Function at 0x140096b10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1990
call fcn.1401354c0
sub rsp, rax
lea rdi, [rsp + 0x60]
mov ecx, 0x64c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x19a0]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x1988], rax
mov r9, qword [rsp + 0x19e0]
mov r8, qword [rsp + 0x19d8]
mov rdx, qword [rsp + 0x19d0]
lea rcx, [rsp + 0x70]
call fcn.140072a20
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0xb0]
or eax, 9
lea rcx, [rsp + 0x10a8]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140096bc3
mov eax, 4
jmp 0x14009720c
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x10e4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x10c4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140096c45
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x14009720c
mov dword [rsp + 0x1104], 4
mov qword [rsp + 0x1128], 0
mov rax, qword [0x14031a1e8]
mov qword [rsp + 0x1138], rax
cmp dword [rsp + 0x10e4], 0
jbe 0x140096eaf
cmp dword [rsp + 0x19c0], 2
je 0x140096eaf
lea rcx, [rsp + 0x70]
call fcn.140089d00
mov eax, dword [rsp + 0x10e4]
dec eax
mov dword [rsp + 0x1134], eax
jmp 0x140096cb3
mov eax, dword [rsp + 0x1134]
dec eax
mov dword [rsp + 0x1134], eax
mov dword [rsp + 0x1144], 0x400
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x880], cx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x1080]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x1144]
lea r8, [rsp + 0x880]
mov edx, dword [rsp + 0x1134]
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140096e62
mov rax, qword [rsp + 0x1138]
lea rcx, [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax]
cmp eax, 3
jne 0x140096d94
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
lea r9, [rsp + 0x1128]
mov r8, qword [rsp + 0x19a8]
mov edx, 2
mov rcx, qword [rax + 0x20]
call fcn.14007e450
mov dword [rsp + 0x1104], eax
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
cmp qword [rsp + 0x1128], rax
je 0x140096d4b
jmp 0x140096dc1
lea r9, [rsp + 0x1128]
mov r8, qword [rsp + 0x19a8]
mov edx, 3
mov rax, qword [rsp + 0x19a0]
mov rcx, qword [rax + 0x20]
call fcn.14007e450
mov dword [rsp + 0x1104], eax
cmp qword [rsp + 0x1128], 0
je 0x140096dfd
cmp dword [rsp + 0x1104], 6
jne 0x140096de8
mov rax, qword [rsp + 0x19a0]
cmp qword [rsp + 0x1128], rax
je 0x140096dfd
mov rax, qword [rsp + 0x19b0]
mov rcx, qword [rsp + 0x1128]
mov qword [rax], rcx
jmp 0x140096e73
cmp dword [rsp + 0x1104], 6
jne 0x140096e14
mov dword [rsp + 0x1104], 1
jmp 0x140096e20
cmp dword [rsp + 0x1104], 1
je 0x140096e20
jmp 0x140096e73
cmp qword [rsp + 0x19b8], 0
je 0x140096e49
lea rdx, [rsp + 0x1104]
mov rcx, qword [rsp + 0x19b8]
call fcn.14007dfc0
movzx eax, al
test eax, eax
je 0x140096e49
jmp 0x140096e73
mov rax, qword [rsp + 0x1138]
mov rax, qword [rax]
inc rax
mov rcx, qword [rsp + 0x1138]
mov qword [rcx], rax
cmp dword [rsp + 0x1134], 0
jne 0x140096e6e
jmp 0x140096e73
jmp 0x140096ca3
cmp dword [rsp + 0x1104], 1
je 0x140096e87
cmp dword [rsp + 0x1104], 4
jne 0x140096e95
mov rax, qword [rsp + 0x19b0]
cmp qword [rax], 0
je 0x140096eaf
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x1104]
jmp 0x14009720c
cmp dword [rsp + 0x10c4], 0
je 0x140096ecf
cmp dword [rsp + 0x19c0], 1
jne 0x140096ee9
movzx eax, byte [rsp + 0x19c8]
test eax, eax
jne 0x140096ee9
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x1104]
jmp 0x14009720c
lea rcx, [rsp + 0x70]
call fcn.140089ce0
mov eax, dword [rsp + 0x10c4]
dec eax
mov dword [rsp + 0x1134], eax
jmp 0x140096f15
mov eax, dword [rsp + 0x1134]
dec eax
mov dword [rsp + 0x1134], eax
mov dword [rsp + 0x1144], 0x400
lea rax, [rsp + 0x1084]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x1144]
lea r8, [rsp + 0x880]
mov edx, dword [rsp + 0x1134]
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400971e6
cmp dword [rsp + 0x19c0], 1
je 0x1400970c8
mov rax, qword [rsp + 0x1138]
lea rcx, [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax]
cmp eax, 3
jne 0x140096ff1
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
lea r9, [rsp + 0x1128]
mov r8, qword [rsp + 0x19a8]
mov edx, 2
mov rcx, qword [rax + 0x20]
call fcn.14007e450
mov dword [rsp + 0x1104], eax
mov rax, qword [rsp + 0x19a0]
mov rax, qword [rax + 0x20]
cmp qword [rsp + 0x1128], rax
je 0x140096fa8
jmp 0x14009701e
lea r9, [rsp + 0x1128]
mov r8, qword [rsp + 0x19a8]
mov edx, 3
mov rax, qword [rsp + 0x19a0]
mov rcx, qword [rax + 0x20]
call fcn.14007e450
mov dword [rsp + 0x1104], eax
cmp qword [rsp + 0x1128], 0
je 0x14009705d
cmp dword [rsp + 0x1104], 6
jne 0x140097045
mov rax, qword [rsp + 0x19a0]
cmp qword [rsp + 0x1128], rax
je 0x14009705d
mov rax, qword [rsp + 0x19b0]
mov rcx, qword [rsp + 0x1128]
mov qword [rax], rcx
jmp 0x1400971f7
cmp dword [rsp + 0x1104], 6
jne 0x140097074
mov dword [rsp + 0x1104], 1
jmp 0x140097083
cmp dword [rsp + 0x1104], 1
je 0x140097083
jmp 0x1400971f7
cmp qword [rsp + 0x19b8], 0
je 0x1400970af
lea rdx, [rsp + 0x1104]
mov rcx, qword [rsp + 0x19b8]
call fcn.14007dfc0
movzx eax, al
test eax, eax
je 0x1400970af
jmp 0x1400971f7
mov rax, qword [rsp + 0x1138]
mov rax, qword [rax]
inc rax
mov rcx, qword [rsp + 0x1138]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x19c8]
test eax, eax
je 0x1400971e6
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x1400970fe
lea rax, [0x140282424]
mov qword [rsp + 0x1980], rax
jmp 0x14009710d
lea rax, [0x14028252c]
mov qword [rsp + 0x1980], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1980]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
lea r8, [0x140282958]
mov edx, 0x400
lea rcx, [rsp + 0x1170]
call fcn.1400feb20
lea rax, [rsp + 0x1170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x19d8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x19d0]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x19c8]
mov byte [rsp + 0x28], al
mov eax, dword [rsp + 0x19c0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x19b8]
mov r8, qword [rsp + 0x19b0]
mov rdx, qword [rsp + 0x19a8]
mov rcx, qword [rsp + 0x19a0]
call fcn.140096b10
mov dword [rsp + 0x1974], eax
cmp dword [rsp + 0x1974], 4
je 0x1400971e6
mov eax, dword [rsp + 0x1974]
mov dword [rsp + 0x1104], eax
cmp dword [rsp + 0x1104], 1
je 0x1400971d6
jmp 0x1400971f7
mov rax, qword [rsp + 0x19b0]
cmp qword [rax], 0
je 0x1400971e6
jmp 0x1400971f7
cmp dword [rsp + 0x1134], 0
jne 0x1400971f2
jmp 0x1400971f7
jmp 0x140096f05
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x1104]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_htonl
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x1988]
xor rcx, rsp
call fcn.140135520
add rsp, 0x1990
pop rdi
ret