Function at 0x10000c914
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov rax, qword [0x100012110]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x1c], r8d
mov rdi, rdx
mov qword [rbp + 0x20], rdx
mov rbx, rcx
mov qword [rbp + 0x10], rcx
xor eax, eax
mov esi, eax
mov dword [rbp + 4], eax
lea ecx, [rax + 0x5b]
call fcn.10000cecc
mov rcx, rdi
call fcn.10000cdc4
lea rcx, [0x10000201c]
call fcn.10000cdc4
xor r11d, r11d
mov eax, r11d
mov dword [rbp + 0x18], 0x100
mov edx, eax
inc eax
mov dword [rbp], eax
lea r8, [rbp + 8]
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov qword [rsp + 0x30], r8
lea rax, [rbp + 0xc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x18]
lea r8, [0x100012840]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
xor r11d, r11d
cmp eax, r11d
je 0x10000cb9c
lea ecx, [r11 + 0xa]
call fcn.10000cecc
mov r11d, dword [0x100012a44]
mov eax, 0x1e
cmp ebx, 0x103
cmovne r11d, eax
mov dword [0x100012a44], r11d
cmp esi, 1
jne 0x10000c9f7
inc dword [0x1000126f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r9, eax
lea ecx, [r9 + 0x100]
movsxd rdx, ecx
lea rcx, [rdx + rdx]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x10000ca24
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.100010630
sub rsp, rax
lea rsi, [rsp + 0x40]
mov qword [rbp + 0x40], rsi
xor ebx, ebx
mov eax, ebx
cmp rdx, rbx
je 0x10000ca4b
cmp rdx, 0x7fffffff
jbe 0x10000ca50
mov eax, 0x80070057
cmp eax, ebx
jl 0x10000ca93
mov rcx, rsi
cmp rdx, rbx
je 0x10000ca87
mov r8d, 0x7ffffffe
sub r8, rdx
sub rdi, rsi
lea rax, [r8 + rdx]
cmp rax, rbx
je 0x10000ca87
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x10000ca87
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000ca68
cmp rdx, rbx
jne 0x10000ca90
sub rcx, 2
mov word [rcx], bx
lea rdi, [rsi + r9*2]
mov eax, 0x5c
mov word [rdi], ax
add rdi, 2
mov word [rdi], bx
mov dword [rbp], 1
mov r9d, 0xff
mov r8, rdi
xor edx, edx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
jne 0x10000cb78
mov ebx, dword [rbp + 0x1c]
or ebx, 9
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x10000cb45
mov dword [0x100012a44], ecx
mov r8d, dword [rbp + 0x1c]
mov rdx, rsi
mov rcx, qword [rbp + 0x28]
call fcn.10000c914
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp dword [rbp + 4], ecx
jne 0x10000cb32
mov eax, dword [0x100012a44]
cmp eax, ecx
jne 0x10000cb38
inc dword [0x1000126f0]
mov dword [rbp + 4], 1
jmp 0x10000cb38
mov eax, dword [0x100012a44]
cmp eax, 0x322
je 0x10000cd7c
jmp 0x10000cb4f
mov dword [0x100012a44], 0x6e
mov eax, dword [rbp]
mov edx, eax
inc eax
mov dword [rbp], eax
mov r9d, 0xff
mov r8, rdi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor r11d, r11d
cmp eax, r11d
je 0x10000cad0
cmp eax, 0x103
je 0x10000cd7c
mov dword [0x100012a44], 0x1e
jmp 0x10000cd7c
xor ebx, ebx
mov dword [0x100012a44], ebx
mov eax, dword [rbp + 0xc]
cmp eax, 1
je 0x10000cbbb
cmp eax, 2
je 0x10000cbbb
cmp eax, 7
je 0x10000cbbb
mov rax, rbx
jmp 0x10000cbc0
mov eax, 2
mov edx, dword [rbp + 8]
add rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov qword [rbp + 0x30], rax
cmp rax, rbx
je 0x10000cd66
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xc]
xor r8d, r8d
lea rdx, [0x100012840]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10000cc1a
mov dword [0x100012a44], 0x322
jmp 0x10000cd54
cmp dword [rbp + 0x18], ebx
je 0x10000cc2d
lea rcx, [0x100012840]
call fcn.10000cdf4
jmp 0x10000cc37
mov ecx, 0x40
call fcn.10000cecc
mov ecx, 0x3d
call fcn.10000cecc
mov ebx, dword [rbp + 0xc]
mov eax, ebx
sub eax, 1
je 0x10000cd3a
cmp eax, 3
jne 0x10000cc7d
mov edi, dword [rbp + 8]
cmp edi, 4
jne 0x10000cc80
lea rcx, [0x100001568]
call fcn.10000cdc4
lea edx, [rdi - 3]
mov ecx, dword [rsi]
call fcn.10000ce50
mov rdi, qword [rbp + 0x20]
xor ebx, ebx
jmp 0x10000cd4a
mov edi, dword [rbp + 8]
lea rcx, [0x100001560]
call fcn.10000cdc4
cmp ebx, 3
je 0x10000ccae
mov ecx, 0x28
call fcn.10000cecc
xor edx, edx
mov ecx, ebx
call fcn.10000ce50
mov ecx, 0x29
call fcn.10000cecc
mov ecx, 0x3a
call fcn.10000cecc
xor ebx, ebx
lea r11d, [rbx + 1]
cmp edi, ebx
je 0x10000cd46
dec edi
cmp dword [0x100052a6c], 0x4b
jle 0x10000cce8
cmp r11d, ebx
jne 0x10000cce8
lea rcx, [0x100001598]
call fcn.10000cdc4
mov r11d, 1
cmp r11d, ebx
jne 0x10000ccf7
mov ecx, 0x2c
call fcn.10000cecc
movzx eax, byte [rsi]
inc rsi
mov rbx, rax
shr rax, 4
lea rcx, [0x100001578]
movzx ecx, word [rcx + rax*2]
call fcn.10000cecc
and ebx, 0xf
lea rax, [0x100001578]
movzx ecx, word [rax + rbx*2]
call fcn.10000cecc
xor ebx, ebx
mov r11d, ebx
cmp edi, ebx
jne 0x10000ccc6
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x20]
jmp 0x10000cd4a
mov rcx, rsi
call fcn.10000cdf4
xor ebx, ebx
jmp 0x10000cd4a
mov rdi, qword [rbp + 0x20]
mov ecx, 0xa
call fcn.10000cecc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r11d, dword [0x100012a44]
jmp 0x10000cd73
mov r11d, 0x322
mov dword [0x100012a44], r11d
cmp r11d, 0x322
jne 0x10000cd7e
jmp 0x10000cd9e
cmp r11d, ebx
mov eax, dword [rbp]
mov esi, dword [rbp + 4]
mov rbx, qword [rbp + 0x10]
jne 0x10000c977
mov esi, 1
mov dword [rbp + 4], esi
jmp 0x10000c977
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.100010090
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
lea rsp, [rbp + 0x50]
pop rbp
ret