Function at 0x4372f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
test rsi, rsi
jne 0x437460
xor rsi, rsi
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x27e]
mov r9d, 0x20a
call sub.advapi32.dll_RegEnumKeyW
mov edi, eax
test edi, edi
je 0x437344
cmp edi, 0x103
jne 0x43745a
xor rdi, rdi
jmp 0x43745a
cmp word [rbp + 0x27e], 0x2e
je 0x43743b
lea rcx, [rbp + 0x27e]
call fcn.00426cd0
mov r13d, eax
lea rcx, [rbp + 0x27e]
lea rdx, [0x004375cc]
call fcn.00426d10
lea rcx, [rbp + 0x74]
lea rdx, [0x004375f4]
call fcn.00426cf0
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
jne 0x4373ef
mov r13d, r13d
mov word [rbp + r13*2 + 0x27e], 0
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00437634]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
mov rcx, qword [rbp + 0x488]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
jne 0x43743b
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
lea rax, [rbp + 0x27e]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00437636]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042c0a0
mov rax, qword [0x0044d498]
cmp dword [rax], 0
je 0x437452
mov eax, 1
jmp 0x4375bb
add esi, 1
jmp 0x437312
nop
jmp 0x4375b9
cmp word [rsi], 0x2e
jne 0x437492
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437654]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043ff40
mov eax, 0x7b
jmp 0x4375bb
mov rcx, rsi
xor rdx, rdx
call fcn.00440930
mov rsi, rax
mov rcx, rsi
mov dx, 0x20
call fcn.00426c60
test rax, rax
je 0x4374b6
mov word [rax], 0
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [rbp + 0x27e]
lea rdx, [0x004376d8]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00426e00
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x43751c
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437654]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043ff40
mov eax, edi
jmp 0x4375bb
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00437634]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x437598
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x00437636]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042c0a0
jmp 0x4375b9
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x00437654]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0043ff40
mov eax, edi
lea rsp, [rbp + 0x490]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret