Function at 0x1001028d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
lea r13, [0x10003c5c0]
mov qword [rsp + 0x60], r13
lea r14, [0x10003c810]
mov qword [rsp + 0x68], r14
lea r15, [0x10003c5a8]
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x1fa
mov dword [rsp + 0x7c], 0xb
mov dword [rax - 0x138], 0xff
xor r12d, r12d
mov word [rax - 0xb8], r12w
mov byte [rax - 0xb6], r12b
mov byte [rax - 0xb5], 1
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rax - 0x130]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
call fcn.1000e7c38
nop
mov dword [rbp], r12d
mov dword [rsp + 0x1c0], r12d
mov dword [rsp + 0x1d0], r12d
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1c0]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x100102a0d
lea rax, [0x100008440]
mov qword [rsp + 0x20], rax
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0x110]
call fcn.1000e826c
nop
lea rcx, [rsp + 0x110]
call fcn.1000e7d24
xor al, al
jmp 0x100102d6c
cmp eax, r12d
je 0x100102ad0
cmp eax, 0xea
je 0x100102ad0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x219
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r12w
mov byte [rsp + 0x102], r12b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
movzx r8d, bx
or r8d, 0x80070000
cmp ebx, r12d
cmovle r8d, ebx
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rsi
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x10003c850]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
call fcn.1000e9a68
int3
cmp dword [rsp + 0x1c0], 4
je 0x100102b98
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x220
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r12w
mov byte [rsp + 0x102], r12b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], rsi
mov r9, qword [rdi + 0x18]
lea r8, [0x10003c930]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
call fcn.1000eac7c
lea rax, [0x100008440]
mov qword [rsp + 0x20], rax
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0x110]
call fcn.1000e826c
nop
lea rcx, [rsp + 0x110]
call fcn.1000e7d24
xor al, al
jmp 0x100102d6c
mov ebx, dword [rsp + 0x1d0]
cmp ebx, 4
je 0x100102c39
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x22d
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r12w
mov byte [rsp + 0x102], r12b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], rsi
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, [0x10003c9f0]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
call fcn.1000e9a68
int3
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r12d
je 0x100102d28
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], 0x23c
mov dword [rsp + 0x7c], 0xb
mov dword [rsp + 0x80], 0xff
mov word [rsp + 0x100], r12w
mov byte [rsp + 0x102], r12b
mov byte [rsp + 0x103], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll_memset
movzx r8d, bx
or r8d, 0x80070000
cmp ebx, r12d
cmovle r8d, ebx
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rsi
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x10003c850]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
call fcn.1000e9a68
int3
mov ecx, dword [rsp + 0x50]
mov dword [rbp], ecx
lea rcx, [0x100008430]
mov qword [rsp + 0x20], rcx
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0x110]
call fcn.1000e826c
nop
lea rcx, [rsp + 0x110]
call fcn.1000e7d24
mov al, 1
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret