Function at 0x1000057b8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x100027100]
xor rax, rsp
mov qword [rsp + 0x120], rax
and dword [rsp + 0x3c], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov rbp, rdx
lea rax, [rsp + 0x40]
mov rsi, r9
mov rdi, r8
mov rbx, rcx
lea rdx, [0x1000043f0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100005abd
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x100004458]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100005ab2
cmp dword [rsp + 0x34], eax
je 0x100005ab2
mov ecx, dword [rbx]
lea edx, [rax + 7]
lea r11, [0x1000043b0]
mov eax, ecx
shr ecx, 4
and eax, 0xf
sub rdx, 1
movzx eax, word [r11 + rax*2]
mov word [rsp + rdx*2 + 0xd2], ax
jns 0x100005872
movzx edx, word [rbx + 4]
mov r9w, 0x2d
mov ecx, 3
mov word [rsp + 0xe0], r9w
mov r8, rcx
mov eax, edx
shr edx, 4
and eax, 0xf
sub r8, 1
movzx eax, word [r11 + rax*2]
mov word [rsp + r8*2 + 0xe4], ax
jns 0x1000058a7
movzx edx, word [rbx + 6]
mov word [rsp + 0xea], r9w
mov eax, edx
shr edx, 4
and eax, 0xf
sub rcx, 1
movzx eax, word [r11 + rax*2]
mov word [rsp + rcx*2 + 0xee], ax
jns 0x1000058d0
movzx ecx, byte [rbx + 8]
mov word [rsp + 0xf4], r9w
mov word [rsp + 0xfe], r9w
mov rax, rcx
lea rdx, [rsp + 0x100]
lea r8, [rsp + 0x102]
shr rax, 4
mov r10d, 6
movzx eax, word [r11 + rax*2]
mov word [rsp + 0xf6], ax
mov al, cl
movzx ecx, byte [rbx + 9]
and eax, 0xf
movzx eax, word [r11 + rax*2]
mov word [rsp + 0xf8], ax
mov rax, rcx
shr rax, 4
movzx eax, word [r11 + rax*2]
mov word [rsp + 0xfa], ax
mov al, cl
and eax, 0xf
add rbx, 0xa
movzx eax, word [r11 + rax*2]
mov word [rsp + 0xfc], ax
movzx ecx, byte [rbx]
add rbx, 1
mov rax, rcx
shr rax, 4
movzx eax, word [r11 + rax*2]
mov word [rdx], ax
mov al, cl
add rdx, 4
and eax, 0xf
movzx eax, word [r11 + rax*2]
mov word [r8], ax
add r8, 4
sub r10, 1
jne 0x10000596b
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x118], r10w
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100005ab2
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea rdx, [0x100004468]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [0x100004478]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x34], 1
jne 0x100005aa7
mov ebx, 0x78
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x50]
lea rdx, [0x100004488]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x7c], 0x20000
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
test eax, eax
je 0x100005a89
cmp eax, 0xea
je 0x100005a89
xor eax, eax
jmp 0x100005a8e
mov rax, qword [rsp + 0x58]
test rax, rax
mov qword [rbp], rax
je 0x100005aa7
mov eax, dword [rsp + 0x3c]
btr eax, 0x1f
mov dword [rdi], eax
mov al, byte [rsp + 0x38]
mov byte [rsi], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1000233b0
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret