Function at 0x10000ac30
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x10000b009
test rdx, rdx
je 0x10000b009
test r8, r8
je 0x10000b009
mov edi, 1
cmp dword [r8 + 0x80], edi
jne 0x10000accc
mov eax, dword [r8 + 0x88]
lea r9d, [rdi + 3]
lea edx, [rdi + 1]
lea r8, [rsp + 0x74]
mov dword [rsp + 0x74], eax
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
jne 0x10000acc2
xor r8d, r8d
mov edx, 0xa1
xor ecx, ecx
call fcn.10000d950
mov r8, qword [rsi + 0x50]
mov ecx, edi
mov rdx, rax
call fcn.10000d518
mov eax, edi
jmp 0x10000b017
mov ebx, 1
jmp 0x10000ade2
mov r9d, 0xc
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x88]
lea edx, [r9 - 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x10000ac9e
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x100001a20]
lea rcx, [rax + 0x30]
call fcn.10000e8f4
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, [0x100001d58]
lea rcx, [rax + 0x30]
mov r8d, edi
mov edx, edi
mov qword [rsp + 0x20], rbx
call fcn.10000ec34
test byte [rsp + 0x90], 2
lea rax, [0x100001e08]
lea rdi, [0x100001e10]
mov rbx, rdi
cmovne rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov ecx, 1
mov r8d, ecx
mov edx, ecx
lea r9, [0x100001e20]
lea rcx, [rax + 0x30]
mov qword [rsp + 0x20], rbx
call fcn.10000ec34
test byte [rsp + 0x90], 4
lea rax, [0x100001e08]
mov rbx, rdi
cmovne rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov qword [rsp + 0x20], rbx
mov ebx, 1
lea r9, [0x100001e60]
lea rcx, [rax + 0x30]
mov r8d, ebx
mov edx, ebx
call fcn.10000ec34
test byte [rsp + 0x90], 8
lea rax, [0x100001e08]
cmovne rdi, rax
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, [0x100001ea0]
lea rcx, [rax + 0x30]
mov r8d, ebx
mov edx, ebx
mov qword [rsp + 0x20], rdi
call fcn.10000ec34
xor edi, edi
cmp dword [rsi + 0x20], ebx
jne 0x10000acbb
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp eax, edi
je 0x10000ae40
mov ecx, eax
jmp 0x10000b010
mov ecx, dword [rsp + 0xc0]
cmp dword [rsp + 0x60], edi
je 0x10000ae58
cmp ecx, edi
jne 0x10000ae58
mov ecx, 0x100
jmp 0x10000ae62
cmp ecx, 0x100
jae 0x10000ae62
add ecx, ecx
inc ecx
mov dword [rsp + 0xc0], ecx
add ecx, ecx
call fcn.10000ef18
mov rbx, rax
mov qword [rsp + 0x80], rax
cmp rax, rdi
jne 0x10000ae8c
mov ebx, 0xe
jmp 0x10000b00e
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0xc0]
lea eax, [rax + rcx + 1]
mov dword [rsp + 0xd8], eax
lea ecx, [rax + rax]
call fcn.10000ef18
mov qword [rsp + 0x78], rax
cmp rax, rdi
jne 0x10000aecd
lea rcx, [rsp + 0x80]
call fcn.10000ee3c
jmp 0x10000ae82
and dword [rsp + 0x64], edi
cmp dword [rsp + 0x60], edi
jbe 0x10000afed
mov eax, dword [rsp + 0xc0]
xor edx, edx
mov rcx, rbx
mov r8, rax
mov dword [rsp + 0x70], eax
add r8, r8
call sub.msvcrt.dll_memset
mov edx, dword [rsp + 0x64]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x70]
mov r8, rbx
mov rcx, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x10000afd9
mov rdi, qword [rsp + 0x78]
mov r8d, dword [rsp + 0xd8]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.10000e668
mov r8d, dword [rsp + 0xd8]
lea rdx, [0x100001440]
mov rcx, rdi
call fcn.10000e710
mov r8d, dword [rsp + 0xd8]
mov rdx, rbx
mov rcx, rdi
call fcn.10000e710
mov r9d, dword [rsi + 0x84]
lea rax, [rsp + 0x68]
xor r8d, r8d
cmp dword [rsi + 0x80], 1
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rbp
jne 0x10000af9c
or r9d, 0xf003f
jmp 0x10000afa3
or r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10000afb1
xor edi, edi
jmp 0x10000afd9
mov rcx, qword [rsp + 0x68]
mov r8, rsi
mov rdx, rdi
call fcn.10000ac30
mov rcx, qword [rsp + 0x68]
mov edi, eax
test rcx, rcx
je 0x10000afd9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x68], 0
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
cmp eax, dword [rsp + 0x60]
jb 0x10000aedb
lea rcx, [rsp + 0x80]
call fcn.10000ee3c
lea rcx, [rsp + 0x78]
call fcn.10000ee3c
jmp 0x10000acbb
mov ebx, 0x57
mov ecx, ebx
call fcn.100002fe8
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret