Function at 0x1000068c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [rsp + 0xa0]
xor ebp, ebp
mov r13, rcx
and qword [rsi], rbp
mov r12d, edx
lea ecx, [rbp + 0x40]
xor r14d, r14d
mov edx, 0x1b8
mov r15, r9
and qword [rax - 0x48], r14
mov rbx, r8
lea edi, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov qword [rbx], rax
test rax, rax
jne 0x10000692c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x100006e7c
mov r8d, 4
lea r10, [0x100001d20]
lea rdx, [0x100001df0]
mov eax, r12d
lea rcx, [0x100001e70]
lea ebx, [r8 + 4]
and eax, edi
mov r15d, r12d
mov r9d, edi
mov dword [r11], eax
mov qword [r11 + 8], rdx
mov qword [r11 + 0x10], rcx
and r15d, r8d
lea rcx, [0x100001e90]
mov qword [r11 + 0x18], rcx
mov dword [r11 + 0x20], 0x18
mov dword [r11 + 0x24], edi
mov dword [r11 + 0x28], r15d
mov qword [r11 + 0x30], rdx
lea rcx, [0x100001ea8]
mov qword [r11 + 0x38], rcx
lea rcx, [0x100001738]
lea rdx, [0x100001f00]
mov qword [r11 + 0x40], rcx
mov dword [r11 + 0x48], r8d
mov dword [r11 + 0x4c], r8d
mov dword [r11 + 0x50], eax
mov qword [r11 + 0x58], r10
lea rax, [0x100001ed0]
mov qword [r11 + 0x60], rax
lea rax, [0x100001e6c]
lea ecx, [rbx - 2]
mov qword [r11 + 0x68], rax
mov dword [r11 + 0x70], 2
mov dword [r11 + 0x74], edi
mov eax, r12d
and eax, ebx
mov dword [r11 + 0x78], eax
lea rax, [0x100001d60]
mov qword [r11 + 0x80], rax
lea rax, [0x100001ee8]
mov qword [r11 + 0x88], rax
mov qword [r11 + 0x90], rdx
mov dword [r11 + 0x98], r8d
mov dword [r11 + 0x9c], edi
mov eax, r12d
and eax, 2
mov dword [r11 + 0xa0], eax
mov qword [r11 + 0xa8], r10
lea rax, [0x100001f08]
mov qword [r11 + 0xb0], rax
mov qword [r11 + 0xb8], rdx
mov dword [r11 + 0xc0], r8d
mov dword [r11 + 0xc4], edi
mov dword [r11 + 0xc8], r15d
mov qword [r11 + 0xd0], r10
lea rax, [0x100001f28]
mov qword [r11 + 0xd8], rax
lea rax, [0x100001f44]
mov qword [r11 + 0xe0], rax
mov dword [r11 + 0xe8], ecx
mov dword [r11 + 0xec], edi
mov eax, r12d
and eax, 0x40
mov dword [r11 + 0xf0], eax
mov qword [r11 + 0xf8], r10
lea rax, [0x100001f50]
mov qword [r11 + 0x100], rax
lea rax, [0x100001f70]
mov qword [r11 + 0x108], rax
mov dword [r11 + 0x110], ecx
mov dword [r11 + 0x114], edi
lea rcx, [0x100001f78]
mov eax, r12d
shr eax, 7
not eax
and eax, edi
mov dword [r11 + 0x118], eax
mov qword [r11 + 0x120], r10
mov qword [r11 + 0x128], rcx
lea rcx, [0x10000173c]
mov qword [r11 + 0x130], rcx
mov dword [r11 + 0x138], r8d
mov dword [r11 + 0x13c], r8d
mov dword [r11 + 0x140], eax
mov qword [r11 + 0x148], r10
lea rax, [0x100001fa0]
mov qword [r11 + 0x150], rax
mov qword [r11 + 0x158], rdx
mov dword [r11 + 0x160], r8d
mov dword [r11 + 0x164], edi
mov eax, r12d
lea ebp, [rbx + 2]
and eax, 0x10
mov dword [r11 + 0x168], eax
lea rax, [0x100001cf0]
mov qword [r11 + 0x170], rax
lea rax, [0x100001fc0]
mov qword [r11 + 0x178], rax
lea rax, [0x100001fe8]
mov qword [r11 + 0x180], rax
mov dword [r11 + 0x188], ebx
mov dword [r11 + 0x18c], edi
test r15d, r15d
jne 0x100006b86
test r12b, 0x20
je 0x100006e74
lea rax, [rsp + 0x30]
lea rdx, [0x100001ff0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r13, [0x100002020]
test eax, eax
jne 0x100006c20
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100006c20
mov edx, dword [rsp + 0xa0]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x100006c57
lea rcx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x30]
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100006c57
mov rcx, qword [rsi]
test rcx, rcx
je 0x100006c2e
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov rdx, rbx
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x100006c57
mov rcx, qword [0x10000b1a0]
mov qword [rax], rcx
mov dword [rsp + 0xa0], ebx
jmp 0x100006c5e
mov ebx, dword [rsp + 0xa0]
mov rdx, qword [rsi]
test rdx, rdx
je 0x100006e74
test r12b, 0x20
je 0x100006ca6
test edi, edi
jne 0x100006c80
lea eax, [rbx*8 - 1]
cmp eax, 0xd
jb 0x100006c8f
btr dword [rdx], 0xd
test edi, edi
jne 0x100006c9b
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 0xd
jb 0x100006ca6
btr dword [rdx], 0xd
mov ebx, dword [rsp + 0xa0]
mov ebp, 0xb
test r15d, r15d
je 0x100006e2c
mov ecx, 0xfffffffd
mov r9d, 0xfffffff7
mov r8d, 0xfffffffb
test edi, edi
jne 0x100006cd5
lea eax, [rbx*8 - 1]
cmp eax, 1
jb 0x100006ce2
and dword [rdx], ecx
test edi, edi
jne 0x100006cee
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 1
jb 0x100006cfb
and dword [rdx], ecx
test edi, edi
jne 0x100006d07
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 9
jb 0x100006d16
btr dword [rdx], 9
test edi, edi
jne 0x100006d22
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 9
jb 0x100006d31
btr dword [rdx], 9
test edi, edi
jne 0x100006d3c
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, ebp
jb 0x100006d4b
btr dword [rdx], 0xb
test edi, edi
jne 0x100006d56
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, ebp
jb 0x100006d65
btr dword [rdx], 0xb
test edi, edi
jne 0x100006d71
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 0xc
jb 0x100006d80
btr dword [rdx], 0xc
test edi, edi
jne 0x100006d8c
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 0xc
jb 0x100006d9b
btr dword [rdx], 0xc
test edi, edi
jne 0x100006da7
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 2
jb 0x100006db5
and dword [rdx], r8d
test edi, edi
jne 0x100006dc1
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 2
jb 0x100006dcf
and dword [rdx], r8d
test edi, edi
jne 0x100006ddb
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 3
jb 0x100006de9
and dword [rdx], r9d
test edi, edi
jne 0x100006df5
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 3
jb 0x100006e03
and dword [rdx], r9d
test edi, edi
jne 0x100006e0f
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 0x21
jb 0x100006e1d
and dword [rdx + 4], ecx
test edi, edi
jne 0x100006e29
mov ebx, dword [rsp + 0xa0]
lea eax, [rbx*8 - 1]
cmp eax, 0x21
jb 0x100006e2c
and dword [rdx + 4], ecx
mov rcx, qword [rsp + 0x90]
lea rax, [0x100001d20]
mov rcx, qword [rcx]
mov dword [rcx + 0x190], 1
mov qword [rcx + 0x198], rax
mov qword [rcx + 0x1a0], r13
mov qword [rcx + 0x1a8], rdx
mov eax, dword [rsp + 0xa0]
mov dword [rcx + 0x1b0], eax
mov dword [rcx + 0x1b4], 3
mov r15, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x100006e8c
call qword [entry0]
mov rbx, qword [rsp + 0x80]
mov dword [r15], ebp
mov eax, r14d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret