Function at 0x10000c0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x100025108]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r15d, r15d
lea rax, [rsp + 0x48]
mov r13, rcx
mov edi, 0x20019
lea rdx, [0x100006250]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, edi
mov qword [rsp + 0x20], rax
mov ebx, r15d
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov ebp, r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x10000c3b7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [r15 + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
lea r8, [0x100006238]
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, 0x80070000
movzx ebx, ax
or ebx, esi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
mov dword [rsp + 0x60], ebx
jl 0x10000c36f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea rdx, [0x1000062a8]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x10000c33e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea r12, [rsp + 0x70]
not rcx
sub rcx, 1
mov r14, rcx
je 0x10000c331
mov edx, dword [rsp + 0x40]
lea rsi, [0x100025288]
lea ebx, [rax + 1]
mov eax, 8
cmp ax, word [r13]
jbe 0x10000c32d
cmp edx, r15d
jbe 0x10000c32d
cmp dword [0x1000253b0], r15d
je 0x10000c32d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x10000c2aa
mov r8, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.10000c3f0
cmp eax, r15d
mov edi, eax
jge 0x10000c29d
mov rcx, qword [0x100025288]
cmp rcx, rsi
je 0x10000c29d
test byte [rcx + 0x1c], 4
je 0x10000c29d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006448]
mov edx, 0x13
mov r9d, eax
call fcn.100009850
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000c2ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x100025288]
cmp rcx, rsi
je 0x10000c2ed
test byte [rcx + 0x1c], 4
je 0x10000c2ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006448]
mov edx, 0x14
mov r9, r12
mov dword [rsp + 0x20], edi
call fcn.10000b964
cmp edi, r15d
jl 0x10000c2f8
cmp ebp, r15d
cmove ebp, ebx
mov edx, dword [rsp + 0x40]
lea eax, [r14 + r14]
mov ecx, 0xfffffffe
sub ecx, eax
lea r12, [r12 + r14*2 + 2]
xor eax, eax
add edx, ecx
or rcx, 0xffffffffffffffff
mov rdi, r12
mov dword [rsp + 0x40], edx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r14, rcx
jne 0x10000c210
mov ebx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000c3a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x100025288]
lea rsi, [0x100025288]
cmp rcx, rsi
je 0x10000c3a0
test byte [rcx + 0x1c], 4
je 0x10000c3a0
mov edx, 0x15
jmp 0x10000c38d
mov rcx, qword [0x100025288]
lea rsi, [0x100025288]
cmp rcx, rsi
je 0x10000c3a0
test byte [rcx + 0x1c], 4
je 0x10000c3a0
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006448]
mov r9d, ebx
call fcn.100009850
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r15d
jge 0x10000c3b7
cmp ebp, r15d
cmovne ebx, r15d
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100020bc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret