Function at 0x140003350
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov dword [rsp + 0x50], 0xff
mov rdi, rdx
mov qword [rsp + 0x60], rax
mov r13, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r14d, eax
lea edx, [rax + 1]
mov dword [rsp + 0x40], eax
lea ecx, [rax + 0x48]
mov dword [rsp + 0x44], eax
mov esi, eax
mov r12d, eax
call fcn.1400200e4
or ebx, 0xffffffff
mov r15, rax
test rax, rax
je 0x1400036e0
mov qword [rax + 0x28], 0x100
mov edx, 0x100
mov qword [rax + 0x20], 0x8000000
xor eax, eax
mov dword [r15 + 0x30], eax
mov dword [r15 + 0x38], 1
mov qword [r15 + 0x40], rax
lea ecx, [rax + 1]
call fcn.1400200e4
mov qword [r15], rax
mov qword [r15 + 8], rax
test rax, rax
jne 0x140003414
mov rcx, r15
call fcn.14001da20
xor r15d, r15d
jmp 0x1400036e0
xor ebx, ebx
mov rcx, 0xffffffff80000002
cmp dword [r13 + 0x40048], 2
mov qword [rsp + 0x58], rcx
jg 0x140003480
mov rcx, qword [r13 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140003660
xor r13d, r13d
lea rdx, [rsp + 0x58]
mov ecx, 0xf003f
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x14000346b
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.140007d10
or ebx, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
jne 0x140003660
mov rcx, qword [rsp + 0x58]
jmp 0x140003483
xor r13d, r13d
lea rax, [rsp + 0x60]
mov r9d, 0x20108
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003660
mov ebx, esi
nop dword [rax]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x50], 0xff
test rcx, rcx
je 0x1400034cd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r13
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r13
mov edx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
test eax, eax
jne 0x140003660
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400034b0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140038178]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400034b0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400034b0
test r14, r14
je 0x140003594
mov rcx, r14
call fcn.14001da20
test rsi, rsi
je 0x1400035a1
mov rcx, rsi
call fcn.14001da20
mov ecx, dword [rsp + 0x40]
mov rsi, r13
call fcn.14001da34
mov r14, rax
test rax, rax
je 0x140003654
mov ecx, dword [rsp + 0x44]
call fcn.14001da34
mov rsi, rax
test rax, rax
je 0x140003654
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140038178]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003654
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003654
mov r8d, dword [rsp + 0x40]
mov rdx, r14
mov rcx, r15
call fcn.140008dc0
test eax, eax
jne 0x140003654
mov r8d, dword [rsp + 0x44]
mov rdx, rsi
mov rcx, r15
call fcn.140008dc0
test eax, eax
jne 0x140003654
inc r12d
jmp 0x1400034b0
or ebx, 0xffffffff
jmp 0x1400036e0
xor ebx, ebx
mov rcx, rdi
lea edx, [rbx + 1]
call fcn.140008460
test eax, eax
jne 0x140003685
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rdi]
add rbx, rcx
lea rax, [rcx + 1]
mov qword [rdi + 0x18], rax
jmp 0x140003687
js 0x140003660
mov byte [rbx], 0xc
mov rcx, rdi
xor ebx, ebx
lea edx, [rbx + 4]
call fcn.140008460
test eax, eax
jne 0x1400036af
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rdi]
add rbx, rcx
lea rax, [rcx + 4]
mov qword [rdi + 0x18], rax
jmp 0x1400036b1
js 0x140003660
mov eax, r12d
mov rdx, r15
shr eax, 0x18
mov rcx, rdi
mov byte [rbx], al
mov eax, r12d
shr eax, 0x10
mov byte [rbx + 1], al
mov eax, r12d
shr eax, 8
mov byte [rbx + 2], al
mov byte [rbx + 3], r12b
call fcn.140008cd0
test eax, eax
jne 0x140003660
xor ebx, ebx
test r14, r14
je 0x1400036ed
mov rcx, r14
call fcn.14001da20
test rsi, rsi
je 0x1400036fa
mov rcx, rsi
call fcn.14001da20
test r15, r15
je 0x140003707
mov rcx, r15
call fcn.1400082a0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003717
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003727
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003737
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400164b0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret