Function at 0x1001a4240
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r14
sub rsp, 0x58
cmp dword [0x1004c6af0], 0
mov r14, r9
mov rbx, rdx
je 0x1001a453b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
call fcn.1001a4830
test rbx, rbx
je 0x1001a4279
cmp word [rbx], 0
jne 0x1001a4280
lea rbx, [0x100053e14]
mov rdx, rbx
mov rcx, rax
call fcn.1001a4c40
mov rsi, rax
test rax, rax
je 0x1001a451a
mov eax, 0xffff
cmp word [rsi], ax
jne 0x1001a42b2
cmp word [rsi + 2], 0
jne 0x1001a42b2
mov ebp, 2
jmp 0x1001a4504
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x50], r12
xor ebp, ebp
lea r9, [rsp + 0x30]
lea rdx, [0x100053e18]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x48], r13
lea r12d, [rbp + 1]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], ebp
call qword [sym.imp.MSVCR100.dll__swscanf_s_l]
lea edi, [rbp + 4]
cmp eax, r12d
jne 0x1001a4300
mov r12d, edi
lea r13, [rsp + 0x30]
jmp 0x1001a44b3
lea rax, [0x100053e30]
mov r9d, edi
mov r8, rsi
mov edx, r12d
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1001a432f
lea r12d, [rax + 1]
jmp 0x1001a43a9
lea rax, [0x100053e40]
mov r9d, edi
mov r8, rsi
mov edx, r12d
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1001a4496
lea rbx, [rsi + 8]
lea r9, [rsp + 0x34]
lea rdx, [0x100053e50]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.MSVCR100.dll__swscanf_s_l]
cmp eax, r12d
jne 0x1001a4496
cmp word [rbx], 0x3a
je 0x1001a439c
nop word [rax + rax]
add rbx, 2
inc edi
cmp word [rbx], 0x3a
jne 0x1001a4390
mov r12d, dword [rsp + 0x34]
inc edi
je 0x1001a4496
movsxd r8, edi
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], bp
jne 0x1001a43b0
sub rcx, r8
lea rbx, [rsi + r8*2]
movabs rax, 0xaaaaaaaaaaaaaaab
lea r9, [rsp + 0x30]
xor r8d, r8d
mov r13, rsi
mul rcx
mov rdi, rdx
lea rdx, [0x100053e60]
mov rcx, rbx
shr rdi, 1
mov r15d, ebp
inc edi
call qword [sym.imp.MSVCR100.dll__swscanf_s_l]
cmp eax, 1
jne 0x1001a4466
mov r14, rsi
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x2c
je 0x1001a4423
nop dword [rax]
test ax, ax
je 0x1001a4423
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x2c
jne 0x1001a4410
movzx eax, byte [rsp + 0x30]
inc r14
inc r15d
mov byte [r14 - 1], al
cmp word [rbx], 0x2c
jne 0x1001a443c
add rbx, 2
cmp word [rbx], bp
je 0x1001a445e
lea r9, [rsp + 0x30]
lea rdx, [0x100053e60]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__swscanf_s_l]
cmp eax, 1
je 0x1001a4400
mov r14, qword [rsp + 0x88]
cmp edi, r15d
jne 0x1001a448f
cmp r12d, 1
je 0x1001a447d
cmp r12d, 7
je 0x1001a447d
cmp r12d, 2
jne 0x1001a44b3
test dil, 1
jne 0x1001a448f
movsxd rax, r15d
add edi, 2
mov word [rax + rsi], bp
jmp 0x1001a44b3
mov ebp, ntohs
jmp 0x1001a44ed
or rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rsi + rcx*2], bp
jne 0x1001a44a0
lea edi, [rcx*2 + 2]
mov r13, rsi
mov rcx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x1001a44de
cmp dword [rbx], edi
jb 0x1001a44d9
mov r8d, edi
mov rdx, r13
call sub.MSVCR100.dll_memcpy
jmp 0x1001a44de
mov ebp, 0xea
test r14, r14
je 0x1001a44e6
mov dword [r14], r12d
test rbx, rbx
je 0x1001a44ed
mov dword [rbx], edi
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001a451f
mov ebp, 8
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x78]
mov eax, ebp
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop r14
pop rbx
ret
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x58
pop r14
pop rbx
ret