Function at 0x100037a40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
mov rbp, rcx
mov dil, r14b
cmp byte [0x10003e292], r14b
je 0x100037f41
cmp rcx, r14
je 0x100037f41
lea rbx, [0x10003e530]
mov r8, rcx
mov rdx, rbx
mov rcx, rbx
call fcn.100038eac
cmp al, r14b
je 0x100037a99
lea edi, [r14 + 1]
jmp 0x100037f41
lea rdx, [0x10003e548]
mov r8, rbp
mov rcx, rbx
call fcn.100038eac
cmp al, r14b
jne 0x100037ac4
lea rdx, [0x100024b18]
mov rcx, rbp
call fcn.10002fba4
cmp al, r14b
je 0x100037acc
mov dil, r14b
jmp 0x100037f41
lea rcx, [rsp + 0x78]
call fcn.10002fbf0
lea rcx, [rsp + 0x68]
mov rbx, r14
mov sil, r14b
mov r12d, r14d
call fcn.10002fbf0
or r15d, 0xffffffff
lea rdx, [0x100024528]
lea rcx, [rsp + 0x68]
mov r8d, r15d
call fcn.10002fd60
cmp eax, r14d
jl 0x100037f06
lea rcx, [rsp + 0x68]
mov r8d, r15d
mov rdx, rbp
call fcn.10002fe84
cmp eax, r14d
jl 0x100037f06
lea rcx, [rsp + 0x58]
call fcn.10002fbf0
mov r13, qword [rsp + 0x68]
mov rdi, r13
cmp r13, r14
je 0x100037b57
cmp word [r13], r14w
je 0x100037b57
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rdi], ax
add rdi, 2
cmp word [rdi], r14w
jne 0x100037b41
lea rdx, [0x100024b20]
lea rcx, [rsp + 0x58]
mov r8d, r15d
call fcn.10002fd60
mov edi, 1
cmp eax, r14d
jl 0x100037bda
lea rcx, [rsp + 0x58]
mov r8d, r15d
mov rdx, r13
call fcn.10002fe84
cmp eax, r14d
jl 0x100037bda
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0xe8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100037bda
mov rbx, qword [rsp + 0xe8]
cmp rbx, r14
je 0x100037bf3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
jmp 0x100037bf3
lea rdx, [0x100023cf8]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100037eb6
lea rcx, [rsp + 0x48]
call fcn.10002fbf0
lea rdx, [0x100024bb8]
lea rcx, [rsp + 0x48]
mov r8d, r15d
call fcn.10002fd60
cmp eax, r14d
jl 0x100037d00
lea rcx, [rsp + 0x48]
mov r8d, r15d
mov rdx, r13
call fcn.10002fe84
cmp eax, r14d
jl 0x100037d00
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100037d00
mov eax, r14d
cmp rbx, r14
je 0x100037c77
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x30]
cmp eax, r14d
jne 0x100037d00
lea rax, [rsp + 0xe0]
lea r9, [rsp + 0xd8]
lea rdx, [0x100024be8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0xe0], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x100037cdc
cmp dword [rsp + 0xd8], edi
je 0x100037cce
cmp dword [rsp + 0xd8], 2
jne 0x100037ce6
mov r12d, dword [rsp + 0xe0]
mov eax, r14d
shr r12d, 1
movzx esi, sil
cmp eax, r14d
cmove esi, edi
cmp rbx, r14
je 0x100037cf7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x100037eac
lea rax, [rsp + 0x38]
lea rdx, [0x100024c10]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100037dd8
mov eax, r14d
cmp rbx, r14
je 0x100037d46
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x38]
cmp eax, r14d
jne 0x100037dd8
lea eax, [r12 + r12]
lea r9, [rsp + 0xd8]
xor r8d, r8d
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xe0]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov r12d, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp eax, r14d
jne 0x100037db4
cmp dword [rsp + 0xd8], edi
je 0x100037da6
cmp dword [rsp + 0xd8], 2
jne 0x100037dbe
mov r12d, dword [rsp + 0xe0]
mov r11d, r14d
shr r12d, 1
movzx esi, sil
cmp r11d, r14d
cmove esi, edi
cmp rbx, r14
je 0x100037dcf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x100037eac
lea rax, [rsp + 0x40]
lea rdx, [0x100024c10]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100037e9a
mov eax, r14d
cmp rbx, r14
je 0x100037e1e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
cmp eax, r14d
jne 0x100037e9a
lea eax, [r12 + r12]
lea r9, [rsp + 0xd8]
xor r8d, r8d
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xe0]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp eax, r14d
jne 0x100037e7a
cmp dword [rsp + 0xd8], edi
je 0x100037e77
cmp dword [rsp + 0xd8], 2
jne 0x100037e84
mov r11d, r14d
movzx esi, sil
cmp r11d, r14d
cmove esi, edi
cmp rbx, r14
je 0x100037e95
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
cmp sil, r14b
jne 0x100037eac
mov rcx, rbp
call fcn.100038118
movzx esi, sil
cmp al, r14b
cmovne esi, edi
lea rcx, [rsp + 0x48]
call fcn.100030020
lea rcx, [rsp + 0x58]
call fcn.100030020
cmp sil, r14b
je 0x100037f06
lea rcx, [0x10003d7d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x10003d7a8]
mov rdx, rbp
call fcn.100039098
lea rcx, [0x10003d7d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [0x10003e530]
lea rcx, [0x10003e530]
mov r8, rbp
call fcn.100038dbc
jmp 0x100037f1f
lea rdx, [0x10003e548]
lea rcx, [0x10003e530]
mov r8, rbp
call fcn.100038dbc
mov dil, r14b
lea rcx, [rsp + 0x68]
call fcn.100030020
cmp rbx, r14
je 0x100037f37
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.100030020
mov al, dil
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret