Function at 0x100002f3c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x898
mov rax, qword [0x10000e110]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov rax, qword [rsp + 0x910]
mov r14, qword [rsp + 0x908]
mov r15, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x918]
mov r12, rdx
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbp, r9
mov rsi, r8
lea rdi, [rsp + 0x70]
mov ecx, 0x802
rep stosb byte [rdi], al
lea edi, [rax + 1]
lea rdx, [0x100001550]
mov r8d, edi
xor r9d, r9d
mov rcx, r15
mov ebx, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], rax
mov r13, rax
mov qword [rsp + 0x50], rax
call fcn.10000799c
test eax, eax
je 0x100002fef
lea rdx, [0x100001578]
xor r9d, r9d
mov r8d, edi
mov rcx, r15
call fcn.10000799c
test eax, eax
jne 0x100002ff1
mov ebx, edi
lea rdx, [0x100001588]
xor r9d, r9d
mov r8d, edi
mov rcx, r15
call fcn.10000799c
test eax, eax
je 0x100003023
lea rdx, [0x1000015b0]
xor r9d, r9d
mov r8d, edi
mov rcx, r15
call fcn.10000799c
test eax, eax
jne 0x10000302e
mov r15d, 2
mov ebx, r15d
jmp 0x100003034
mov r15d, 2
test r14, r14
je 0x1000030e1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000030e1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rax + 0x14]
call fcn.10000852c
mov r13, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x100003087
mov edx, 0x20001
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.1000064e0
jmp 0x10000388d
mov rcx, r14
call fcn.100008fb8
mov rcx, r13
test eax, eax
jne 0x1000030cb
call fcn.1000086d4
lea rdx, [0x100001478]
mov rcx, r13
movsxd r8, eax
shr r8, 1
call fcn.1000077f8
mov rcx, r13
call fcn.1000086d4
mov rdx, r14
mov rcx, r13
movsxd r8, eax
shr r8, 1
call fcn.1000078a0
jmp 0x1000030e1
call fcn.1000086d4
mov rdx, r14
mov rcx, r13
movsxd r8, eax
shr r8, 1
call fcn.1000077f8
test rsi, rsi
je 0x1000030f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1000030f5
xor esi, esi
test ebx, ebx
je 0x100003862
sub ebx, edi
mov r14d, edi
je 0x1000035a2
cmp ebx, edi
jne 0x10000353d
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000001
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x100003141
xor edx, edx
mov ecx, eax
call fcn.1000043cc
lea rcx, [rsp + 0x50]
call fcn.100008450
jmp 0x10000388d
lea rcx, [rsp + 0x50]
call fcn.100008450
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, r14d
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100003551
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x10001
test eax, eax
je 0x100003387
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1000031c5
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
test r12, r12
jne 0x1000031ce
xor edi, edi
jmp 0x1000031d9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test rsi, rsi
jne 0x1000031e2
xor eax, eax
jmp 0x1000031eb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r13d, [rax + rdi + 0x64]
lea ecx, [r13 + r13]
call fcn.10000852c
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x100003233
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10000388d
mov edx, ebx
jmp 0x100003072
test r12, r12
je 0x100003263
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100003263
mov r8d, r13d
mov rdx, r12
mov rcx, rdi
call fcn.1000077f8
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000078a0
jmp 0x1000032a3
lea rcx, [0x1000015b0]
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
call fcn.10000799c
test eax, eax
je 0x1000032a3
lea rcx, [0x100001588]
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
call fcn.10000799c
test eax, eax
je 0x1000032a3
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000077f8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, r14d
xor r8d, r8d
mov rdx, rdi
lea rsi, [0x1000015bc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000033d1
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rdx, [0x1000015bc]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10000337d
cmp eax, 0xa1
je 0x100003315
cmp eax, r15d
je 0x100003315
xor edx, edx
mov ecx, eax
call fcn.1000043cc
jmp 0x100003332
mov ecx, 0x1f7
call fcn.1000067b4
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov rdx, rax
call fcn.100007a80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100003353
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100003132
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
jmp 0x100003132
lea rcx, [rsp + 0x50]
call fcn.100008450
mov edx, dword [rsp + 0x30]
cmp edx, 0xfe
jbe 0x100003409
add edx, edx
mov rcx, rbp
call fcn.1000085cc
test eax, eax
jne 0x100003409
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, 0x20001
add rcx, 0x60
call fcn.1000064e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000388d
cmp eax, 0xa1
je 0x1000033e2
mov ecx, 0x1f6
cmp eax, r15d
jne 0x1000033e7
mov ecx, 0x1f7
call fcn.1000067b4
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov rdx, rax
call fcn.100007a80
mov rcx, qword [rsp + 0x38]
jmp 0x100003358
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100003495
cmp eax, 0xa1
je 0x10000344d
cmp eax, r15d
je 0x10000344d
xor edx, edx
mov ecx, eax
call fcn.1000043cc
jmp 0x10000346a
mov ecx, 0x1f7
call fcn.1000067b4
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov rdx, rax
call fcn.100007a80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10000348b
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
mov rcx, qword [rsp + 0x40]
jmp 0x10000321e
mov rcx, qword [rbp]
test rcx, rcx
je 0x1000034e6
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp eax, 0x400
jbe 0x1000034e6
mov rdx, qword [rbp]
lea rcx, [rsp + 0x70]
mov r8d, 0x401
call fcn.1000077f8
mov ecx, dword [rsp + 0x30]
mov rdi, qword [rbp]
xor eax, eax
lea rdx, [rsp + 0x70]
mov r8d, esi
rep stosb byte [rdi], al
mov rcx, qword [rbp]
call fcn.1000077f8
mov rdx, qword [rsp + 0x58]
mov dword [rdx], r14d
cmp dword [rsp + 0x48], 4
jne 0x100003509
mov rdi, qword [rbp]
jmp 0x100003834
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.100006330
jmp 0x10000306d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10000352a
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10000322c
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov eax, dword [rsp + 0x48]
jmp 0x100003892
cmp eax, 0xa1
je 0x100003568
cmp eax, r15d
je 0x100003568
xor edx, edx
mov ecx, eax
call fcn.1000043cc
jmp 0x100003585
mov ecx, 0x1f7
call fcn.1000067b4
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov rdx, rax
call fcn.100007a80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10000388d
mov edx, 0x10001
jmp 0x100003072
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x100003129
lea rcx, [rsp + 0x50]
call fcn.100008450
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, r14d
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100003551
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 0x1fc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x10001
test eax, eax
je 0x10000377c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10000364b
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, ebx
add rcx, 0x60
call fcn.1000064e0
test r12, r12
jne 0x100003654
xor edi, edi
jmp 0x10000365f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test rsi, rsi
jne 0x100003668
xor eax, eax
jmp 0x100003671
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r13d, [rax + rdi + 0x64]
lea ecx, [r13 + r13]
call fcn.10000852c
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x100003207
test r12, r12
je 0x1000036d3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000036d3
mov r8d, r13d
mov rdx, r12
mov rcx, rdi
call fcn.1000077f8
lea rdx, [0x100001480]
mov r8d, r13d
mov rcx, rdi
call fcn.1000078a0
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000078a0
jmp 0x100003713
lea rcx, [0x100001578]
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
call fcn.10000799c
test eax, eax
je 0x100003713
lea rcx, [0x100001550]
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
call fcn.10000799c
test eax, eax
je 0x100003713
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000077f8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, r14d
xor r8d, r8d
mov rdx, rdi
lea rsi, [0x1000015bc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000033d1
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rdx, [0x1000015bc]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000032fe
lea rcx, [rsp + 0x50]
call fcn.100008450
mov edx, dword [rsp + 0x30]
cmp edx, 0xfe
jbe 0x10000379a
add edx, edx
mov rcx, rbp
call fcn.1000085cc
test eax, eax
je 0x1000033a1
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100003436
mov rcx, qword [rbp]
test rcx, rcx
je 0x10000381c
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp eax, 0x400
jbe 0x10000381c
mov rdx, qword [rbp]
lea rcx, [rsp + 0x70]
mov r8d, 0x401
call fcn.1000077f8
mov ecx, dword [rsp + 0x30]
mov rdi, qword [rbp]
xor eax, eax
lea rdx, [rsp + 0x70]
mov r8d, esi
rep stosb byte [rdi], al
mov rcx, qword [rbp]
call fcn.1000077f8
mov rdx, qword [rsp + 0x58]
mov dword [rdx], r14d
cmp dword [rsp + 0x48], 4
jne 0x100003509
mov rdi, qword [rbp]
test rdi, rdi
je 0x100003509
mov rcx, rdi
call fcn.1000086d4
mov r9d, dword [rdi]
mov rcx, qword [rbp]
movsxd rdx, eax
lea r8, [0x1000015c0]
shr rdx, 1
call fcn.1000017e8
test eax, eax
js 0x1000034f6
jmp 0x100003509
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x5f4
rep stosb byte [rdi], al
mov ecx, 0x20e
call fcn.1000067b4
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov rdx, rax
call fcn.100007a80
mov eax, 0x63
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.10000c0f0
add rsp, 0x898
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret