Function at 0x100058cd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x380
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor r12d, r12d
xor edi, edi
mov rbx, rdx
and qword [rsp + 0x48], r12
lea r15d, [r12 + 1]
mov rsi, rcx
mov dword [rsp + 0x40], r15d
test rdx, rdx
jne 0x100058d2c
mov eax, 0x80004003
jmp 0x100059120
or r13, 0xffffffffffffffff
test rcx, rcx
je 0x100058de1
xor eax, eax
mov rcx, r13
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
lea rdi, [rcx + rcx + 1]
mov rcx, rdi
call fcn.10007fa96
mov rbp, rax
test rax, rax
jne 0x100058d69
mov eax, 0x8007000e
jmp 0x100059120
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov r12d, 0x80004005
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, 0x200
test eax, eax
je 0x100058dd4
mov rdi, rbp
xor r12d, r12d
mov rdx, rsi
sub rdi, rbx
mov rcx, rbx
lea rax, [rdx + 0x7ffffdfe]
test rax, rax
je 0x100058dc9
mov al, byte [rdi + rcx]
test al, al
je 0x100058dc9
mov byte [rcx], al
add rcx, r15
sub rdx, r15
jne 0x100058dac
test rdx, rdx
jne 0x100058dd1
sub rcx, r15
mov byte [rcx], r12b
mov rcx, rbp
call fcn.10007faa2
jmp 0x100058e9c
lea rax, [rsp + 0x48]
lea rdx, [0x100025840]
mov esi, 0x200
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100058e5f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x10002b090]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100058e50
cmp dword [rsp + 0x40], r15d
jne 0x100058e50
mov edi, r15d
mov byte [rbx + 0x1ff], r12b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100058eba
mov rcx, qword [0x100088070]
mov r9d, esi
mov r8, rbx
mov edx, 0x277e
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x100058eba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
test eax, eax
cmove eax, ecx
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
test r12d, r12d
jns 0x100058eba
lea rdx, [0x10002b0e0]
mov r8d, r12d
mov ecx, 2
call fcn.1000527f4
jmp 0x10005911d
lea rbp, [0x10002b09c]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100058f32
lea rdx, [0x10002b0a0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100058f32
lea rdx, [0x10002b0a8]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100058f32
mov rcx, r13
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r15
je 0x100058f20
cmp rcx, rsi
jae 0x100058f20
cmp byte [rcx + rbx - 1], 0x2f
je 0x100058f20
mov byte [rcx + rbx], 0x2f
mov byte [rcx + rbx + 1], al
lea r8, [0x100024b90]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100058f51
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
sub rcx, r15
sub rdi, rcx
mov rcx, rdi
call fcn.10007fa96
mov rbp, rax
test rax, rax
je 0x10005911d
lea r8, [0x10002b0b0]
mov rdx, rsi
mov rcx, rbx
xor r13d, r13d
call fcn.1000519d4
add rdi, 0xfffffffffffffff6
mov eax, 0xffffffff
cmp rdi, rax
jae 0x100059076
and qword [rsp + 0x20], r13
lea r9d, [r13 + 0xc]
lea r8, [0x100024bd0]
lea rcx, [rsp + 0x160]
mov edx, 0x208
call fcn.10003a0f0
test eax, eax
js 0x100059076
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x160]
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100059076
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x10002b0c0]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100059062
cmp dword [rsp + 0x40], r15d
jne 0x100059062
lea r8, [0x10002b0d0]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
lea r8, [0x10002b0bc]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
mov r13d, r15d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
jne 0x100059115
lea rax, [rsp + 0x50]
test rax, rax
je 0x100059115
lea rax, [rsp + 0x160]
mov edi, 0x104
test rax, rax
je 0x1000590a8
lea rcx, [rsp + 0x160]
mov rdx, rdi
call fcn.100058170
jmp 0x1000590aa
xor eax, eax
test eax, eax
je 0x100059115
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x160]
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100059115
lea r8, [0x10002b0d0]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
lea r8, [0x10002b0bc]
mov rdx, rsi
mov rcx, rbx
call fcn.1000519d4
mov rcx, rbp
call fcn.10007faa2
mov eax, r12d
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret