Function at 0x10005d50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov r11, rsp
sub rsp, 0x2f8
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x2b0], rax
mov r12, r8
mov r13, rdx
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov rbx, qword [rsp + 0x320]
mov r14, qword [rsp + 0x328]
xor edi, edi
xor esi, esi
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x278], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [r11 - 0x268]
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1a0]
call sub.msvcrt.dll_memset
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10005e19
lea edi, [rsi - 1]
jmp 0x100062b4
mov ecx, dword [rsp + 0x338]
test ecx, ecx
je 0x100060c9
dec ecx
je 0x10006020
dec ecx
je 0x10005e44
dec ecx
jne 0x100062b4
lea edi, [rcx + 1]
jmp 0x100062b4
xor r12d, r12d
nop
nop
nop
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x90]
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1a0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], 0x20
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
inc esi
mov dword [rsp + 0x54], esi
test eax, eax
jne 0x100062b4
mov eax, dword [rsp + 0x318]
dec eax
je 0x10005fd1
dec eax
je 0x10005fa1
dec eax
je 0x10005f7e
dec eax
je 0x10005f3f
sub eax, 3
jne 0x10005fff
lea r9, str.REG_MULTI_SZ
lea r8, [rsp + 0x68]
lea rdx, str.__24s___15s__r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x10005fff
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.REG_DWORD
lea r8, [rsp + 0x68]
lea rdx, str.__24s___15s_0x_x__d___r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x10005fff
lea r9, str.REG_BINARY
lea r8, [rsp + 0x68]
lea rdx, str.__24s___15s__r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x10005fff
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.REG_EXPAND_SZ
lea r8, [rsp + 0x68]
lea rdx, str.__24s___15s__s__r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x10005fff
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.REG_SZ
lea r8, [rsp + 0x68]
lea rdx, str.__24s___15s__s__r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, 1
jmp 0x10005e50
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x90]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x40], 0x104
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
mov dword [rsp + 0x54], esi
test eax, eax
jne 0x100062b4
lea r8, [rsp + 0x90]
lea rdx, str.__s__r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x100060b0
mov edi, 1
jmp 0x10006020
mov eax, dword [rsp + 0x318]
test eax, eax
je 0x100062b4
cmp eax, 2
jbe 0x10006251
cmp eax, 3
je 0x10006215
cmp eax, 4
je 0x100061b9
cmp eax, 7
jne 0x100062b4
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x318]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100062b4
lea rdi, [rsp + 0x90]
cmp byte [rdi], 0
je 0x1000618c
mov r8d, 0x104
mov rdx, rdi
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.msvcrt.dll_strncat]
mov r8d, 0x104
lea rdx, [0x100138b8]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.msvcrt.dll_strncat]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strchr]
lea rdi, [rax + 1]
jmp 0x10006144
lea rcx, [rsp + 0x1a0]
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rbx], al
inc rcx
inc rbx
test al, al
jne 0x100061a0
mov edi, 1
jmp 0x100062b4
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x318]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100062b4
mov r8d, dword [rsp + 0x50]
lea rdx, [0x10013b78]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
jmp 0x100062b4
mov eax, dword [rsp + 0x330]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x318]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100062b4
lea edi, [rax + 1]
jmp 0x100062b4
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x318]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100062b4
lea rcx, [rsp + 0x90]
call fcn.10005ce0
nop
nop
movzx ecx, byte [rax]
mov byte [rbx], cl
inc rax
inc rbx
test cl, cl
jne 0x100062a0
mov edi, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2b0]
call fcn.100120f0
mov rbx, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2e0]
mov r12, qword [rsp + 0x2d8]
mov r13, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2c8]
mov r15, qword [rsp + 0x2c0]
add rsp, 0x2f8
ret