Function at 0x1000454bc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r13, r8
mov ebp, edx
mov r12, rcx
mov r14d, 1
cmp edx, r14d
je 0x100045689
cmp edx, 2
je 0x100045689
cmp edx, 3
jne 0x10004550d
lea rdx, [rcx + 8]
mov rcx, r8
call fcn.10001ecdc
mov eax, r14d
jmp 0x1000457f0
cmp edx, 0xe
jne 0x100045534
xor esi, esi
cmp dword [rcx + 0x28], esi
je 0x10004552d
lea rdx, [rcx + 0x10]
mov rcx, r8
call fcn.10001ecdc
mov eax, r14d
jmp 0x1000457f0
xor eax, eax
jmp 0x1000457f0
call fcn.100046600
xor esi, esi
cmp eax, esi
jne 0x100045546
xor eax, eax
jmp 0x1000457f0
cmp ebp, 0xb
jne 0x100045554
lea rdi, [0x10000e3d0]
jmp 0x100045580
cmp ebp, 0xc
jne 0x100045562
lea rdi, [0x10000e3e8]
jmp 0x100045580
cmp ebp, 0xd
jne 0x100045570
lea rdi, [0x10000bb08]
jmp 0x100045580
cmp ebp, 7
jne 0x100045677
lea rdi, [0x10000e410]
mov dword [rsp + 0x88], esi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100045668
mov ecx, dword [rsp + 0x88]
cmp ecx, r14d
jbe 0x100045668
add ecx, 4
mov dword [rsp + 0x88], ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, rsi
jne 0x1000455e3
xor eax, eax
jmp 0x1000457f0
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x88]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10004562e
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
jmp 0x1000457f0
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov r8d, ecx
mov rdx, rbx
mov rcx, r13
call fcn.10001fae8
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp dword [rsp + 0x88], esi
seta sil
mov eax, esi
jmp 0x1000457f0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000457f0
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000457f0
call fcn.100046600
xor esi, esi
cmp eax, esi
jne 0x10004569b
xor eax, eax
jmp 0x1000457f0
lea rcx, [rsp + 0x98]
call fcn.10001fee0
nop
mov rbx, qword [rsp + 0x98]
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x1000456dc
mov edx, edi
lea rcx, [rsp + 0x98]
call fcn.10001fc6c
mov rbx, qword [rsp + 0x98]
cmp dword [rbx - 0xc], edi
jge 0x1000456ec
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], si
mov eax, dword [rbx - 0x10]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x100005558]
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
cmp ecx, esi
jl 0x1000457e5
cmp ecx, dword [rbx - 0xc]
jg 0x1000457e5
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], si
cmp r11d, esi
je 0x100045774
lea rcx, [rsp + 0x98]
call fcn.10001fba0
xor eax, eax
jmp 0x1000457f0
cmp dword [rbx - 0x10], esi
jne 0x10004577b
jmp 0x1000457d4
cmp ebp, r14d
jne 0x100045796
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.10001ecdc
nop
mov esi, r14d
jmp 0x1000457d4
lea rcx, [rsp + 0x30]
call fcn.10001fee0
nop
lea rcx, [r12 + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x98]
call fcn.1000327cc
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10001ecdc
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
nop
mov esi, r14d
lea rcx, [rsp + 0x98]
call fcn.10001fba0
mov eax, esi
jmp 0x1000457f0
mov ecx, 0x80070057
call fcn.10001fd10
nop
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret