Function at 0x4ad21df0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r15d, r15d
mov rax, rdx
mov r13, rcx
cmp rdx, r15
jne 0x4ad21f34
mov ebp, 0x104
lea r8, [rsp + 0x40]
xor edx, edx
mov r9d, ebp
mov esi, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp eax, r15d
jne 0x4ad21f16
or r12, 0xffffffffffffffff
cmp word [rsp + 0x40], 0x2e
je 0x4ad21eed
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, str.ShellOpenCommand
not rcx
lea r14, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
mov r14d, r14d
not rcx
lea rax, [rcx + r14]
cmp rax, rbp
ja 0x4ad21eed
lea r8, str.ShellOpenCommand
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.4ad01ac0
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.4ad217f0
mov word [rsp + r14*2 + 0x40], r15w
mov rbx, rax
cmp rax, r15
je 0x4ad21ee5
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x4ad21ee5
lea rdx, [rsp + 0x40]
lea rcx, str._s_s_r_n
mov r8, rbx
call fcn.4ad05fc4
mov rcx, rbx
call fcn.4ad01040
cmp dword [0x4ad2e19c], r15d
jne 0x4ad21f2a
inc esi
lea r8, [rsp + 0x40]
mov r9d, ebp
mov edx, esi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp eax, r15d
je 0x4ad21e52
cmp ebx, 0x103
jne 0x4ad220c9
mov ebx, r15d
jmp 0x4ad220c9
mov eax, 1
jmp 0x4ad220cb
cmp word [rdx], 0x2e
jne 0x4ad21f56
mov r8, rdx
mov ecx, 0x400023a5
mov edx, 1
call fcn.4ad0b8b0
mov eax, 0x7b
jmp 0x4ad220cb
xor edx, edx
mov rcx, rax
call fcn.4ad02f30
mov rcx, rax
call fcn.4ad01880
mov rsi, rax
cmp rax, r15
je 0x4ad21f2a
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, r15
je 0x4ad21f87
mov word [rax], r15w
xor eax, eax
or r12, 0xffffffffffffffff
mov rdi, rsi
mov rcx, r12
mov ebp, 0x104
repne scasw ax, word [rdi]
lea rdi, str.ShellOpenCommand
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, rbp
jbe 0x4ad21fd7
lea edx, [r12 + 2]
mov r8, rsi
mov ecx, 0x400023db
call fcn.4ad0b8b0
lea ebx, [r12 + 0x7c]
jmp 0x4ad220c1
lea rax, [rsp + 0x40]
mov rdi, rsi
mov rdx, rbp
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r15
je 0x4ad2200d
movzx eax, word [rdi + rcx]
cmp ax, r15w
je 0x4ad2200d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x4ad21fea
cmp rdx, r15
jne 0x4ad22016
sub rcx, 2
mov word [rcx], r15w
lea r8, str.ShellOpenCommand
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.4ad01ac0
lea rdx, [rsp + 0x30]
mov r9d, 0x2000000
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r15d
je 0x4ad2206a
mov r8, rsi
mov edx, 1
mov ecx, 0x400023a5
call fcn.4ad0b8b0
jmp 0x4ad220c1
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.4ad217f0
mov rbp, rax
cmp rax, r15
je 0x4ad220a7
xor eax, eax
mov rcx, r12
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x4ad220a7
lea rcx, str._s_s_r_n
mov r8, rbp
mov rdx, rsi
call fcn.4ad05fc4
jmp 0x4ad220b9
mov r8, rsi
mov edx, 1
mov ecx, 0x400023a5
call fcn.4ad0b8b0
mov rcx, rbp
call fcn.4ad01040
mov rcx, rsi
call fcn.4ad01040
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.4ad01000
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret