Function at 0x1000dd344
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbp, qword [rsp + 0x560]
mov rbx, qword [rsp + 0x570]
mov eax, r8d
and al, 2
mov r12, rdx
xor edx, edx
neg al
mov r15, rcx
mov rcx, qword [rsp + 0x568]
sbb r13d, r13d
mov rsi, r9
mov qword [rsp + 0x68], r9
and r13d, 0xd0026
mov r14d, r8d
mov qword [rsp + 0x78], rbp
add r13d, 0x20019
mov qword [rsp + 0xb0], rcx
mov qword [r11 - 0x4a8], 0xffffffff80000002
mov eax, r13d
mov qword [r11 - 0x4b8], rdx
mov qword [r11 - 0x498], rdx
mov qword [r11 - 0x4b0], rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x9c], eax
cmp rcx, rdx
je 0x1000dd3f8
mov qword [rcx], rdx
cmp rbp, rdx
je 0x1000dd401
mov qword [rbp], rdx
cmp r9, rdx
jne 0x1000dd42a
mov edi, 0x80004003
xor r9d, r9d
mov edx, 0xa7101b5
mov r8d, edi
xor ecx, ecx
call fcn.1000b51b8
mov r12, qword [rsp + 0x50]
xor r13d, r13d
jmp 0x1000ddb48
mov qword [r9], rdx
cmp rbx, rdx
je 0x1000dd434
mov byte [rbx], dl
mov ecx, 0x5c
cmp cx, word [r12]
jne 0x1000dd449
lea rsi, [0x100110290]
jmp 0x1000dd49a
lea rsi, [0x100110150]
lea rbp, [0x100110270]
mov edi, dword [rsi + 8]
mov rcx, qword [rsi]
mov rdx, r12
mov r8, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
xor edx, edx
cmp eax, edx
jne 0x1000dd480
lea eax, [rdx + 0x5c]
cmp ax, word [r12 + rdi*2]
je 0x1000dd48b
cmp dx, word [r12 + rdi*2]
je 0x1000dd48b
add rsi, 0x20
cmp rsi, rbp
jae 0x1000dd490
jmp 0x1000dd457
cmp rsi, rbp
jb 0x1000dd497
lea rsi, [0x100110270]
mov eax, r13d
test byte [rsi + 0xc], 0x20
je 0x1000dd4ab
bts eax, 8
mov dword [rsp + 0x9c], eax
test byte [rsi + 0xc], 8
je 0x1000dd4cb
test r14b, 4
je 0x1000dd4cb
mov qword [rsp + 0x90], 0xffffffff80000001
cmp rbx, rdx
je 0x1000dd4cb
mov byte [rbx], 1
mov rbp, qword [rsi + 0x10]
test r14b, 0x10
je 0x1000dd4de
cmp qword [rsi + 0x18], rdx
cmovne rbp, qword [rsi + 0x18]
cmp r15, rdx
je 0x1000dd57e
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1000b2190
xor edx, edx
mov edi, eax
cmp eax, edx
je 0x1000dd525
xor r9d, r9d
mov r8d, eax
mov edx, 0xaa901b5
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
jmp 0x1000dd41d
cmp dword [rsp + 0xa8], edx
jne 0x1000dd57e
mov r15, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor edx, edx
mov edi, eax
cmp eax, edx
je 0x1000dd57e
xor r9d, r9d
mov r8d, eax
mov edx, 0xaae01b5
mov rcx, r15
call fcn.1000b51b8
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
xor r13d, r13d
jmp 0x1000ddb4d
test byte [rsi + 0xc], 7
mov r15b, dl
je 0x1000dd632
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x80]
lea rdx, [0x10001f8a0]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, 2
jne 0x1000dd623
test r14b, 8
je 0x1000dd676
xor r9d, r9d
mov edx, 0xabe01b5
xor ecx, ecx
mov r8d, eax
call fcn.1000b51b8
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x80]
lea rdx, [0x10001f8a0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor r13d, r13d
mov edi, eax
cmp eax, r13d
je 0x1000dd62b
mov edx, 0xac001b5
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
jmp 0x1000ddb48
xor r13d, r13d
cmp eax, r13d
jne 0x1000dd679
mov r15b, r14b
and r15b, 1
test byte [rsi + 0xc], 1
mov edi, reloc.certcli.dll_Ordinal_260
je 0x1000dd680
mov eax, dword [rsi + 8]
xor r13d, r13d
lea rbx, [r12 + rax*2]
mov rax, qword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], r13
mov word [rsp + 0xc0], r13w
lea r14d, [r13 + 0x5c]
jmp 0x1000dd923
xor r13d, r13d
mov edx, 0xac201b5
jmp 0x1000dd602
test byte [rsi + 0xc], 7
je 0x1000dd87b
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x58]
lea r14, [0x1000184b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
lea r9, [rsp + 0x70]
xor r13d, r13d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0x208
mov word [rsp + 0xc0], r13w
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
je 0x1000dd6ef
mov r8d, eax
mov edx, 0xae301b5
xor r9d, r9d
mov rcx, r14
jmp 0x1000dd60a
cmp dword [rsp + 0x70], 1
je 0x1000dd70d
cmp dword [rsp + 0x70], 7
je 0x1000dd70d
mov r8d, 0x8007000d
mov edx, 0xae801b5
mov edi, r8d
jmp 0x1000dd6e4
mov eax, dword [rsi + 8]
mov edi, reloc.certcli.dll_Ordinal_260
lea rbx, [r12 + rax*2]
cmp rbp, r13
je 0x1000dd748
lea r8, [0x100014f4c]
lea rcx, [rsp + 0xc0]
mov rdx, rdi
call fcn.100038a50
lea rcx, [rsp + 0xc0]
mov r8, rbp
mov rdx, rdi
call fcn.100038a50
mov rbp, qword [rsp + 0x78]
cmp rbp, r13
je 0x1000dd845
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r13d
je 0x1000dd7a6
mov r8d, eax
mov edx, 0xb0201b5
lea rcx, [rsp + 0xc0]
xor r9d, r9d
call fcn.1000b51b8
jmp 0x1000dd614
test byte [rsi + 0xc], 4
je 0x1000dd86b
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
je 0x1000dd7fc
mov r8d, eax
mov edx, 0xb0e01b5
mov rcx, r14
jmp 0x1000dd799
cmp dword [rsp + 0x70], 1
je 0x1000dd81d
cmp dword [rsp + 0x70], 7
je 0x1000dd81d
mov r8d, 0x8007000d
mov edx, 0xb1301b5
mov edi, r8d
jmp 0x1000dd791
lea r8, [0x100014f4c]
lea rcx, [rsp + 0xc0]
mov edx, reloc.certcli.dll_Ordinal_260
call fcn.100038a50
lea r8, [rsp + 0x2d0]
mov edx, reloc.certcli.dll_Ordinal_260
jmp 0x1000dd85e
mov edx, 0x5c
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r13
je 0x1000dd86b
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.100038a50
mov r12, qword [rsp + 0x50]
mov r14d, 0x5c
jmp 0x1000dd928
mov eax, dword [rsi + 8]
mov r14d, 0x5c
lea rbx, [r12 + rax*2]
cmp r14w, word [rbx]
jne 0x1000dd892
add rbx, 2
xor r13d, r13d
cmp r13w, word [rbx]
je 0x1000dd8ca
test byte [rsi + 0xc], 0x10
je 0x1000dd8ca
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1000dd1ac
cmp eax, r13d
je 0x1000dd9b9
mov r9d, eax
mov r8d, eax
mov edx, 0xb3601b5
mov rcx, rbx
call fcn.1000b51b8
mov r12, qword [rsp + 0x50]
mov word [rsp + 0xc0], r13w
cmp rbp, r13
je 0x1000dd923
lea rax, [rsp + 0xc0]
mov rdx, rdi
lea rcx, [rsp + 0xc0]
sub rbp, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x1000dd916
movzx eax, word [rcx + rbp]
cmp ax, r13w
je 0x1000dd916
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000dd8f3
cmp rdx, r13
jne 0x1000dd91f
sub rcx, 2
mov word [rcx], r13w
mov rbp, qword [rsp + 0x78]
cmp qword [rsp + 0x88], r13
jne 0x1000dd9c6
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0xc0]
cmp rax, r13
cmovne rcx, rax
lea rax, [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x9c]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, r13d
je 0x1000dd9c6
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov r8d, eax
mov edx, 0xb5301b5
call fcn.1000b51b8
mov rsi, qword [rsp + 0x68]
jmp 0x1000ddb48
mov r12, qword [rsp + 0x50]
mov rbx, r12
jmp 0x1000dd8cf
cmp r14w, word [rbx]
jne 0x1000dd9d0
add rbx, 2
cmp rbp, r13
je 0x1000dda47
cmp r13w, word [rbx]
je 0x1000dda47
mov edi, r13d
xor edx, edx
jmp 0x1000dd9fb
lea rcx, [rsp + 0x2d0]
mov rdx, rbx
call fcn.1000b5684
cmp eax, r13d
je 0x1000dda3f
inc edi
mov edx, edi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x2d0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x98], reloc.certcli.dll_Ordinal_260
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r13d
je 0x1000dd9e2
jmp 0x1000dda47
lea rbx, [rsp + 0x2d0]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x58], eax
cmp r15b, r13b
je 0x1000dda6e
add eax, 0x70
mov dword [rsp + 0x58], eax
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, qword [rsp + 0x68]
mov qword [rsi], rax
cmp rax, r13
jne 0x1000ddaa1
mov edi, 0x8007000e
mov edx, 0xb7a01b5
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000ddb48
mov word [rax], r13w
cmp r15b, r13b
je 0x1000ddac0
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsi]
lea r8, [0x10002a510]
shr rdx, 1
call fcn.100038b1c
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsi]
lea r8, [rsp + 0xc0]
shr rdx, 1
call fcn.100038a50
cmp r13w, word [rsp + 0xc0]
jne 0x1000ddb01
cmp dword [rsp + 0x58], 2
jbe 0x1000ddb01
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsi]
shr rax, 1
cmp r14w, word [rcx + rax*2 - 4]
jne 0x1000ddb01
mov word [rcx + rax*2 - 4], r13w
cmp rbp, r13
je 0x1000ddb25
mov rdx, rbp
mov rcx, rbx
call fcn.1000b80c8
mov edi, eax
cmp eax, r13d
je 0x1000ddb25
mov r8d, eax
mov edx, 0xb8b01b5
jmp 0x1000dda92
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000ddb45
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x88], r13
mov qword [rcx], rax
mov edi, r13d
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffff80000002
je 0x1000ddb6d
cmp rcx, 0xffffffff80000001
je 0x1000ddb6d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x1000ddb80
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x1000ddb93
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x88]
cmp rcx, r13
je 0x1000ddba6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r15, r13
je 0x1000ddbb4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r12, r13
je 0x1000ddbc2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, r13d
je 0x1000ddbf5
cmp rsi, r13
je 0x1000ddbdd
mov rcx, qword [rsi]
cmp rcx, r13
je 0x1000ddbdd
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r13
cmp rbp, r13
je 0x1000ddbf5
mov rcx, qword [rbp]
cmp rcx, r13
je 0x1000ddbf5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp], r13
mov ecx, edi
call fcn.1000b7bec
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret