Function at 0x140003440
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov dword [rsp + 0x50], 0xff
mov r14, rdx
mov qword [rsp + 0x60], rax
mov rsi, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r13d, eax
lea edx, [rax + 1]
mov dword [rsp + 0x40], eax
lea ecx, [rax + 0x48]
mov dword [rsp + 0x44], eax
mov r12d, eax
mov dword [rsp + 0x54], eax
mov r15d, eax
call fcn.140036a5c
or edi, 0xffffffff
mov rbx, rax
test rax, rax
je 0x140003835
mov qword [rax + 0x28], 0x100
mov edx, 0x100
mov qword [rax + 0x20], 0x8000000
xor eax, eax
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x38], 1
mov qword [rbx + 0x40], rax
lea ecx, [rax + 1]
call fcn.140036a5c
mov qword [rbx], rax
mov qword [rbx + 8], rax
test rax, rax
jne 0x140003506
mov rcx, rbx
call fcn.140031820
xor ebx, ebx
jmp 0x140003835
xor edi, edi
mov rcx, 0xffffffff80000002
cmp dword [rsi + 0x40048], 2
mov qword [rsp + 0x58], rcx
jg 0x140003570
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140003751
xor esi, esi
lea rdx, [rsp + 0x58]
mov ecx, 0xf003f
mov qword [rsp + 0x58], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
test eax, eax
je 0x14000355b
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.1400039b0
or edi, 0xffffffff
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
test edi, edi
jne 0x140003751
mov rcx, qword [rsp + 0x58]
jmp 0x140003572
xor esi, esi
lea rax, [rsp + 0x60]
mov r9d, 0x20108
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003751
mov edi, r12d
nop dword [rax]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x50], 0xff
test rcx, rcx
je 0x1400035bd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov edx, edi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
inc edi
test eax, eax
jne 0x140003751
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400035a0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140050968]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400035a0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400035a0
test r13, r13
je 0x140003684
mov rcx, r13
call fcn.140031820
test r12, r12
je 0x140003691
mov rcx, r12
call fcn.140031820
mov ecx, dword [rsp + 0x40]
mov r12, rsi
call fcn.140031834
mov r13, rax
test rax, rax
je 0x140003749
mov ecx, dword [rsp + 0x44]
call fcn.140031834
mov r12, rax
test rax, rax
je 0x140003749
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140050968]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140003749
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140003749
mov r8d, dword [rsp + 0x40]
mov rdx, r13
mov rcx, rbx
call fcn.140004aa0
test eax, eax
jne 0x140003749
mov r8d, dword [rsp + 0x44]
mov rdx, r12
mov rcx, rbx
call fcn.140004aa0
test eax, eax
jne 0x140003749
inc r15d
mov dword [rsp + 0x54], r15d
jmp 0x1400035a0
or edi, 0xffffffff
jmp 0x140003835
xor edi, edi
mov rcx, r14
lea edx, [rdi + 1]
call fcn.1400040f0
test eax, eax
jne 0x140003776
mov rcx, qword [r14 + 0x18]
mov rdi, qword [r14]
add rdi, rcx
lea rax, [rcx + 1]
mov qword [r14 + 0x18], rax
jmp 0x140003778
js 0x140003751
mov byte [rdi], listen
mov rcx, r14
xor edi, edi
lea edx, [rdi + 4]
call fcn.1400040f0
test eax, eax
jne 0x1400037a0
mov rcx, qword [r14 + 0x18]
mov rdi, qword [r14]
add rdi, rcx
lea rax, [rcx + 4]
mov qword [r14 + 0x18], rax
jmp 0x1400037a2
js 0x140003751
mov eax, r15d
mov rcx, rbx
shr eax, 0x18
mov byte [rdi], al
mov eax, r15d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, r15d
shr eax, 8
mov byte [rdi + 2], al
mov byte [rdi + 3], r15b
call fcn.140003cc0
test eax, eax
je 0x1400037d0
xor edi, edi
jmp 0x1400037d8
mov rdi, qword [rbx + 0x18]
sub rdi, qword [rbx + 0x10]
mov rcx, rbx
call fcn.140003cc0
test eax, eax
je 0x1400037e8
xor esi, esi
jmp 0x1400037f0
mov rsi, qword [rbx + 0x10]
add rsi, qword [rbx + 8]
mov rdx, rdi
mov rcx, r14
xor r15d, r15d
call fcn.1400040f0
test eax, eax
je 0x14000380e
jns 0x140003820
mov r15d, dword [rsp + 0x54]
jmp 0x140003751
mov r9, qword [r14 + 0x18]
mov r15, qword [r14]
add r15, r9
lea rax, [r9 + rdi]
mov qword [r14 + 0x18], rax
test rdi, rdi
je 0x140003833
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.14002b550
xor edi, edi
test r13, r13
je 0x140003842
mov rcx, r13
call fcn.140031820
test r12, r12
je 0x14000384f
mov rcx, r12
call fcn.140031820
test rbx, rbx
je 0x14000385c
mov rcx, rbx
call fcn.140003f20
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000386c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000387c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000388c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14002a0e0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret