Function at 0x140002b30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
cmp word [r8], 0
mov qword [rsp + 0x130], r8
mov rbp, rcx
mov rsi, rdx
mov rax, r8
mov dword [rsp + 0x138], r9d
je 0x14000344e
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140002b70
sub rax, qword [rsp + 0x130]
sar rax, 1
lea ecx, [rax + 7]
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
movsxd rcx, ecx
mov qword [rsp + 0x90], rax
add rcx, rcx
call rax
mov r12, rax
mov rax, qword [rsp + 0x130]
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140002bb0
sub rax, qword [rsp + 0x130]
sar rax, 1
lea edx, [rax + 7]
movsxd rdx, edx
mov r9, qword [rsp + 0x130]
lea r8, str._r_n__s__r_n
mov rcx, r12
call sym.swprintf
cmp word [r12], 0
je 0x140003471
mov r8, r12
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x140002bf8
sub r8d, r12d
and r8d, 0xfffffffe
lea rax, [rsp + 0xc8]
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], 0
mov r9, rax
mov qword [rsp + 0x60], rax
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r12
mov qword [rsp + 0x80], rax
call rax
mov rdi, qword [rsp + 0x90]
mov ecx, 0x200
call rdi
mov ecx, 0x800
mov r13, rax
call rdi
mov dword [rsp + 0x5c], 0
mov r15, rax
lea rax, [rsp + 0xb8]
mov dword [rsp + 0x58], 0x800
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xc4]
mov dword [rsp + 0x4c], 0x100
mov qword [rsp + 0x98], rax
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x30], r15
mov r8, r13
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x68]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x58]
mov edx, dword [rsp + 0x5c]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
call qword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
je 0x140002d48
cmp eax, 0xea
jne 0x140003290
mov ebx, dword [rsp + 0xbc]
cmp ebx, dword [rsp + 0x58]
jbe 0x140003120
mov rcx, r15
mov edx, ebx
call qword [sym.imp.ucrtbase.dll_realloc]
mov dword [rsp + 0x58], ebx
mov r15, rax
jmp 0x140002cc0
mov r14d, dword [rsp + 0xbc]
lea rcx, [0x140009140]
mov edx, 0x3d
mov ebx, dword [rsp + 0xc0]
mov rax, rcx
mov dword [rsp + 0x88], r14d
test r13, r13
je 0x140002d84
cmp word [r13], 0
je 0x140002d84
jmp 0x1400031d0
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
jne 0x140002d80
sub rax, rcx
lea rcx, [0x140009140]
sar rax, 1
mov r8, rcx
cdqe
mov qword [rsp + 0xc8], rax
mov eax, 0x3d
jmp 0x140002db5
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x140002db0
sub r8d, ecx
mov r9, qword [rsp + 0x98]
mov rax, qword [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], 0
and r8d, 0xfffffffe
lea rdx, [0x140009140]
call rax
mov r10, qword [rsp + 0xc8]
cmp ebx, 1
je 0x140003020
cmp ebx, 4
je 0x140003140
mov dword [rsp + 0xa0], r10d
cmp ebx, 3
jne 0x140003151
lea rdx, [0x140009146]
mov eax, 0x65
mov r10, rdx
jmp 0x140002e2d
movzx eax, word [r10 + 2]
add r10, 2
test ax, ax
jne 0x140002e28
sub r10, rdx
lea rdx, [0x140009146]
mov eax, 0x65
sar r10, 1
mov r8, rdx
movsxd rdi, r10d
jmp 0x140002e55
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x140002e50
sub r8d, edx
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], 0
and r8d, 0xfffffffe
lea rdx, [0x140009146]
call rax
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x1400030ca
lea ecx, [rax + rax*2]
add edi, dword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rcx, rcx
call rbx
lea rcx, [r14 + r15]
xor r14d, r14d
mov rbx, r15
mov r12, rax
mov eax, dword [rsp + 0x88]
mov qword [rsp + 0xa0], r13
mov r13, r14
mov qword [rsp + 0xa8], r15
mov r14, rcx
dec eax
mov qword [rsp + 0x128], rsi
mov esi, edi
add rax, r15
mov r15, qword [rsp + 0x60]
mov rdi, rax
jmp 0x140002efc
inc rbx
cmp r14, rbx
je 0x140002ff0
movzx r9d, byte [rbx]
lea rcx, [r12 + r13*2]
mov edx, 3
lea r8, str._02x
call sym.swprintf
cdqe
add rax, r13
cmp rdi, rbx
je 0x140002ff0
mov edx, 0x2c
xor ecx, ecx
lea r13, [rax + 1]
add esi, 3
mov word [r12 + rax*2], dx
mov word [r12 + rax*2 + 2], cx
cmp esi, 0x4c
jbe 0x140002ef0
cmp word [r12], 0
je 0x140003436
mov r8, r12
add r8, 2
cmp word [r8], 0
jne 0x140002f50
sub r8d, r12d
and r8d, 0xfffffffe
mov rax, qword [rsp + 0x50]
mov r9, r15
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], 0
call rax
mov eax, 0xd
lea r8, str._r_n
jmp 0x140002f95
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x140002f90
lea rax, str._r_n
inc rbx
mov r9, r15
mov rcx, rbp
mov qword [rsp + 0x88], rax
mov rdx, rax
xor r13d, r13d
mov rax, qword [rsp + 0x50]
sub r8d, dword [rsp + 0x88]
mov esi, 2
mov qword [rsp + 0x20], 0
and r8d, 0xfffffffe
call rax
cmp r14, rbx
jne 0x140002efc
nop word cs:[rax + rax]
cmp word [r12], 0
mov r13, qword [rsp + 0xa0]
mov r8, r12
mov r15, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x128]
jne 0x140003090
xor r8d, r8d
jmp 0x1400030a2
mov rax, r14
mov r8, qword [rsp + 0x60]
mov rcx, r15
shr rax, 1
dec rax
test r14, r14
cmovne r14, rax
mov rdx, r14
call sym.escape_string
mov r14, rax
mov rax, qword [rsp + 0xc8]
lea rbx, [rax + 3]
mov rax, qword [rsp + 0x90]
lea rcx, [rbx + rbx]
call rax
mov r9, r14
lea r8, [0x140009180]
mov rdx, rbx
mov rcx, rax
mov r12, rax
call sym.swprintf
mov rax, qword [rsp + 0x80]
mov rcx, r14
call rax
cmp word [r12], 0
mov r8, r12
je 0x140003013
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x140003090
sub r8d, r12d
and r8d, 0xfffffffe
mov rcx, rbp
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rdx, r12
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x80]
mov rcx, r12
call rax
lea rdx, [0x14000915c]
mov eax, 0xa
mov r8, rdx
jmp 0x1400030e5
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x1400030e0
sub r8d, edx
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], 0
and r8d, 0xfffffffe
lea rdx, [0x14000915c]
call rax
inc dword [rsp + 0x5c]
jmp 0x140002cc0
shl dword [rsp + 0x4c], 1
mov edx, dword [rsp + 0x4c]
mov rcx, r13
add rdx, rdx
call qword [sym.imp.ucrtbase.dll_realloc]
mov r13, rax
jmp 0x140002cc0
mov dword [rsp + 0xa0], r10d
test r14, r14
jne 0x140003408
mov ecx, 0x1e
mov rax, qword [rsp + 0x90]
call rax
mov r9d, ebx
lea r8, str.hex__x_:
mov edx, 0xf
mov r12, rax
mov rcx, rax
call sym.swprintf
cmp word [r12], 0
movsxd rdi, eax
je 0x14000343e
mov r8, r12
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x140003190
sub r8d, r12d
and r8d, 0xfffffffe
mov rcx, rbp
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rdx, r12
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x80]
mov rcx, r12
call rax
jmp 0x140002e84
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0xb8]
mov rcx, r13
call sym.escape_string
mov r12, rax
mov rax, qword [rsp + 0xc8]
lea rdx, [rax + 4]
mov rax, qword [rsp + 0x90]
lea rcx, [rdx + rdx]
mov qword [rsp + 0xa0], rdx
call rax
mov rdx, qword [rsp + 0xa0]
mov r9, r12
lea r8, [0x140009174]
mov rcx, rax
mov rdi, rax
call sym.swprintf
cmp word [rdi], 0
cdqe
mov qword [rsp + 0xc8], rax
je 0x140003446
mov r8, rdi
nop dword [rax]
add r8, 2
cmp word [r8], 0
jne 0x140003240
sub r8d, edi
and r8d, 0xfffffffe
mov rdx, rdi
mov rcx, rbp
mov r9, qword [rsp + 0x98]
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
call rax
mov rcx, rdi
mov rdi, qword [rsp + 0x80]
call rdi
mov rcx, r12
call rdi
jmp 0x140002de7
mov rdi, qword [rsp + 0x80]
mov rcx, r15
call rdi
mov rcx, r13
call rdi
mov rax, qword [rsp + 0x90]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0x130]
cmp word [rax], 0
je 0x140003479
mov rbx, rax
nop dword [rax]
add rbx, 2
cmp word [rbx], 0
jne 0x1400032d0
sub rbx, qword [rsp + 0x130]
sar rbx, 1
mov r15d, dword [rsp + 0x138]
mov qword [rsp + 0x120], rbp
xor edi, edi
mov r14, qword [sym.imp.advapi32.dll_RegEnumKeyExW]
mov rbp, qword [rsp + 0x98]
or r15d, 0x20019
mov dword [rsp + 0xc4], 0x101
mov r9, rbp
mov r8, r12
mov edx, edi
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
test eax, eax
jne 0x1400033e0
mov r9d, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x130]
mov r8, r12
mov edx, ebx
call sym.build_subkey_path
xor r8d, r8d
mov r9d, r15d
mov rdx, r12
mov r13, rax
mov rax, qword [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400033a8
mov rax, qword [rsp + 0x80]
mov rcx, r13
inc edi
call rax
jmp 0x14000330d
mov rcx, qword [rsp + 0x120]
mov r9d, dword [rsp + 0x138]
mov r8, r13
mov rdx, qword [rsp + 0xc8]
call sym.export_registry_data
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x14000338f
mov rax, qword [rsp + 0x80]
mov rcx, r12
call rax
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x90]
mov ecx, 0x1e
call rax
mov r9d, dword [r15]
lea r8, str.dword:_08x
mov edx, 0xf
mov rcx, rax
mov r12, rax
call sym.swprintf
jmp 0x140003082
xor r8d, r8d
jmp 0x140002f62
xor r8d, r8d
jmp 0x1400031a2
xor r8d, r8d
jmp 0x140003252
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov ecx, 0xe
mov qword [rsp + 0x90], rax
call rax
mov edx, 7
mov r12, rax
jmp 0x140002bcb
xor r8d, r8d
jmp 0x140002c0a
xor ebx, ebx
jmp 0x1400032e5