Function at 0x1000792f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
mov rbp, rcx
mov dil, r14b
cmp byte [0x10008895e], r14b
je 0x1000797f1
cmp rcx, r14
je 0x1000797f1
lea rbx, [0x100088c60]
mov r8, rcx
mov rdx, rbx
mov rcx, rbx
call fcn.10007beec
cmp al, r14b
je 0x100079349
lea edi, [r14 + 1]
jmp 0x1000797f1
lea rdx, [0x100088c78]
mov r8, rbp
mov rcx, rbx
call fcn.10007beec
cmp al, r14b
jne 0x100079374
lea rdx, [0x1000319f8]
mov rcx, rbp
call fcn.10007d3c0
cmp al, r14b
je 0x10007937c
mov dil, r14b
jmp 0x1000797f1
lea rcx, [rsp + 0x78]
call fcn.10007d40c
lea rcx, [rsp + 0x68]
mov rbx, r14
mov sil, r14b
mov r12d, r14d
call fcn.10007d40c
or r15d, 0xffffffff
lea rdx, [0x100029f80]
lea rcx, [rsp + 0x68]
mov r8d, r15d
call fcn.10007d57c
cmp eax, r14d
jl 0x1000797b6
lea rcx, [rsp + 0x68]
mov r8d, r15d
mov rdx, rbp
call fcn.10007d7d4
cmp eax, r14d
jl 0x1000797b6
lea rcx, [rsp + 0x58]
call fcn.10007d40c
mov r13, qword [rsp + 0x68]
mov rdi, r13
cmp r13, r14
je 0x100079407
cmp word [r13], r14w
je 0x100079407
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rdi], ax
add rdi, 2
cmp word [rdi], r14w
jne 0x1000793f1
lea rdx, [0x100031a00]
lea rcx, [rsp + 0x58]
mov r8d, r15d
call fcn.10007d57c
mov edi, 1
cmp eax, r14d
jl 0x10007948a
lea rcx, [rsp + 0x58]
mov r8d, r15d
mov rdx, r13
call fcn.10007d7d4
cmp eax, r14d
jl 0x10007948a
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0xe8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10007948a
mov rbx, qword [rsp + 0xe8]
cmp rbx, r14
je 0x1000794a3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
jmp 0x1000794a3
lea rdx, [0x1000062c0]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100079766
lea rcx, [rsp + 0x48]
call fcn.10007d40c
lea rdx, [0x100031a98]
lea rcx, [rsp + 0x48]
mov r8d, r15d
call fcn.10007d57c
cmp eax, r14d
jl 0x1000795b0
lea rcx, [rsp + 0x48]
mov r8d, r15d
mov rdx, r13
call fcn.10007d7d4
cmp eax, r14d
jl 0x1000795b0
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x1000795b0
mov eax, r14d
cmp rbx, r14
je 0x100079527
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x30]
cmp eax, r14d
jne 0x1000795b0
lea rax, [rsp + 0xe0]
lea r9, [rsp + 0xd8]
lea rdx, [0x100030e20]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0xe0], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x10007958c
cmp dword [rsp + 0xd8], edi
je 0x10007957e
cmp dword [rsp + 0xd8], 2
jne 0x100079596
mov r12d, dword [rsp + 0xe0]
mov eax, r14d
shr r12d, 1
movzx esi, sil
cmp eax, r14d
cmove esi, edi
cmp rbx, r14
je 0x1000795a7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x10007975c
lea rax, [rsp + 0x38]
lea rdx, [0x100031ad0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100079688
mov eax, r14d
cmp rbx, r14
je 0x1000795f6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x38]
cmp eax, r14d
jne 0x100079688
lea eax, [r12 + r12]
lea r9, [rsp + 0xd8]
xor r8d, r8d
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xe0]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov r12d, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp eax, r14d
jne 0x100079664
cmp dword [rsp + 0xd8], edi
je 0x100079656
cmp dword [rsp + 0xd8], 2
jne 0x10007966e
mov r12d, dword [rsp + 0xe0]
mov r11d, r14d
shr r12d, 1
movzx esi, sil
cmp r11d, r14d
cmove esi, edi
cmp rbx, r14
je 0x10007967f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x10007975c
lea rax, [rsp + 0x40]
lea rdx, [0x100031ad0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10007974a
mov eax, r14d
cmp rbx, r14
je 0x1000796ce
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
cmp eax, r14d
jne 0x10007974a
lea eax, [r12 + r12]
lea r9, [rsp + 0xd8]
xor r8d, r8d
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xe0]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp eax, r14d
jne 0x10007972a
cmp dword [rsp + 0xd8], edi
je 0x100079727
cmp dword [rsp + 0xd8], 2
jne 0x100079734
mov r11d, r14d
movzx esi, sil
cmp r11d, r14d
cmove esi, edi
cmp rbx, r14
je 0x100079745
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x10007975c
mov rcx, rbp
call fcn.1000799c8
movzx esi, sil
cmp al, r14b
cmovne esi, edi
lea rcx, [rsp + 0x48]
call fcn.10007d970
lea rcx, [rsp + 0x58]
call fcn.10007d970
cmp sil, r14b
je 0x1000797b6
lea rcx, [0x1000876c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x100087698]
mov rdx, rbp
call fcn.10007c914
lea rcx, [0x1000876c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [0x100088c60]
lea rcx, [0x100088c60]
mov r8, rbp
call fcn.10007bdfc
jmp 0x1000797cf
lea rdx, [0x100088c78]
lea rcx, [0x100088c60]
mov r8, rbp
call fcn.10007bdfc
mov dil, r14b
lea rcx, [rsp + 0x68]
call fcn.10007d970
cmp rbx, r14
je 0x1000797e7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.10007d970
mov al, dil
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret