Function at 0x140003ac0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov dword [rsp + 0x50], 0xff
mov rdi, rdx
mov qword [rsp + 0x60], rax
mov r13, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r14d, eax
lea edx, [rax + 1]
mov dword [rsp + 0x40], eax
lea ecx, [rax + 0x48]
mov dword [rsp + 0x44], eax
mov esi, eax
mov r12d, eax
call fcn.1400227ec
or ebx, 0xffffffff
mov r15, rax
test rax, rax
je 0x140003e80
mov qword [rax + 0x28], 0x100
mov edx, 0x100
mov qword [rax + 0x20], 0x8000000
xor eax, eax
mov dword [r15 + 0x30], eax
mov dword [r15 + 0x38], 1
mov qword [r15 + 0x40], rax
lea ecx, [rax + 1]
call fcn.1400227ec
mov qword [r15], rax
mov qword [r15 + 8], rax
test rax, rax
jne 0x140003b84
mov rcx, r15
call fcn.140020360
xor r15d, r15d
jmp 0x140003e80
xor ebx, ebx
mov rcx, 0xffffffff80000002
cmp dword [r13 + 0x40048], 2
mov qword [rsp + 0x58], rcx
jg 0x140003c19
mov rcx, qword [r13 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140003e00
xor r13d, r13d
lea rdx, [rsp + 0x58]
mov ecx, 0xf003f
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140003c04
mov dword [rsp + 0x38], eax
lea r8d, [rbx + 0x3e]
lea rax, str.unable_to_open_users_registry_hive__ERROR____d
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.get_user_root
mov qword [rsp + 0x28], r13
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov dword [rsp + 0x20], 5
call fcn.140008ef0
or ebx, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
jne 0x140003e00
mov rcx, qword [rsp + 0x58]
jmp 0x140003c1c
xor r13d, r13d
lea rax, [rsp + 0x60]
mov r9d, 0x20108
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003e00
mov ebx, esi
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x50], 0xff
test rcx, rcx
je 0x140003c6d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r13
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r13
mov edx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
test eax, eax
jne 0x140003e00
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003c50
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140039f18]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003c50
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003c50
test r14, r14
je 0x140003d34
mov rcx, r14
call fcn.140020360
test rsi, rsi
je 0x140003d41
mov rcx, rsi
call fcn.140020360
mov ecx, dword [rsp + 0x40]
mov rsi, r13
call fcn.140020374
mov r14, rax
test rax, rax
je 0x140003df4
mov ecx, dword [rsp + 0x44]
call fcn.140020374
mov rsi, rax
test rax, rax
je 0x140003df4
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140039f18]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003df4
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.comment
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003df4
mov r8d, dword [rsp + 0x40]
mov rdx, r14
mov rcx, r15
call fcn.14000a0a0
test eax, eax
jne 0x140003df4
mov r8d, dword [rsp + 0x44]
mov rdx, rsi
mov rcx, r15
call fcn.14000a0a0
test eax, eax
jne 0x140003df4
inc r12d
jmp 0x140003c50
or ebx, 0xffffffff
jmp 0x140003e80
xor ebx, ebx
mov rcx, rdi
lea edx, [rbx + 1]
call fcn.140009490
test eax, eax
jne 0x140003e25
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rdi]
add rbx, rcx
lea rax, [rcx + 1]
mov qword [rdi + 0x18], rax
jmp 0x140003e27
js 0x140003e00
mov byte [rbx], 0xc
mov rcx, rdi
xor ebx, ebx
lea edx, [rbx + 4]
call fcn.140009490
test eax, eax
jne 0x140003e4f
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rdi]
add rbx, rcx
lea rax, [rcx + 4]
mov qword [rdi + 0x18], rax
jmp 0x140003e51
js 0x140003e00
mov eax, r12d
mov rdx, r15
shr eax, 0x18
mov rcx, rdi
mov byte [rbx], al
mov eax, r12d
shr eax, 0x10
mov byte [rbx + 1], al
mov eax, r12d
shr eax, 8
mov byte [rbx + 2], al
mov byte [rbx + 3], r12b
call fcn.140009f30
test eax, eax
jne 0x140003e00
xor ebx, ebx
test r14, r14
je 0x140003e8d
mov rcx, r14
call fcn.140020360
test rsi, rsi
je 0x140003e9a
mov rcx, rsi
call fcn.140020360
test r15, r15
je 0x140003ea7
mov rcx, r15
call fcn.1400092d0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003eb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003ec7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003ed7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140018df0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret