Function at 0x100002620
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20a0
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x100004100]
xor rax, rsp
mov qword [rsp + 0x2090], rax
xor ebx, ebx
mov edi, 0x2000
lea rcx, [rsp + 0x90]
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x38], ebx
mov ebp, ebx
call sub.ntdll.dll_memset
lea rdx, [0x1000015a0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, ebx
je 0x1000026de
lea rcx, [0x100001628]
mov edx, eax
call fcn.1000017d8
or eax, 0xffffffff
jmp 0x10000288b
lea rdx, [0x100001660]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x40]
mov r8d, 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, ebx
je 0x100002738
lea rcx, [0x100001678]
mov edx, eax
call fcn.1000017d8
mov ebx, 0xfffffffe
jmp 0x10000287e
mov edx, dword [rsp + 0x94]
cmp edx, 7
je 0x10000275a
lea rcx, [0x1000016a0]
call fcn.1000017d8
mov ebx, 0xfffffffd
jmp 0x10000287e
lea rsi, [rsp + 0x9c]
lea r9, [0x1000016b8]
cmp word [rsi], bx
je 0x10000287e
mov rdi, rsi
mov r8d, 8
mov rdx, r9
sub rdi, r9
movzx ecx, word [rdi + rdx]
cmp cx, 0x5a
ja 0x100002795
cmp cx, 0x41
jb 0x100002795
add cx, 0x20
movzx eax, word [rdx]
cmp ax, 0x5a
ja 0x1000027a8
cmp ax, 0x41
jb 0x1000027a8
add ax, 0x20
add rdx, 2
add r8d, 0xffffffff
je 0x1000027bc
cmp cx, bx
je 0x1000027bc
cmp cx, ax
je 0x100002781
movzx eax, ax
movzx ecx, cx
mov rdi, rsi
sub ecx, eax
je 0x1000027ee
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov eax, ecx
lea ebp, [rbp + rcx + 1]
lea rsi, [rsi + rax*2 + 2]
cmp rsi, rbx
jne 0x100002769
jmp 0x10000287e
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
movsxd rax, ecx
lea rdx, [rsi + rax*2 + 2]
cmp word [rdx], bx
jne 0x100002818
mov word [rsi], bx
mov word [rsi + 2], bx
lea eax, [rbp + rbp]
jmp 0x100002840
mov edi, dword [rsp + 0x98]
shr edi, 1
sub edi, ecx
mov rcx, rsi
sub edi, ebp
mov r8d, edi
add r8, r8
call sub.ntdll.dll_memmove
lea edx, [rdi + 1]
lea eax, [rbp + rdi]
mov word [rsi + rdx*2], bx
add eax, eax
mov r9d, dword [rsp + 0x94]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x9c]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
cmp eax, ebx
je 0x10000287e
lea rcx, [0x1000016d0]
mov edx, eax
call fcn.1000017d8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.100002c70
lea r11, [rsp + 0x20a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret