Function at 0x1001025f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x100347ae0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
and dword [rsp + 0x70], 0
and dword [rsp + 0x74], 0
and qword [rsp + 0x78], 0
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov r15, r8
lea rcx, [rsp + 0x80]
lea rdx, [0x100349120]
mov r8d, 0x50
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 8]
xor r12d, r12d
and dword [rsp + 0x88], r12d
and dword [rsp + 0x8c], r12d
and qword [rsp + 0x90], r12
and qword [rsp + 0xc0], r12
lea rax, [rsp + 0x40]
xor esi, esi
and qword [rsp + 0x40], rsi
lea r9d, [r12 + 8]
xor ebp, ebp
xor ebx, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x80], r12
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1001026c8
xor edi, edi
jmp 0x1001029e0
test eax, eax
jne 0x1001026d0
xor edi, edi
jmp 0x1001026e6
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100102979
xor r13d, r13d
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xd0]
mov edx, r13d
mov dword [rsp + 0x68], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r13d
cmp eax, 0x103
je 0x100102921
test eax, eax
je 0x10010274c
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100102979
test rbp, rbp
je 0x10010276c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbp - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rax + 8]
xor r8d, r8d
call fcn.1000b71e4
mov edi, eax
test eax, eax
js 0x10010291a
test rbx, rbx
je 0x1001027b4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x48], 0
mov rbp, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [0x10003f99c]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.100074da0
mov rbx, qword [rsp + 0x48]
test eax, eax
js 0x100102913
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1001026e9
test rsi, rsi
je 0x10010281e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0xc8], 0
test r12, r12
je 0x100102842
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r12 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x80], 0
lea rdx, [rsp + 0xc8]
mov rcx, r14
call fcn.10005058c
mov edi, eax
test eax, eax
js 0x100102909
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call fcn.10005058c
mov edi, eax
test eax, eax
js 0x100102909
and dword [rsp + 0xbc], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x6c]
lea r8, [0x10003f984]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.10004f718
test eax, eax
js 0x1001028c7
mov ecx, dword [rsp + 0x6c]
mov edx, 1
cmp ecx, edx
je 0x1001028b9
test ecx, ecx
jne 0x1001028fa
xor eax, eax
test ecx, ecx
cmovne eax, edx
mov dword [rsp + 0xbc], eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
call fcn.1001033d0
mov edi, eax
test eax, eax
js 0x100102909
mov rsi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0x80]
jmp 0x1001026e9
mov rsi, qword [rsp + 0xc8]
mov edi, 0x8004f807
jmp 0x100102977
mov rsi, qword [rsp + 0xc8]
jmp 0x10010297b
mov edi, 0x8004f807
jmp 0x10010297b
mov rbp, qword [rsp + 0x50]
jmp 0x10010297b
and dword [rsp + 0x58], 0
and dword [rsp + 0x5c], 0
and qword [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.100107e24
lea rcx, [rsp + 0x58]
mov rdx, r15
call fcn.100107e24
lea rcx, [rsp + 0x58]
xor edx, edx
call fcn.100106a90
mov r12, qword [rsp + 0x60]
test r12, r12
je 0x100102977
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jns 0x1001029ac
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1001029ac
test byte [rcx + 0x3c], 2
je 0x1001029ac
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020568]
mov edx, 0xb
mov r9d, edi
call fcn.100050618
test rbx, rbx
je 0x1001029c6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x1001029e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbp - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1001029f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
test rsi, rsi
je 0x100102a19
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0xc8], 0
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x100102a35
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0xc0], 0
lea rcx, [rsp + 0x80]
call fcn.10010159c
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.100106a90
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x100102a6c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1002edf64
mov rbx, qword [rsp + 0x348]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret