Function at 0x100081e7c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x870
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor r12d, r12d
mov ebx, ecx
cmp ecx, 1
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov ecx, 0x88e
jne 0x100081ec1
mov ecx, 0x88d
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea rax, [rsp + 0x50]
and bl, 1
neg bl
lea rdi, [0x10001e970]
mov r9d, 9
sbb rcx, rcx
xor r8d, r8d
mov rdx, rdi
neg rcx
mov qword [rsp + 0x20], rax
add rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov ebx, eax
cmp eax, r12d
je 0x100081f6c
lea rcx, [0x10001e818]
mov r9, rdi
mov r8d, eax
call fcn.1000ba5ac
mov ecx, 0x88f
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
xor r9d, r9d
mov r8d, ebx
mov edx, 0x62f013a
mov rcx, rdi
call fcn.1000b51b8
cmp ebx, 2
jne 0x1000820b6
mov ebx, r12d
jmp 0x1000820b6
mov esi, r12d
jmp 0x100082042
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov r9d, 9
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov edi, eax
cmp eax, r12d
jne 0x10008211b
mov ebp, r12d
jmp 0x100081fe3
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x60]
call fcn.1000813f8
mov edi, eax
cmp eax, r12d
je 0x100081fd9
xor r9d, r9d
mov r8d, eax
mov edx, 0x67a013a
xor ecx, ecx
call fcn.1000b51b8
cmp ebx, r12d
cmove ebx, edi
inc ebp
mov edx, ebp
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x460]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, r12d
je 0x100081fa9
cmp eax, 0x103
jne 0x100082100
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
mov qword [rsp + 0x48], r12
mov edx, esi
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, r12d
je 0x100081f74
cmp eax, 0x103
je 0x1000820b6
lea rcx, [0x10001e9f0]
xor r9d, r9d
mov r8d, eax
xor edx, edx
call fcn.1000ba5ac
mov edx, 0x64f013a
cmp ebx, r12d
cmove ebx, edi
xor ecx, ecx
xor r9d, r9d
mov r8d, edi
call fcn.1000b51b8
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x1000820c6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000820d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea rcx, [0x10001e9f0]
xor r9d, r9d
mov r8d, edi
xor edx, edx
call fcn.1000ba5ac
mov edx, 0x677013a
jmp 0x1000820a3
lea rcx, [0x10001e818]
xor r9d, r9d
mov r8d, eax
call fcn.1000ba5ac
cmp ebx, r12d
mov edx, 0x65e013a
cmove ebx, edi
lea rcx, [rsp + 0x60]
jmp 0x1000820ab