Function at 0x100026400
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x350
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x10003c108]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov r13, rcx
xor ebx, ebx
cmp qword [rcx + 8], rbx
je 0x100026ed2
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx + 8]
sar rax, 3
cmp rax, rbx
je 0x100026ed2
mov rbp, rbx
mov qword [rsp + 0x78], rbx
mov r12, rbx
mov qword [r11 - 0x2f8], rbx
mov qword [r11 - 0x2f0], rbx
mov r14d, ebx
mov r15, rbx
mov dil, byte [rsp + 0x5c]
mov r8, qword [r13 + 8]
cmp r8, rbx
jne 0x100026493
mov rax, rbx
jmp 0x10002649e
mov rax, qword [r13 + 0x10]
sub rax, r8
sar rax, 3
cmp r14d, eax
jge 0x100026655
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x50], rbx
mov r8, qword [r8 + r15]
lea rdx, [0x100008140]
lea rcx, [rsp + 0x50]
call fcn.10002c430
mov esi, eax
cmp eax, ebx
jl 0x1000265f3
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.100022114
nop
test rbp, rbp
je 0x100026593
mov rcx, r12
sub rcx, rbp
movabs r9, 0x6666666666666667
mov rax, r9
imul rcx
mov r8, rdx
sar r8, 4
mov rax, r8
shr rax, 0x3f
add r8, rax
mov rcx, qword [rsp + 0x88]
sub rcx, rbp
mov rax, r9
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jae 0x100026593
lea rsi, [r12 + 0x28]
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xa8]
lea edx, [rax + 1]
mov rcx, r12
call fcn.100027978
mov r12, rsi
mov qword [rsp + 0x80], rsi
mov esi, 1
jmp 0x1000265bd
lea r9, [rsp + 0xa8]
mov esi, 1
mov r8, rsi
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.100027478
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
cmp qword [rsp + 0xc8], 8
jb 0x1000265d7
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x1000265e5
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
add r14d, esi
add r15, 8
xor ebx, ebx
jmp 0x100026485
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x100026604
call qword [sym.imp.msvcrt.dll_free]
nop
cmp rbp, rbx
je 0x10002664e
cmp rbp, r12
je 0x100026645
lea rbx, [rbp + 0x20]
xor ebp, ebp
cmp qword [rbx], 8
jb 0x100026624
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx], 7
mov qword [rbx - 8], rbp
mov word [rbx - 0x18], bp
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026614
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x100026ed4
xor r13d, r13d
mov rdi, r13
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x90], r13
lea rdx, [rsp + 0x90]
lea rcx, [0x100008168]
call fcn.100029eb0
mov rbx, qword [rsp + 0x90]
cmp eax, r13d
jl 0x1000266f2
cmp rbx, r13
je 0x1000266f2
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x1000266de
mov eax, r13d
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rdi
movzx esi, ax
mov r15d, 0x80070000
or esi, r15d
cmp eax, r13d
cmovle esi, eax
jmp 0x100026745
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1000081a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x100026733
mov eax, r13d
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rdi
movzx esi, ax
mov r15d, 0x80070000
or esi, r15d
cmp eax, r13d
cmovle esi, eax
cmp esi, r13d
jge 0x1000267b2
cmp rbx, r13
je 0x100026758
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
nop
cmp rdi, r13
je 0x100026767
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbp, r13
je 0x1000267ab
cmp rbp, r12
je 0x1000267a2
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026785
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx], 7
mov qword [rbx - 8], r13
mov word [rbx - 0x18], r13w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026775
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x100026ed4
mov esi, r13d
mov r14d, 1
jmp 0x1000267c4
mov esi, dword [rsp + 0x60]
xor r13d, r13d
cmp rbp, r13
je 0x100026e86
mov rcx, r12
sub rcx, rbp
movabs rax, 0x6666666666666667
imul rcx
mov r13, rdx
sar r13, 4
mov rax, r13
shr rax, 0x3f
add r13, rax
je 0x100026e60
mov dword [rsp + 0x58], 0x104
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x130]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ecx, ax
or ecx, r15d
xor edx, edx
cmp eax, edx
cmovle ecx, eax
add esi, r14d
mov dword [rsp + 0x60], esi
cmp ecx, edx
jl 0x100026e60
cmp dword [rsp + 0x58], 0x104
ja 0x100026e60
mov eax, dword [rsp + 0x58]
mov word [rsp + rax*2 + 0x130], dx
mov eax, edx
mov dword [rsp + 0x64], edx
lea rsi, [rbp + 8]
cmp eax, r13d
jge 0x1000267bd
cmp qword [rsi + 0x18], 8
jb 0x10002688a
mov rdx, qword [rsi]
jmp 0x10002688d
mov rdx, rsi
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
xor edx, edx
cmp rax, rdx
jne 0x1000268b3
mov eax, dword [rsp + 0x64]
add eax, r14d
mov dword [rsp + 0x64], eax
add rsi, 0x28
jmp 0x100026875
mov rsi, rdx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x130]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x10002690c
mov eax, ecx
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0xa8], rsi
movzx r13d, ax
or r13d, r15d
cmp eax, ecx
cmovle r13d, eax
cmp r13d, ecx
jl 0x100026dec
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, [0x100008240]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100026974
mov eax, dword [rsp + 0x9c]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
movzx r13d, ax
or r13d, r15d
cmp eax, ecx
cmovle r13d, eax
cmp r13d, ecx
jl 0x100026d75
mov eax, dword [rsp + 0x68]
cmp eax, 0x70
je 0x100026b26
cmp eax, 7
je 0x100026b26
cmp eax, 0x60
je 0x1000269ae
cmp eax, 6
jne 0x100026b84
mov dword [rsp + 0x50], ecx
xor eax, eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, [0x100008260]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100026a06
mov eax, dword [rsp + 0x98]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
movzx r13d, ax
or r13d, r15d
cmp eax, ecx
cmovle r13d, eax
cmp r13d, ecx
jl 0x100026cfe
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [0x100008280]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100026a6a
mov eax, dword [rsp + 0xa0]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
movzx r13d, ax
or r13d, r15d
cmp eax, ecx
cmovle r13d, eax
cmp r13d, ecx
jl 0x100026c87
mov dword [rsp + 0x48], ecx
xor eax, eax
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x40], rcx
mov r9b, r14b
lea r8, [0x1000082a0]
lea rdx, [0x1000082c0]
lea rcx, [rsp + 0x40]
call fcn.10002a16c
mov r13d, eax
xor eax, eax
cmp r13d, eax
jl 0x100026b04
lea r13d, [rax + 0x30]
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x100]
call sub.msvcrt.dll_memset
xor r9d, r9d
mov r8d, r13d
lea rdx, [rsp + 0x100]
lea ecx, [r13 - 0x2d]
call qword [rsp + 0x40]
xor r13d, r13d
cmp eax, r13d
jl 0x100026c08
lea r8d, [r13 + 8]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memmove
xor eax, eax
cmp r13d, eax
jl 0x100026c0e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
je 0x100026bc7
movsxd rax, dword [rsp + 0x64]
lea rcx, [rax + rax*4]
lea r8, [rbp + rcx*8]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x70]
call fcn.100026fe4
nop
xor r13d, r13d
cmp rsi, r13
jne 0x100026b65
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov esi, dword [rsp + 0x60]
jmp 0x1000267c4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov esi, dword [rsp + 0x60]
jmp 0x1000267c4
cmp rsi, rcx
je 0x100026b94
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbx, rcx
je 0x100026ba3
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
xor ecx, ecx
cmp rdi, rcx
je 0x100026bb2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.100027098
jmp 0x100026c76
xor r13d, r13d
cmp rsi, r13
je 0x100026bd9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbx, r13
je 0x100026be7
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
nop
cmp rdi, r13
je 0x100026bf6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.100027098
jmp 0x100026c76
mov r13d, 0x80004005
xor r14d, r14d
cmp rsi, r14
je 0x100026c20
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbx, r14
je 0x100026c2e
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
nop
cmp rdi, r14
je 0x100026c3d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbp, r12
je 0x100026c73
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026c56
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx], 7
mov qword [rbx - 8], r14
mov word [rbx - 0x18], r14w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026c46
mov r14d, r13d
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, r14d
jmp 0x100026ed4
cmp rsi, rcx
je 0x100026c97
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbx, rcx
je 0x100026ca6
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
xor ecx, ecx
cmp rdi, rcx
je 0x100026cb6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbp, r12
je 0x100026ced
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026cd1
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
xor ecx, ecx
mov qword [rbx], 7
mov qword [rbx - 8], rcx
mov word [rbx - 0x18], cx
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026cbf
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, r13d
jmp 0x100026ed4
cmp rsi, rcx
je 0x100026d0e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbx, rcx
je 0x100026d1d
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
xor ecx, ecx
cmp rdi, rcx
je 0x100026d2d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbp, r12
je 0x100026d64
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026d48
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
xor ecx, ecx
mov qword [rbx], 7
mov qword [rbx - 8], rcx
mov word [rbx - 0x18], cx
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026d36
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, r13d
jmp 0x100026ed4
cmp rsi, rcx
je 0x100026d85
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbx, rcx
je 0x100026d94
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
xor ecx, ecx
cmp rdi, rcx
je 0x100026da4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbp, r12
je 0x100026ddb
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026dbf
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
xor ecx, ecx
mov qword [rbx], 7
mov qword [rbx - 8], rcx
mov word [rbx - 0x18], cx
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026dad
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, r13d
jmp 0x100026ed4
cmp rsi, rcx
je 0x100026dfc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbx, rcx
je 0x100026e0b
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
xor ecx, ecx
cmp rdi, rcx
je 0x100026e1b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp rbp, r12
je 0x100026e52
lea rbx, [rbp + 0x20]
cmp qword [rbx], 8
jb 0x100026e36
mov rcx, qword [rbx - 0x18]
call qword [sym.imp.msvcrt.dll_free]
xor ecx, ecx
mov qword [rbx], 7
mov qword [rbx - 8], rcx
mov word [rbx - 0x18], cx
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, r12
jne 0x100026e24
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, r13d
jmp 0x100026ed4
mov rcx, r12
sub rcx, rbp
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xor r13d, r13d
jmp 0x100026e89
mov rdx, r13
mov esi, r13d
cmp rdx, r13
setne sil
cmp rbx, r13
je 0x100026ea1
mov rcx, rbx
call sub.MpClient.dll_MpFreeMemory
nop
cmp rdi, r13
je 0x100026eb0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbp, r13
je 0x100026ece
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.100027098
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x100026ed4
xor eax, eax
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.10002d830
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret