Function at 0x1400108a4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x100
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rsi
mov rax, qword [0x140041480]
xor rax, rbp
mov qword [rbp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
lea rcx, [rbp + 0x10]
lea rdx, str.A970_56CA_11d0_9CC1_0040053122B2
mov r8d, 0x27
call fcn.14001cb40
xor edx, edx
lea rcx, [rsi + 0x2a0]
lea r8d, [rdx + 0x10]
call fcn.14001b7c0
xor r13d, r13d
test rbx, rbx
jne 0x140010915
xor al, al
jmp 0x140010bab
mov r14d, 1
jmp 0x14001093e
cmp byte [rbx], 0x7b
je 0x140010943
lea rdx, [0x140032ec0]
mov r8d, 3
mov rcx, rbx
call fcn.14001b1b0
test eax, eax
je 0x140010943
add rbx, r14
cmp byte [rbx], r13b
jne 0x14001091d
mov al, byte [rbx]
test al, al
je 0x140010ba8
cmp al, 0x7b
je 0x14001095a
add rbx, r14
mov al, byte [rbx]
test al, al
jne 0x14001094d
cmp byte [rbx], r13b
je 0x14001090e
lea rdx, str.MyComputer
mov r8d, 0xc
mov rcx, rbx
mov rdi, rbx
call fcn.14001b1b0
test eax, eax
jne 0x140010987
lea rdi, str.20D04FE0_3AEA_1069_A2D8_08002B30309D
jmp 0x140010a3c
lea rdx, str.RegView
mov r8d, 9
mov rcx, rbx
call fcn.14001b1b0
test eax, eax
jne 0x1400109ac
lea rdi, str.4778AFE0_2289_11d0_8AEC_00A0C90C9246
jmp 0x140010a3c
lea rdx, str.WinView
mov r8d, 9
mov rcx, rbx
call fcn.14001b1b0
test eax, eax
jne 0x1400109ce
lea rdi, str.F778AFE0_2289_11d0_8AEC_00A0C90C9246
jmp 0x140010a3c
mov r8b, 0x2a
lea rcx, [rbp + 0x10]
cmp byte [rbp + 0x10], r8b
je 0x1400109e3
add rcx, r14
cmp byte [rcx], r8b
jne 0x1400109db
cmp byte [rbx], 0x7b
jne 0x1400109eb
add rbx, r14
mov dl, byte [rbx]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010a3c
add rbx, r14
mov byte [rcx], dl
add rcx, r14
mov al, byte [rbx]
add rbx, r14
cmp al, 0x2e
jne 0x140010a3c
jmp 0x140010a20
cmp dl, 0x7d
je 0x140010a33
cmp byte [rcx], r8b
jne 0x140010a26
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010a26
mov byte [rcx], dl
add rcx, r14
add rbx, r14
mov dl, byte [rbx]
test dl, dl
jne 0x140010a07
cmp byte [rbx], 0x7d
jne 0x140010a3c
jmp 0x140010a33
mov byte [rcx], 0x30
add rcx, r14
cmp byte [rcx], r8b
je 0x140010a2d
lea rdi, [rbp + 0x10]
lea rcx, [rbp + 0x40]
mov r8d, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea r11, [rbp + 0x40]
cmp byte [rbp + 0x40], r13b
je 0x140010a70
cmp byte [r11], 0x7d
je 0x140010a67
add r11, r14
cmp byte [r11], r13b
jne 0x140010a59
cmp byte [r11], r13b
je 0x140010a70
mov byte [r11 + 1], r13b
lea rbx, [rsi + 0x280]
cmp byte [rbx], r13b
jne 0x140010b0b
lea rdx, str.CLSID_
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r11, [rbp + 8]
lea rdx, [rbp + 0x80]
mov r9d, r14d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140010b0b
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
lea r9, [rbp]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rbp + 4], 0x20
mov dword [rbp], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp], r14d
je 0x140010b0b
mov byte [rbx], r13b
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [r14 + rax]
cmp r9d, 0x3fffffff
jg 0x140010b7f
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140010b3b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14001b970
sub rsp, rcx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x140010b7f
mov dword [rsp + 0x28], r9d
xor edx, edx
lea r8, [rbp + 0x40]
lea ecx, [rdx + 3]
or r9d, 0xffffffff
mov word [rdi], r13w
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rcx, rcx
and rcx, rdi
jmp 0x140010b82
mov rcx, r13
lea rdx, [rsi + 0x2a0]
call qword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
je 0x140010ba8
xor edx, edx
lea rcx, [rsi + 0x2a0]
lea r8d, [rdx + 0x10]
call fcn.14001b7c0
mov byte [rbx], r13b
mov al, r14b
mov rcx, qword [rbp + 0xc0]
xor rcx, rbp
call fcn.14001b940
mov rbx, qword [rbp + 0x110]
mov rsi, qword [rbp + 0x118]
lea rsp, [rbp + 0xd0]
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret