Function at 0x100115c4c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
and dword [rsp + 0x70], 0
and dword [rsp + 0x74], 0
and qword [rsp + 0x78], 0
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov r15, r8
lea rcx, [rsp + 0x80]
lea rdx, [0x1004c58d0]
mov r8d, 0x50
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 8]
xor r12d, r12d
and dword [rsp + 0x88], r12d
and dword [rsp + 0x8c], r12d
and qword [rsp + 0x90], r12
and qword [rsp + 0xc0], r12
lea rax, [rsp + 0x40]
xor esi, esi
and qword [rsp + 0x40], rsi
lea r9d, [r12 + 8]
xor ebp, ebp
xor ebx, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x80], r12
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x100115d24
xor edi, edi
jmp 0x10011603c
test eax, eax
jne 0x100115d2c
xor edi, edi
jmp 0x100115d42
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100115fd5
xor r13d, r13d
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xd0]
mov edx, r13d
mov dword [rsp + 0x68], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r13d
cmp eax, 0x103
je 0x100115f7d
test eax, eax
je 0x100115da8
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100115fd5
test rbp, rbp
je 0x100115dc8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbp - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rax + 8]
xor r8d, r8d
call fcn.1000bed9c
mov edi, eax
test eax, eax
js 0x100115f76
test rbx, rbx
je 0x100115e10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x48], 0
mov rbp, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [0x10004978c]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.100083830
mov rbx, qword [rsp + 0x48]
test eax, eax
js 0x100115f6f
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x100115d45
test rsi, rsi
je 0x100115e7a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0xc8], 0
test r12, r12
je 0x100115e9e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r12 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x80], 0
lea rdx, [rsp + 0xc8]
mov rcx, r14
call fcn.10005c2cc
mov edi, eax
test eax, eax
js 0x100115f65
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call fcn.10005c2cc
mov edi, eax
test eax, eax
js 0x100115f65
and dword [rsp + 0xbc], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x6c]
lea r8, [0x100049774]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.10005b6f8
test eax, eax
js 0x100115f23
mov ecx, dword [rsp + 0x6c]
mov edx, 1
cmp ecx, edx
je 0x100115f15
test ecx, ecx
jne 0x100115f56
xor eax, eax
test ecx, ecx
cmovne eax, edx
mov dword [rsp + 0xbc], eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
call fcn.100116ac4
mov edi, eax
test eax, eax
js 0x100115f65
mov rsi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0x80]
jmp 0x100115d45
mov rsi, qword [rsp + 0xc8]
mov edi, 0x8004f807
jmp 0x100115fd3
mov rsi, qword [rsp + 0xc8]
jmp 0x100115fd7
mov edi, 0x8004f807
jmp 0x100115fd7
mov rbp, qword [rsp + 0x50]
jmp 0x100115fd7
and dword [rsp + 0x58], 0
and dword [rsp + 0x5c], 0
and qword [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.10011b044
lea rcx, [rsp + 0x58]
mov rdx, r15
call fcn.10011b044
lea rcx, [rsp + 0x58]
xor edx, edx
call fcn.100119da0
mov r12, qword [rsp + 0x60]
test r12, r12
je 0x100115fd3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jns 0x100116008
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100116008
test byte [rcx + 0x3c], 2
je 0x100116008
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a238]
mov edx, 0xb
mov r9d, edi
call fcn.10005c358
test rbx, rbx
je 0x100116022
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x10011603c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbp - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100116052
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
test rsi, rsi
je 0x100116075
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0xc8], 0
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x100116091
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0xc0], 0
lea rcx, [rsp + 0x80]
call fcn.1001150b4
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.100119da0
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1001160c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10027d5f4
mov rbx, qword [rsp + 0x348]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret