Function at 0x100103784
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov rbx, rcx
lea r12, [0x10003c5c0]
mov qword [rsp + 0x48], r12
lea r13, [0x10003ce20]
mov qword [rsp + 0x50], r13
lea r14, [0x10003c5a8]
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0x3bd
mov r15d, 0xb
mov dword [rsp + 0x64], r15d
mov edi, 0xff
mov dword [rsp + 0x68], edi
xor ebp, ebp
mov word [rax - 0x210], bp
mov byte [rax - 0x20e], bpl
mov byte [rax - 0x20d], 1
xor edx, edx
lea r8d, [r15 + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x100]
call fcn.1000e7c38
nop
mov rcx, rbx
call fcn.100103fa0
cmp dword [rbx + 0x10], 4
je 0x1001038a2
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0x3c3
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x68], edi
mov word [rsp + 0xe8], bp
mov byte [rsp + 0xea], bpl
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [r15 + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, [0x10003ce90]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x100]
call fcn.1000e9a68
int3
mov edi, dword [rbx + 0x2c]
cmp edi, 4
je 0x100103923
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0x3c8
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], bp
mov byte [rsp + 0xea], bpl
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
lea r9, [0x10003cfe0]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x100]
call fcn.1000e9a68
int3
mov dword [rsp + 0x318], ebp
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x300], eax
mov dword [rsp + 0x310], ebp
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x300]
mov r8, qword [rbx + 0x20]
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp eax, ebp
je 0x100103ac7
cmp eax, 0x103
je 0x100103a33
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0x3e7
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], bp
mov byte [rsp + 0xea], bpl
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
movzx r8d, di
or r8d, 0x80070000
cmp edi, ebp
cmovle r8d, edi
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x38], eax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
lea r9, [0x10003cfa0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x100]
call fcn.1000e9a68
int3
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], r14
mov dword [rsp + 0x188], 0x3e5
mov dword [rsp + 0x18c], r15d
mov dword [rsp + 0x190], 0xff
mov word [rsp + 0x210], bp
mov byte [rsp + 0x212], bpl
mov byte [rsp + 0x213], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x198]
call sub.msvcrt.dll_memset
mov r11d, dword [rbx + 8]
mov dword [rsp + 0x28], r11d
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x20], eax
lea r9, [0x10003cc10]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x100]
call fcn.1000e9a68
int3
mov ebx, dword [rbx + 0x10]
mov edi, dword [rsp + 0x310]
cmp edi, ebx
je 0x100103b65
mov qword [rsp + 0x218], r12
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], r14
mov dword [rsp + 0x230], 0x3df
mov dword [rsp + 0x234], r15d
mov dword [rsp + 0x238], 0xff
mov word [rsp + 0x2b8], bp
mov byte [rsp + 0x2ba], bpl
mov byte [rsp + 0x2bb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
lea r9, [0x10003cf10]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x100]
call fcn.1000e9a68
int3
mov eax, dword [rsp + 0x318]
mov dword [rsi], eax
lea rcx, [rsp + 0x100]
call fcn.1000e7d24
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret