Function at 0x100417300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r14
sub rsp, 0x58
cmp dword [0x100455180], 0
mov r14, r9
mov rbx, rdx
je 0x1004175fb
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
call fcn.1004178f0
test rbx, rbx
je 0x100417339
cmp word [rbx], 0
jne 0x100417340
lea rbx, [0x100421d44]
mov rdx, rbx
mov rcx, rax
call fcn.100417d00
mov rsi, rax
test rax, rax
je 0x1004175da
mov eax, 0xffff
cmp word [rsi], ax
jne 0x100417372
cmp word [rsi + 2], 0
jne 0x100417372
mov ebp, 2
jmp 0x1004175c4
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x50], r12
xor ebp, ebp
lea r9, [rsp + 0x30]
lea rdx, [0x100421d48]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x48], r13
lea r12d, [rbp + 1]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], ebp
call sub.MSVCR100.dll__swscanf_s_l
lea edi, [rbp + 4]
cmp eax, r12d
jne 0x1004173bf
mov r12d, edi
lea r13, [rsp + 0x30]
jmp 0x100417573
lea rax, str.hex:
mov r9d, edi
mov r8, rsi
mov edx, r12d
mov ecx, reloc.sqldk.dll_Ordinal_1024
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1004173ee
lea r12d, [rax + 1]
jmp 0x100417469
lea rax, str.hex_
mov r9d, edi
mov r8, rsi
mov edx, r12d
mov ecx, reloc.sqldk.dll_Ordinal_1024
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x100417555
lea rbx, [rsi + 8]
lea r9, [rsp + 0x34]
lea rdx, str._d_:
mov rcx, rbx
xor r8d, r8d
call sub.MSVCR100.dll__swscanf_s_l
cmp eax, r12d
jne 0x100417555
cmp word [rbx], 0x3a
je 0x10041745c
nop word [rax + rax]
add rbx, 2
inc edi
cmp word [rbx], 0x3a
jne 0x100417450
mov r12d, dword [rsp + 0x34]
inc edi
je 0x100417555
movsxd r8, edi
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], bp
jne 0x100417470
sub rcx, r8
lea rbx, [rsi + r8*2]
movabs rax, 0xaaaaaaaaaaaaaaab
lea r9, [rsp + 0x30]
xor r8d, r8d
mov r13, rsi
mul rcx
mov rdi, rdx
lea rdx, str._08x
mov rcx, rbx
shr rdi, 1
mov r15d, ebp
inc edi
call sub.MSVCR100.dll__swscanf_s_l
cmp eax, 1
jne 0x100417525
mov r14, rsi
nop word [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x2c
je 0x1004174e3
nop dword [rax]
test ax, ax
je 0x1004174e3
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x2c
jne 0x1004174d0
movzx eax, byte [rsp + 0x30]
inc r14
inc r15d
mov byte [r14 - 1], al
cmp word [rbx], 0x2c
jne 0x1004174fc
add rbx, 2
cmp word [rbx], bp
je 0x10041751d
lea r9, [rsp + 0x30]
lea rdx, str._08x
xor r8d, r8d
mov rcx, rbx
call sub.MSVCR100.dll__swscanf_s_l
cmp eax, 1
je 0x1004174c0
mov r14, qword [rsp + 0x88]
cmp edi, r15d
jne 0x10041754e
cmp r12d, 1
je 0x10041753c
cmp r12d, 7
je 0x10041753c
cmp r12d, 2
jne 0x100417573
test dil, 1
jne 0x10041754e
movsxd rax, r15d
add edi, 2
mov word [rax + rsi], bp
jmp 0x100417573
mov ebp, 0xd
jmp 0x1004175ad
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rsi + rcx*2], bp
jne 0x100417560
lea edi, [rcx*2 + 2]
mov r13, rsi
mov rcx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x10041759e
cmp dword [rbx], edi
jb 0x100417599
mov r8d, edi
mov rdx, r13
call sub.MSVCR100.dll_memcpy
jmp 0x10041759e
mov ebp, Ordinal_236
test r14, r14
je 0x1004175a6
mov dword [r14], r12d
test rbx, rbx
je 0x1004175ad
mov dword [rbx], edi
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004175df
mov ebp, 8
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x78]
mov eax, ebp
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop r14
pop rbx
ret
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x58
pop r14
pop rbx
ret