Function at 0x100116238
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r15d, r15d
mov r14, rdx
mov r13, rcx
lea rcx, [rsp + 0x70]
lea rdx, [0x1004c5930]
lea r8d, [r15 + 0x40]
mov dword [rsp + 0x40], r15d
mov esi, r15d
mov dword [rsp + 0x44], r15d
mov rbp, r15
mov qword [rsp + 0x48], r15
call sub.msvcrt.dll_memcpy
mov rdx, qword [r13]
lea rax, [rsp + 0x50]
lea r9d, [r15 + 8]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0x50], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1001162e2
mov ebx, r15d
jmp 0x1001165fd
lea rdx, [0x1004a9500]
cmp eax, r15d
jne 0x1001162f3
mov ebx, r15d
jmp 0x10011630b
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jne 0x1001166d9
mov r12d, r15d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xb0]
mov edx, r12d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x58], 0x25
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r12d
cmp eax, 0x103
je 0x10011667a
cmp eax, r15d
je 0x100116370
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jne 0x1001166cf
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.10005e6d0
cmp eax, r15d
jl 0x100116673
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.1001187ec
cmp eax, r15d
mov ebx, eax
jl 0x1001166e1
mov r10, qword [rsp + 0x70]
mov ebx, r15d
mov edi, r15d
cmp esi, r15d
je 0x100116494
mov r8d, esi
jle 0x100116494
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
lea r11d, [rax + rdi]
movsxd rcx, r11d
shl rcx, 6
add rcx, rbp
cmp qword [rcx], r10
je 0x100116435
cmp r10, r15
lea rdx, [0x100042ce0]
lea rax, [0x100042ce0]
cmovne rdx, r10
cmp qword [rcx], r15
cmovne rax, qword [rcx]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x10011641c
add rax, 2
test cx, cx
jne 0x100116405
mov eax, r15d
jmp 0x100116421
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
jge 0x100116435
or eax, 0xffffffff
lea edi, [r11 + 1]
sub eax, r9d
add r8d, eax
jmp 0x100116438
mov r8d, r9d
cmp r8d, r15d
jg 0x1001163c8
cmp edi, esi
jge 0x100116494
movsxd rax, edi
shl rax, 6
add rax, rbp
cmp r10, qword [rax]
je 0x100116490
cmp qword [rax], r15
lea rdx, [0x100042ce0]
cmovne rdx, qword [rax]
cmp r10, r15
lea rax, [0x100042ce0]
cmovne rax, r10
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x100116486
add rax, 2
test cx, cx
jne 0x10011646f
mov eax, r15d
jmp 0x10011648b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
jl 0x100116494
mov al, 1
jmp 0x100116497
mov al, r15b
cmp al, r15b
jne 0x1001165c3
lea r8, [rsp + 0x5c]
mov edx, 1
mov ecx, esi
call fcn.100085980
cmp eax, r15d
mov ebx, eax
jl 0x100116558
mov edx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x40]
call fcn.10011b1b4
mov rbp, qword [rsp + 0x48]
mov esi, dword [rsp + 0x44]
cmp eax, r15d
mov ebx, eax
jl 0x100116558
cmp edi, esi
jge 0x100116510
cmp rbp, r15
jne 0x1001164eb
mov rdx, r15
mov r9, r15
jmp 0x1001164f1
mov rdx, rbp
mov r9, rbp
mov eax, esi
movsxd rcx, edi
shl rcx, 6
sub eax, edi
movsxd r8, eax
add rdx, rcx
lea rcx, [r9 + rcx + 0x40]
shl r8, 6
call sub.msvcrt.dll_memmove
movsxd rdi, edi
lea rdx, [0x1004c5930]
mov r8d, 0x40
shl rdi, 6
lea rbx, [rdi + rbp]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x30], r15
lea rcx, [rdi + rbp]
lea rdx, [rsp + 0x70]
mov qword [rbx + 0x38], r15
call fcn.1001151d0
inc esi
mov dword [rsp + 0x44], esi
mov ebx, r15d
jmp 0x100116589
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100116597
test byte [rcx + 0x3c], 2
je 0x100116597
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a268]
mov edx, 0xf
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp ebx, r15d
jge 0x10011630e
cmp rcx, rax
je 0x1001165ca
test byte [rcx + 0x3c], 2
je 0x1001165ca
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a268]
mov edx, 0x13
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [0x1004a9500]
cmp ebx, r15d
jge 0x10011630e
lea rdx, [0x1004a9500]
cmp rcx, rdx
je 0x1001165fd
test byte [rcx + 0x3c], 2
je 0x1001165fd
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a238]
mov edx, 0xd
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x100116612
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x70]
call fcn.100115010
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.10011a078
mov rdi, qword [rsp + 0x48]
cmp rdi, r15
je 0x100116646
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10027d5f4
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8004f807
jmp 0x1001166cf
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r15d
mov qword [rsp + 0x68], r15
call fcn.10011b0fc
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.10011b0fc
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.10011a078
mov rdi, qword [rsp + 0x68]
cmp rdi, r15
je 0x1001166cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x1004a9500]
cmp ebx, r15d
jge 0x1001165fd
jmp 0x1001166e8
lea rdx, [0x1004a9500]
mov rcx, qword [0x1004a9500]
jmp 0x1001165da