Function at 0x10019f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x68
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x48], 0x8c5e7fda
mov word [rsp + 0x4c], 0xe8bf
mov word [rsp + 0x4e], 0x4a96
mov byte [rsp + 0x50], 0x9a
mov byte [rsp + 0x51], 0x85
mov byte [rsp + 0x52], 0xa6
mov byte [rsp + 0x53], 0xe2
mov byte [rsp + 0x54], 0x3a
mov byte [rsp + 0x55], 0x8c
mov byte [rsp + 0x56], 0x63
mov byte [rsp + 0x57], 0x5c
mov dword [rsp + 0x30], r12d
lea rsi, [0x010101a0]
mov qword [rsp + 0x20], rsi
mov r9d, 0x101
xor r8d, r8d
lea rbx, [0x010013b0]
mov rdx, rbx
movabs rdi, 0xffffffff80000002
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
test eax, eax
je 0x1001aac
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
test eax, eax
jne 0x1001ae7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x010013a0]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001ae7
mov eax, r12d
mov dword [rsp + 0x30], eax
jmp 0x1001aeb
mov eax, dword [rsp + 0x30]
and al, 1
jne 0x1001b07
mov dword [0x010101b0], r12d
mov dword [0x01005080], r12d
add rsp, 0x68
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, [0x01001390]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rbx, rbx
je 0x1001ca9
lea rdx, [0x01001378]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x01001360]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x1001bfd
test rdi, rdi
je 0x1001bfd
lea rdx, [rsp + 0x40]
xor ecx, ecx
call rsi
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1001be8
mov ecx, dword [rdx]
mov dword [0x010101b0], ecx
mov ax, word [rdx + 4]
mov word [0x010101b4], ax
mov ax, word [rdx + 6]
mov word [0x010101b6], ax
mov al, byte [rdx + 8]
mov byte [0x010101b8], al
mov al, byte [rdx + 9]
mov byte [0x010101b9], al
mov al, byte [rdx + 0xa]
mov byte [0x010101ba], al
mov al, byte [rdx + 0xb]
mov byte [0x010101bb], al
mov al, byte [rdx + 0xc]
mov byte [0x010101bc], al
mov al, byte [rdx + 0xd]
mov byte [0x010101bd], al
mov al, byte [rdx + 0xe]
mov byte [0x010101be], al
mov al, byte [rdx + 0xf]
mov byte [0x010101bf], al
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rsp + 0x48]
xor ecx, ecx
call rdi
jmp 0x1001ca0
mov dword [0x010101b0], r12d
lea rdx, [rsp + 0x48]
xor ecx, ecx
call rdi
jmp 0x1001ca0
lea rdx, [0x01001348]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x01001330]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r12, [0x01010060]
test rsi, rsi
je 0x1001c53
lea rcx, [rsp + 0x34]
call rsi
test eax, eax
jne 0x1001c53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x01001310]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, dword [rsp + 0x34]
lea rdx, [0x010012f0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_sprintf]
mov eax, dword [rsp + 0x34]
mov dword [0x01005080], eax
test rdi, rdi
je 0x1001ca0
xor r8d, r8d
xor edx, edx
mov ecx, 3
call rdi
test eax, eax
jne 0x1001ca0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x010012d0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_sprintf]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x68
pop r12
pop rdi
pop rsi
pop rbx
ret