Function at 0x140003270
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
lea rbp, [rax - 0x47]
sub rsp, 0xa8
xor ebx, ebx
mov qword [rax - 0x18], rdi
mov qword [rax - 0x28], r13
mov edi, ebx
mov qword [rax - 0x38], r15
mov r15d, ebx
mov qword [rdx], rbx
mov qword [r8], rbx
mov qword [rbp - 9], rbx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], rbx
mov qword [rbp + 7], rbx
mov dword [rbp - 0x21], ebx
mov dword [rbp - 0x1d], ebx
mov qword [rbp - 1], rbx
call fcn.14000b260
mov r13, rax
test rax, rax
je 0x14000354f
mov qword [rsp + 0xc0], rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x88], r14
mov esi, ebx
mov r14, qword [rbp + 0x7f]
mov qword [rbp - 0x19], rcx
cmp dword [r14 + 0x40048], 2
jg 0x140003370
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140003537
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x19], rbx
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x14000335e
mov dword [rsp + 0x38], eax
lea r8d, [rbx + 0x3e]
lea rax, str.unable_to_open_users_registry_hive__ERROR____d
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.get_user_root
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov dword [rsp + 0x20], 5
call fcn.140008ef0
or esi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test esi, esi
jne 0x140003537
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 9]
mov r9d, 0x20109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003537
mov rcx, qword [rbp - 9]
lea rax, [rbp - 0x11]
mov r9d, 0x20109
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003537
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003537
mov ecx, dword [rbp - 0x21]
mov qword [rsp + 0x98], r12
call fcn.140020374
mov r12, rax
test rax, rax
je 0x14000352f
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000350d
mov r8d, dword [rbp - 0x21]
lea rax, [rbp - 0x1d]
mov dword [rsp + 0x28], ebx
lea r9, [rbp - 1]
mov rdx, r12
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.140002bc0
mov r14, qword [rbp - 1]
test eax, eax
jne 0x140003500
mov edx, dword [rbp - 0x1d]
mov rcx, r14
call fcn.1400091b0
mov r15, rax
test rax, rax
je 0x140003500
mov ecx, dword [rbp + 0x77]
test cl, 2
je 0x14000347e
lea rsi, str.rsa_sha2_256
jmp 0x14000348c
test cl, 4
lea rsi, str.rsa_sha2_512
cmove rsi, rbx
lea rdx, [rbp + 7]
mov rcx, rax
call fcn.14000db80
mov rdi, qword [rbp + 7]
test eax, eax
jne 0x1400034cb
mov rax, qword [rbp + 0x6f]
mov rcx, rdi
mov r9, qword [rbp + 0x67]
mov r8, qword [rbp + 0x5f]
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.14000d2e0
test eax, eax
jne 0x1400034cb
lea ebx, [rax + 1]
jmp 0x140003500
lea rax, str.cannot_sign_using_retrieved_key
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.sign_blob
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0xeb
mov dword [rsp + 0x20], 5
call fcn.140008ef0
test r14, r14
je 0x14000350d
mov rcx, r14
call fcn.140020360
mov rcx, r12
call fcn.140020360
test r15, r15
je 0x140003522
mov rcx, r15
call fcn.1400092d0
test rdi, rdi
je 0x14000352f
mov rcx, rdi
call fcn.14000a920
mov r12, qword [rsp + 0x98]
mov rcx, r13
call fcn.140020360
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x19]
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
test rcx, rcx
je 0x140003576
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140003585
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140003594
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rbx - 1]
add rsp, 0xa8
pop rbx
pop rbp
ret