Function at 0x100410780
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp dword [0x10044c054], 0
je 0x100410c1c
mov rcx, qword [rsp + 0xf0]
call fcn.10040f440
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0xf8], 0
je 0x1004107d9
mov rax, qword [rsp + 0xf8]
movzx eax, word [rax]
test eax, eax
jne 0x1004107e8
lea rax, [0x10041decc]
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x38], 0x3f4
mov qword [rsp + 0x40], 0
call fcn.100411150
test eax, eax
je 0x10041081c
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x98]
call fcn.100410010
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x10041083e
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x98]
call fcn.10040fab0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x100410c01
mov rcx, qword [rsp + 0x40]
call fcn.10040ed00
test eax, eax
jne 0x100410be1
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, [0x10041ded0]
mov rcx, qword [rsp + 0x40]
call fcn.10040eca0
cmp eax, 1
jne 0x1004108c2
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x68], rax
jmp 0x100410b6c
mov dword [rsp + 0x30], 0
mov r9d, 4
lea r8, str.hex:
mov edx, 4
mov rcx, qword [rsp + 0x40]
call fcn.10040ed90
movzx eax, al
test eax, eax
je 0x100410902
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x48], 3
jmp 0x100410989
mov r9d, 4
lea r8, str.hex_
mov edx, 4
mov rcx, qword [rsp + 0x40]
call fcn.10040ed90
movzx eax, al
test eax, eax
je 0x100410989
mov rax, qword [rsp + 0x40]
add rax, 8
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str._d_:
mov rcx, rax
call fcn.10040eca0
cmp eax, 1
jne 0x100410989
mov dword [rsp + 0x30], 4
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax*2]
cmp eax, 0x3a
je 0x100410974
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
jmp 0x100410955
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x30], 0
je 0x100410b25
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x70], 0xffffffffffffffff
inc qword [rsp + 0x70]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
cmp word [rax + rcx*2], 0
jne 0x1004109aa
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rsp + 0x30]
sub rax, rcx
xor edx, edx
mov ecx, 3
div rcx
inc rax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x3c], 0
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str._08x
mov rcx, qword [rsp + 0x58]
call fcn.10040eca0
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 1
jne 0x100410aa3
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x2c
je 0x100410a59
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
test eax, eax
je 0x100410a59
mov rax, qword [rsp + 0x58]
add rax, 2
mov qword [rsp + 0x58], rax
jmp 0x100410a30
movsxd rax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
movzx edx, byte [rsp + 0x4c]
mov byte [rcx + rax], dl
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x2c
jne 0x100410a90
mov rax, qword [rsp + 0x58]
add rax, 2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
test eax, eax
jne 0x100410a9e
jmp 0x100410aa3
jmp 0x100410a06
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
je 0x100410ab5
mov dword [rsp + 0x38], ntohs
cmp dword [rsp + 0x38], 0
jne 0x100410b23
cmp dword [rsp + 0x48], 1
je 0x100410ad1
cmp dword [rsp + 0x48], 7
je 0x100410ad1
cmp dword [rsp + 0x48], 2
jne 0x100410b23
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x100410b1b
mov eax, dword [rsp + 0x34]
add rax, 2
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
movsxd rax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
mov byte [rcx + rax], 0
jmp 0x100410b23
mov dword [rsp + 0x38], ntohs
jmp 0x100410b6c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x78], 0xffffffffffffffff
inc qword [rsp + 0x78]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
cmp word [rax + rcx*2], 0
jne 0x100410b3b
mov rax, qword [rsp + 0x78]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
cmp dword [rsp + 0x38], 0
jne 0x100410bdf
cmp qword [rsp + 0x110], 0
je 0x100410bad
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x34]
cmp dword [rax], ecx
jb 0x100410ba5
mov eax, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x68]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x100410bad
mov dword [rsp + 0x38], 0xea
cmp qword [rsp + 0x108], 0
je 0x100410bc6
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
cmp qword [rsp + 0x118], 0
je 0x100410bdf
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
jmp 0x100410be9
mov dword [rsp + 0x38], 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100410c09
mov dword [rsp + 0x38], 8
mov ecx, dword [rsp + 0x38]
call fcn.10040ee00
jmp 0x100410dfd
cmp dword [0x10044c268], 0
je 0x100410dbd
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xf0]
call fcn.100410f60
mov dword [rsp + 0x50], 0
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
call fcn.100410010
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x100410cdc
cmp dword [rsp + 0xc8], 0
jne 0x100410cc6
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
call fcn.10040ee00
jmp 0x100410dfd
mov dword [rsp + 0x50], 2
mov ecx, dword [rsp + 0x50]
call fcn.10040ee00
jmp 0x100410dfd
cmp qword [rsp + 0x108], 0
je 0x100410cf5
mov rax, qword [rsp + 0x108]
mov dword [rax], 1
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x80], 0xffffffffffffffff
inc qword [rsp + 0x80]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
cmp word [rax + rcx*2], 0
jne 0x100410d11
mov rax, qword [rsp + 0x80]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x60], eax
cmp qword [rsp + 0x110], 0
je 0x100410d7e
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x60]
cmp dword [rax], ecx
jb 0x100410d76
mov eax, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x88]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x100410d7e
mov dword [rsp + 0x50], 0xea
cmp qword [rsp + 0x118], 0
je 0x100410d97
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [rsp + 0x50]
call fcn.10040ee00
jmp 0x100410dfd
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0xd8
pop rdi
pop rsi
ret