Function at 0x100401ab0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
xor r8d, r8d
mov edx, 0x20019
mov ecx, 1
call dbg.find_key(int, unsigned int, int)
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rax, [rsp + 0x8c]
mov rcx, qword [0x10040a010]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edx, dword [rsp + 0x80]
lea ecx, [rdx + 1]
mov dword [rsp + 0x6c], ecx
add rcx, rcx
call sym.malloc
mov r8d, dword [rsp + 0x90]
mov rbp, rax
lea ecx, [r8 + 1]
mov dword [rsp + 0x68], ecx
add rcx, rcx
call sym.malloc
mov r14, rax
mov eax, dword [rsp + 0x88]
lea ecx, [rax + 1]
add rcx, rcx
call sym.malloc
mov rdi, rax
mov eax, dword [rsp + 0x8c]
lea ecx, [rax + 1]
call sym.malloc
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x6c]
mov rsi, rax
mov eax, dword [0x10040a038]
test eax, eax
jne 0x100401de0
mov dword [0x10040a038], 3
mov r9d, dword [rsp + 0x7c]
test r9d, r9d
je 0x100401cab
xor ebx, ebx
lea r13, [rsp + 0x94]
lea r12, [rsp + 0x98]
lea r15, [0x100405dca]
jmp 0x100401c06
mov edx, dword [rsp + 0x80]
mov r8d, dword [rsp + 0x90]
add edx, 1
add r8d, 1
add edx, edx
add r8d, r8d
mov rcx, qword [0x10040a010]
mov r9, r13
mov dword [rsp + 0x94], edx
mov edx, ebx
mov dword [rsp + 0x98], r8d
mov r8, rbp
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rdx, rbp
mov rcx, r15
call sym.printf
mov eax, dword [0x10040a034]
or eax, dword [0x10040a030]
je 0x100401c92
call sym.__getreent
movsx ecx, byte [0x100404380]
mov rdx, qword [rax + 0x10]
call sym.fputc
mov ecx, dword [0x10040a030]
test ecx, ecx
je 0x100401c92
mov rdx, r14
lea rcx, str.___ls_
call sym.printf
lea rcx, [0x100405dd5]
add ebx, 1
call sym.puts
cmp dword [rsp + 0x7c], ebx
ja 0x100401bf0
mov eax, dword [0x10040a038]
test al, 2
je 0x100401dc0
mov edx, dword [rsp + 0x84]
test edx, edx
je 0x100401dc0
xor ebx, ebx
lea r13, [rsp + 0x94]
lea r12, [rsp + 0x98]
lea r14, [rsp + 0x9c]
jmp 0x100401d07
mov rdx, rdi
lea rcx, str._ls_n
call sym.printf
add ebx, 1
cmp dword [rsp + 0x84], ebx
jbe 0x100401dc0
mov qword [rsp + 0x38], r12
mov r9, r13
mov r8, rdi
mov edx, ebx
mov eax, dword [rsp + 0x88]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r14
mov rcx, qword [0x10040a010]
mov qword [rsp + 0x20], 0
lea eax, [rax + rax + 2]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x8c]
add eax, 1
mov dword [rsp + 0x98], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov eax, dword [rsp + 0x98]
mov byte [rsi + rax], 0
mov eax, dword [0x10040a030]
test eax, eax
je 0x100401ce8
mov eax, dword [rsp + 0x9c]
lea rcx, str.REG_NONE
mov rdx, rdi
mov r8, qword [rcx + rax*8]
lea rcx, str._ls___s__
call sym.printf
cmp dword [rsp + 0x9c], 0xb
ja case.0x100401db4.8
mov eax, dword [rsp + 0x9c]
lea rdx, [0x100405e2c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test al, 1
je 0x100401cb1
jmp 0x100401bc3
mov rdx, rsi
lea rcx, str.__ls__n
call sym.printf
jmp 0x100401cf7
xor r15d, r15d
cmp dword [rsp + 0x98], r15d
jbe 0x100401e30
movzx edx, byte [rsi + r15]
lea rcx, str._02x
add r15, 1
call sym.printf
cmp r15, 8
jne 0x100401e0b
mov ecx, 0xa
call sym.putchar
jmp 0x100401cf7
lea rcx, [0x100405e29]
call sym.puts
jmp 0x100401cf7
mov rdx, qword [rsi]
lea rcx, str.0x_016llx___llu__n
mov r8, rdx
call sym.printf
jmp 0x100401cf7
test rsi, rsi
je 0x100401e30
movzx eax, word [rsi]
mov rbp, rsi
lea r15, str.__ls_
jmp 0x100401e98
lea rcx, [0x100405e26]
call sym.printf
movzx eax, word [rbp]
test ax, ax
je 0x100401e30
mov rdx, rbp
mov rcx, r15
call sym.printf
mov rcx, rbp
call sym.wcslen
lea rbp, [rbp + rax*2 + 2]
cmp word [rbp], 0
jne 0x100401e88
mov ecx, 0xa
call sym.putchar
jmp 0x100401cf7
mov edx, dword [rsi]
lea rcx, str.0x_08x___d__n
bswap edx
mov r8d, edx
call sym.printf
jmp 0x100401cf7
mov edx, dword [rsi]
lea rcx, str.0x_08x___u__n
mov r8d, edx
call sym.printf
jmp 0x100401cf7