Function at 0x100007260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x3b0
mov rax, qword [0x10000a100]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov eax, dword [rcx + 4]
xor r14d, r14d
mov ebp, edx
sub eax, 1
mov rsi, rcx
mov ebx, r14d
je 0x1000072c1
sub eax, 1
je 0x1000072cb
cmp eax, 2
jne 0x1000072cb
cmp edx, r14d
jne 0x1000072d4
test byte [rcx], 1
jne 0x1000072ba
test byte [rcx], al
je 0x1000074da
mov ebx, 1
jmp 0x1000072d4
mov ebx, dword [rcx]
shl ebx, 0x1f
sar ebx, 0x1f
jne 0x1000072d4
cmp edx, r14d
je 0x1000074da
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rcx, [0x100002a08]
lea r12, [0x1000029b8]
cmp eax, 0x80000000
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
cmovae r12, rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1000074da
mov r8d, 0x104
lea rcx, [rsp + 0x70]
xor edx, edx
mov r13d, r14d
mov dword [rsp + 0x40], r8d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x38], rdx
xor edx, edx
jmp 0x1000074a2
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__strlwr]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x70]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov edi, 0x104
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, rdi
jae 0x10000747e
lea rcx, [rsp + 0x180]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x70]
lea rdx, [0x1000029e0]
lea rcx, [rsp + 0x290]
mov r8, r12
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0x48]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x290]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x10000747e
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
lea rdx, [0x100002a34]
xor r8d, r8d
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rcx, [rsi + 8]
mov edx, ebp
mov rax, qword [rcx]
cmp ebx, r14d
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], rax
cmovne edx, r14d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], edx
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], r14
call fcn.100007768
mov rcx, qword [rsp + 0x58]
cmp rcx, r14
je 0x100007473
mov rdx, qword [rsp + 0x48]
call fcn.100007974
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x68]
add r13d, 1
mov dword [rsp + 0x40], edi
mov edx, r13d
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, r14d
je 0x100007348
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.100008060
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret