Function at 0x10000286c
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
mov rbp, rdx
lea rax, [rsp + 0x40]
mov esi, ecx
lea rdx, [0x100001380]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000291b
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x100001418]
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10000291b
cmp dword [rsp + 0x38], 4
jne 0x10000291b
cmp dword [rsp + 0x34], 4
jne 0x10000291b
mov ebx, dword [rsp + 0x30]
xor edi, edi
jmp 0x100002926
xor ebx, ebx
mov edi, 0xc0000001
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100002940
cmp rcx, 0xffffffffffffffff
je 0x100002940
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x30]
test edi, edi
jns 0x100002966
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, 0x5de
xor ecx, ecx
mov r8d, eax
mov ebx, eax
call fcn.1000016ec
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test ebx, ebx
jne 0x100002987
mov ebx, 0x1f
mov edx, 0x5de
xor ecx, ecx
mov r8d, ebx
call fcn.1000016ec
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.100002708
mov edi, eax
test eax, eax
je 0x1000029aa
mov r8d, eax
mov edx, 0x5de
xor ecx, ecx
call fcn.1000016ec
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x100006720], ebx
mov dword [0x100006724], ebx
mov ebx, 1
cmp esi, ebx
jle 0x100002a34
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9d, [rbx + 3]
lea r8, [0x100006778]
mov rcx, rax
mov edx, 0x5e9
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9d, [rbx + 3]
lea r8, [0x100006788]
mov rcx, rax
mov edx, 0x5ea
call qword [sym.imp.USER32.dll_LoadStringW]
mov r11, qword [rbp + 8]
cmp word [r11], 0x2d
je 0x100002a13
cmp word [r11], 0x2f
jne 0x100002a34
movzx ecx, word [r11 + 2]
call qword [sym.imp.msvcrt.dll_towupper]
mov ecx, dword [0x100006728]
cmp ax, word [0x100006778]
cmove ecx, ebx
mov dword [0x100006728], ecx
cmp dword [0x100006728], 0
je 0x100002a8c
cmp dword [0x100006724], ebx
jne 0x100002a4c
call fcn.10000265c
jmp 0x100002ab1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov rcx, rax
mov edx, 0x5eb
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, [rsp + 0x50]
lea rdx, [0x100001378]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
jmp 0x100002ab1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and qword [rsp + 0x20], 0
xor r8d, r8d
lea edx, [r8 + 0x64]
lea r9, [0x1000024a4]
mov rcx, rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000038f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret