Function at 0x7ff34470830
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
xor r15d, r15d
mov dword [r11 + 8], r15d
mov rax, qword [str.lCH4]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], r15
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], r15
call fcn.7ff34470bc4
cmp dword [rbx], 1
jne 0x7ff3447089a
mov edi, dword [rbx + 0xa4]
cmp dword [rbx + 0x44], edi
cmova edi, dword [rbx + 0x44]
mov edx, dword [rbx + 0xa0]
add edx, dword [rbx + 0x40]
lea rcx, [rbx + 0xc8]
call fcn.7ff34470e70
jmp 0x7ff344708bc
mov edi, dword [rbx + 0xb4]
cmp dword [rbx + 0x54], edi
cmova edi, dword [rbx + 0x54]
mov edx, dword [rbx + 0xac]
add edx, dword [rbx + 0x4c]
lea rcx, [rbx + 0xc8]
call fcn.7ff34470e70
cmp eax, r15d
jne 0x7ff344708d6
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
mov edi, 0xc0000017
jmp 0x7ff34470a6c
lea edx, [rdi + 1]
lea rcx, [rsp + 0x58]
call fcn.7ff3444d558
mov r13, rax
mov qword [rsp + 0xc0], rax
lea edx, [rdi + rdi + 2]
mov dword [rsp + 0xb8], edx
mov esi, r15d
cmp esi, 2
jge 0x7ff34470a81
cmp dword [rbx], 1
jne 0x7ff3447091c
movsxd rax, esi
lea rcx, [rax + rax*2]
shl rcx, 5
mov r14d, dword [rcx + rbx + 0x40]
jmp 0x7ff3447092c
movsxd rax, esi
lea rcx, [rax + rax*2]
shl rcx, 5
mov r14d, dword [rcx + rbx + 0x4c]
mov r12d, r15d
cmp r12d, r14d
jae 0x7ff34470a7a
cmp dword [rbx], 1
jne 0x7ff3447095e
movsxd rax, esi
lea rcx, [rax + rax*2]
shl rcx, 5
mov r9d, edx
mov r8, r13
mov edx, r12d
mov rcx, qword [rcx + rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x7ff3447099d
mov dword [rsp + 0xb0], edx
movsxd rax, esi
lea rcx, [rax + rax*2]
shl rcx, 5
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb0]
mov r8, r13
mov edx, r12d
mov rcx, qword [rcx + rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r15d
je 0x7ff344709b7
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
mov edi, 0xc0000001
jmp 0x7ff34470a6c
mov rdx, r13
lea rcx, [rsp + 0x48]
call fcn.7ff3444d284
nop
mov edi, r15d
mov r13, r15
cmp dword [rbx + 0xd4], r15d
jle 0x7ff34470a0e
mov r15, qword [rsp + 0x48]
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rax + r13*8]
mov rcx, qword [rcx + 0x10]
mov eax, dword [rcx - 8]
sub eax, dword [r15 - 8]
jne 0x7ff344709fa
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x7ff34470a42
inc edi
inc r13
cmp edi, dword [rbx + 0xd4]
jl 0x7ff344709d9
xor r15d, r15d
movsxd rax, esi
lea rcx, [rax + rax*2]
shl rcx, 5
mov r9d, r12d
mov r8, qword [rcx + rbx + 0x10]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.7ff34470728
mov edi, eax
cmp eax, r15d
jge 0x7ff34470a45
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
jmp 0x7ff34470a6c
xor r15d, r15d
inc r12d
mov r13, qword [rsp + 0xc0]
mov edx, dword [rsp + 0xb8]
jmp 0x7ff3447092f
lea rcx, [rsp + 0x58]
call fcn.7ff3444cfe4
mov eax, edi
jmp 0x7ff34470ab4
inc esi
jmp 0x7ff344708fc
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x58]
call fcn.7ff3444cfe4
xor eax, eax
jmp 0x7ff34470ab4
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret