Function at 0x100043220
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r12d, r12d
mov rbp, rcx
mov rsi, r8
mov rdi, rdx
mov ebx, 0x206
lea rcx, [rsp + 0x62]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov word [rsp + 0x60], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x272]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x270], r12w
call sub.msvcrt.dll_memset
mov al, byte [0x100080fc0]
mov dword [rsp + 0x40], 1
cmp al, r12b
jne 0x1000432ad
mov eax, 0x80070015
jmp 0x1000434c0
cmp rdi, r12
je 0x1000434bb
cmp rsi, r12
je 0x1000434bb
mov rcx, rbp
call fcn.100042d80
cmp eax, r12d
je 0x1000432a3
lea rcx, [0x100080fb8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lea rdx, [rsp + 0x48]
lea rcx, [0x10007f368]
call qword [sym.imp.ole32.dll_StringFromCLSID]
lea rcx, [0x100080fb8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp ebx, r12d
jl 0x100043497
lea r8, [0x1000790d0]
lea rax, [rsp + 0x60]
mov r13d, 0x104
lea rcx, [rsp + 0x60]
mov ebx, r12d
sub r8, rax
mov rdx, r13
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100043347
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100043347
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100043323
cmp rdx, r12
jne 0x100043355
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x100043497
lea r8, [0x100075b3c]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100004b94
cmp eax, r12d
mov ebx, eax
jl 0x100043497
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r13
call fcn.100004b94
cmp eax, r12d
mov ebx, eax
jl 0x100043497
mov eax, dword [rsi]
lea rdx, [rsp + 0x60]
mov r9d, 2
add eax, eax
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov r13d, 0x80070000
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100043497
lea rax, [rsp + 0x50]
lea rdx, [0x1000749e0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100043497
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x270]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r13d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100043497
mov edx, dword [rsi]
lea r8, [0x1000790f4]
mov rcx, rdi
call fcn.100004b94
cmp eax, r12d
mov ebx, eax
jl 0x100043497
mov edx, dword [rsi]
lea r8, [rsp + 0x270]
mov rcx, rdi
call fcn.100004b94
mov ebx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x1000434a7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000434b7
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000434c0
mov eax, 0x80070057
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000012f0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret