Function at 0x4011f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x42b0
call fcn.00401918
nop
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, 0
mov byte [rbp - 0x423b], al
movabs rax, 0x3ffe
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x423a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x3fff
mov dword [rbp - 0x4240], eax
lea rax, [rbp - 0x23c]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x234]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x230]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x22c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x228]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x224]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x220]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21c]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
lea rax, [rbp - 0x218]
mov r8, rax
lea rax, [rbp - 0x214]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0x21c]
cmp eax, 0
jne 0x401320
lea rax, [0x0040209b]
mov r11, rax
lea rax, str.__FAIL:_No_subkeys_exist_at:_HKCU_s_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40154c
mov eax, dword [rbp - 0x21c]
mov r11, rax
lea rax, str.__INFO:_Found__d_subkeys_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov ecx, dword [rbp - 0x21c]
cmp eax, ecx
jae 0x40154c
jmp 0x40136a
mov eax, dword [rbp - 4]
mov rcx, rax
add eax, 1
mov dword [rbp - 4], eax
jmp 0x401346
mov eax, 0xff
mov dword [rbp - 0x110], eax
lea rax, [rbp - 0x23c]
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
movabs rax, 0
mov qword [rsp + 0x28], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x110]
mov r9, rax
lea rax, [rbp - 0x10b]
mov r8, rax
mov eax, dword [rbp - 4]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.advapi32.dll_RegEnumKeyExA
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x401417
lea rax, [rbp - 0x10b]
mov r8, rax
lea rax, [0x0040211d]
mov r11, rax
lea rax, str.__WARN:_Could_not_enumerate_key:_HKCU_s_s_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40135c
lea rax, [rbp - 0x10b]
mov r11, rax
movabs rax, 0xffffffff80000001
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0x4244], eax
mov eax, dword [rbp - 0x4244]
cmp eax, 0
jne 0x401547
mov eax, dword [0x00402004]
cmp eax, 1
jne 0x4014c4
mov eax, dword [0x00402008]
cmp eax, 0
jne 0x4014c4
lea rax, str._n_______________________________________________n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, str.__WARN:_Multiple_subkeys_match_the_criteria____n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, str.___first_encountered_subkey_will_be_affected___n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, str._______________________________________________n_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 1
mov dword [0x00402008], eax
jmp 0x40154c
mov eax, 1
mov dword [0x00402004], eax
lea rax, [rbp - 0x10b]
mov r9, rax
lea rax, [0x00402220]
mov r8, rax
movabs rax, 0xff
mov r11, rax
lea rax, [0x00402fc0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf_s
lea rax, [rbp - 0x10b]
mov qword [rsp + 0x20], rax
lea rax, [0x00402229]
mov r9, rax
lea rax, str._s_s
mov r8, rax
movabs rax, 0xff
mov r11, rax
lea rax, [0x004027c8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf_s
jmp 0x40135c
leave
ret