Function at 0x1000044b4
Capabilities:
Query or enumerate registry key

Disassembly:
cmp al, 0x61
jl 0x100008fbb
cmp al, 0x66
jg 0x100008fbb
movsx edx, al
sub edx, 0x57
jmp 0x100004599
movsx edx, al
sub edx, ebp
jmp 0x100004790
cmp al, 0x61
jl 0x10000905c
cmp al, 0x66
jg 0x10000905c
movsx ecx, al
sub ecx, 0x57
jmp 0x1000047ab
movsx ecx, al
sub ecx, ebp
jmp 0x100004896
cmp al, 0x61
jl 0x100008fd6
cmp al, 0x66
jg 0x100008fd6
movsx ecx, al
sub ecx, 0x57
jmp 0x1000045b4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rcx, qword [0x10001dad8]
lea rax, [r11 - 0x40]
lea rdx, [0x100016024]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rsi, [r11 - 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
xor edi, edi
mov ebp, 0x30
cmp eax, edi
jne 0x1000045dc
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000045dc
mov r9d, edi
lea r8, [rsp + 0x81]
mov al, byte [r8 - 1]
cmp al, bpl
jl 0x10000385b
cmp al, 0x39
jg 0x10000385b
movsx edx, al
sub edx, ebp
jmp 0x100004599
mov al, byte [r8]
cmp al, bpl
jl 0x100004492
cmp al, 0x39
jg 0x100004492
movsx ecx, al
sub ecx, ebp
jmp 0x1000045b4
cmp edx, edi
jl 0x100008ff1
cmp ecx, edi
jl 0x100008ff1
shl dl, 4
add r9d, 2
add r8, 2
add dl, cl
mov byte [rsi], dl
inc rsi
cmp r9d, 8
jb 0x10000457d
mov rcx, qword [0x10001dad8]
lea rax, [rsp + 0x68]
lea rdx, str.Skew1
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000046d1
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000046d1
mov r9d, edi
lea r8, [rsp + 0x81]
mov al, byte [r8 - 1]
cmp al, bpl
jl 0x100008ff8
cmp al, 0x39
jg 0x100008ff8
movsx edx, al
sub edx, ebp
jmp 0x10000468e
mov al, byte [r8]
cmp al, bpl
jl 0x100004931
cmp al, 0x39
jg 0x100004931
movsx ecx, al
sub ecx, ebp
jmp 0x1000046a9
cmp edx, edi
jl 0x100008ff1
cmp ecx, edi
jl 0x100008ff1
shl dl, 4
add r9d, 2
add r8, 2
add dl, cl
mov byte [rsi], dl
inc rsi
cmp r9d, 8
jb 0x100004672
mov rcx, qword [0x10001dad8]
lea rax, [rsp + 0x68]
lea rdx, [0x100016040]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000047d3
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000047d3
mov r9d, edi
lea r8, [rsp + 0x81]
mov al, byte [r8 - 1]
cmp al, bpl
jl 0x100004778
cmp al, 0x39
jle 0x100003876
cmp al, 0x61
jl 0x100009041
cmp al, 0x66
jg 0x100009041
movsx edx, al
sub edx, 0x57
jmp 0x100004790
mov al, byte [r8]
cmp al, bpl
jl 0x100003880
cmp al, 0x39
jg 0x100003880
movsx ecx, al
sub ecx, ebp
jmp 0x1000047ab
cmp edx, edi
jl 0x100008ff1
cmp ecx, edi
jl 0x100008ff1
shl dl, 4
add r9d, 2
add r8, 2
add dl, cl
mov byte [rsi], dl
inc rsi
cmp r9d, 8
jb 0x100004767
mov rcx, qword [0x10001dad8]
lea rax, [rsp + 0x68]
lea rdx, [0x100016048]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000048d9
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000048d9
mov r9d, edi
lea r8, [rsp + 0x81]
or r10d, 0xffffffff
mov al, byte [r8 - 1]
cmp al, bpl
jl 0x10000487e
cmp al, 0x39
jle 0x10000389b
cmp al, 0x61
jl 0x100009077
cmp al, 0x66
jg 0x100009077
movsx ecx, al
sub ecx, 0x57
jmp 0x100004896
mov al, byte [r8]
cmp al, bpl
jl 0x100009092
cmp al, 0x39
jg 0x100009092
movsx edx, al
sub edx, ebp
jmp 0x1000048b1
cmp ecx, edi
jl 0x100008ff1
cmp edx, edi
jl 0x100008ff1
shl cl, 4
add r9d, 2
add r8, 2
add cl, dl
mov byte [rsi], cl
inc rsi
cmp r9d, 8
jb 0x10000486d
mov r8d, 0x10
lea r9, [0x100000000]
movzx edx, byte [rdi + r9 + 0x1d9c0]
mov cl, byte [rsp + rdi + 0x70]
inc rdi
sub r8, 1
mov byte [rdx + r9 + 0x1d8c0], cl
jne 0x1000048e6
lea eax, [r8 + 1]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp al, 0x61
jl 0x100009026
cmp al, 0x66
jg 0x100009026
movsx ecx, al
sub ecx, 0x57
jmp 0x1000046a9
cmp al, 0x41
jl 0x100008fce
cmp al, 0x46
jg 0x100008fce
movsx edx, al
sub edx, 0x37
jmp 0x100004599
or edx, 0xffffffff
jmp 0x100004599
cmp al, 0x41
jl 0x100008fe9
cmp al, 0x46
jg 0x100008fe9
movsx ecx, al
sub ecx, 0x37
jmp 0x1000045b4
or ecx, 0xffffffff
jmp 0x1000045b4
xor eax, eax
jmp 0x100004908
cmp al, 0x61
jl 0x10000900b
cmp al, 0x66
jg 0x10000900b
movsx edx, al
sub edx, 0x57
jmp 0x10000468e
cmp al, 0x41
jl 0x10000901e
cmp al, 0x46
jg 0x10000901e
movsx edx, al
sub edx, 0x37
jmp 0x10000468e
or edx, 0xffffffff
jmp 0x10000468e
cmp al, 0x41
jl 0x100009039
cmp al, 0x46
jg 0x100009039
movsx ecx, al
sub ecx, 0x37
jmp 0x1000046a9
or ecx, 0xffffffff
jmp 0x1000046a9
cmp al, 0x41
jl 0x100009054
cmp al, 0x46
jg 0x100009054
movsx edx, al
sub edx, 0x37
jmp 0x100004790
or edx, 0xffffffff
jmp 0x100004790
cmp al, 0x41
jl 0x10000906f
cmp al, 0x46
jg 0x10000906f
movsx ecx, al
sub ecx, 0x37
jmp 0x1000047ab
or ecx, 0xffffffff
jmp 0x1000047ab
cmp al, 0x41
jl 0x10000908a
cmp al, 0x46
jg 0x10000908a
movsx ecx, al
sub ecx, 0x37
jmp 0x100004896
mov ecx, r10d
jmp 0x100004896
cmp al, 0x61
jl 0x1000090a5
cmp al, 0x66
jg 0x1000090a5
movsx edx, al
sub edx, 0x57
jmp 0x1000048b1
cmp al, 0x41
jl 0x1000090b8
cmp al, 0x46
jg 0x1000090b8
movsx edx, al
sub edx, 0x37
jmp 0x1000048b1
mov edx, r10d
jmp 0x1000048b1