d, 1
mov r8, rbp
mov edx, 0x20000
call fcn.10000f738
mov dword [rsp + 0xb4], eax
cmp eax, 0xffffffff
je 0x1000094fa
cmp esi, 4
je 0x100009302
cmp esi, 2
jne 0x100009318
mov rcx, qword [rsp + 0xf8]
mov r8d, 3
mov rdx, rbp
call fcn.100009ec8
mov rdi, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0xf8]
mov rcx, rdi
call fcn.10000e668
mov r8d, dword [rsp + 0x60]
lea rdx, [0x100001440]
mov rcx, rdi
call fcn.10000e710
mov r8d, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
call fcn.10000e710
mov rdi, qword [rsp + 0xa0]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x108]
mov rcx, rdi
call fcn.10000e668
mov r8d, dword [rsp + 0x68]
lea rdx, [0x100001440]
mov rcx, rdi
call fcn.10000e710
mov r8d, dword [rsp + 0x68]
mov rdx, rbp
mov rcx, rdi
call fcn.10000e710
mov eax, dword [rsp + 0x130]
lea rcx, [rsp + 0x90]
or eax, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xf0]
mov r9d, eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0xb0], eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov dword [rsp + 0x6c], eax
test eax, eax
jne 0x100009510
mov r9d, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x100]
lea rax, [rsp + 0x98]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov dword [rsp + 0x6c], eax
test eax, eax
jne 0x100009510
mov eax, dword [rsp + 0x128]
mov ecx, dword [rsp + 0x130]
mov rbp, qword [rsp + 0x120]
mov r9, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa8]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x90]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x118]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
call fcn.100008e70
mov rcx, qword [rsp + 0x90]
mov edi, eax
mov dword [rsp + 0x6c], eax
test rcx, rcx
je 0x100009491
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1000094ad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x98], 0
test edi, edi
jne 0x1000094dc
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.10000fae8
mov edx, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x80]
call fcn.10000fae8
or eax, 0xffffffff
add dword [rsp + 0x64], eax
add dword [rsp + 0x74], eax
cmp dword [rbp], 1
jne 0x1000094eb
test esi, esi
je 0x100009506
cmp esi, 1
je 0x100009506
mov eax, dword [rsp + 0x70]
cmp eax, dword [rsp + 0x64]
jae 0x100009510
jmp 0x10000929d
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
jmp 0x1000094ef
and dword [rsp + 0x64], 0
and dword [rsp + 0x74], 0
mov rbp, qword [rsp + 0x120]
xor ebx, ebx
movsxd rax, edi
mov qword [rsp + 0xf0], rax
cmp dword [rsp + 0x64], ebx
jbe 0x100009593
mov rdi, qword [rsp + 0x88]
test rax, rax
jne 0x10000958f
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
call fcn.10000f5c4
test rax, rax
jne 0x10000954e
xor edx, edx
jmp 0x10000955b
cmp dword [rax + 4], 0x20000
jne 0x10000954a
mov rdx, qword [rax + 0x10]
cmp esi, 3
je 0x100009565
cmp esi, 4
jne 0x100009578
mov rcx, qword [rsp + 0xf8]
mov r8d, 1
call fcn.100009ec8
mov rax, qword [rsp + 0xf0]
inc ebx
mov dword [rbp], 1
cmp ebx, dword [rsp + 0x64]
jb 0x100009533
mov edi, dword [rsp + 0x6c]
xor ebx, ebx
cmp dword [rsp + 0x74], ebx
jbe 0x100009603
mov rdi, qword [rsp + 0x80]
test rax, rax
jne 0x1000095ff
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
call fcn.10000f5c4
test rax, rax
jne 0x1000095be
xor edx, edx
jmp 0x1000095cb
cmp dword [rax + 4], 0x20000
jne 0x1000095ba
mov rdx, qword [rax + 0x10]
cmp esi, 3
je 0x1000095d5
cmp esi, 4
jne 0x1000095e8
mov rcx, qword [rsp + 0x108]
mov r8d, 2
call fcn.100009ec8
mov rax, qword [rsp + 0xf0]
inc ebx
mov dword [rbp], 1
cmp ebx, dword [rsp + 0x74]
jb 0x1000095a3
mov edi, dword [rsp + 0x6c]
lea rcx, [rsp + 0xb8]
call fcn.10000ee3c
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x10000962c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x100009648
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x98], 0
lea rcx, [rsp + 0xa8]
call fcn.10000ee3c
lea rcx, [rsp + 0xa0]
call fcn.10000ee3c
mov rax, qword [rsp + 0x88]
cmp dword [rax], 9
jne 0x10000967c
lea rcx, [rsp + 0x88]
call fcn.10000f8d4
mov rax, qword [rsp + 0x80]
cmp dword [rax], 9
jne 0x1000096a8
lea rcx, [rsp + 0x80]
call fcn.10000f8d4
jmp 0x1000096a8
mov dword [rbp], 1
xor eax, eax
jmp 0x1000096b1
mov edi, 0x57
mov ecx, edi
call fcn.100002fe8
mov eax, edi
add rsp, 0xc8
pop rdi
pop rsi
pop rbp
pop rbx
ret