Function at 0x100036d90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x5b0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov esi, r8d
mov rdi, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ebp, ebp
mov ecx, esi
mov qword [rsp + 0x38], rbp
call fcn.1000366c0
cmp eax, ebp
je 0x100037108
lea rax, [rsp + 0x38]
lea r12d, [rbp + 1]
lea rdx, [0x10001feb0]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov r9d, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, 0x104
cmp eax, ebp
jne 0x100036f50
mov rcx, qword [0x10004ce70]
lea r9d, [r13 - 0x6e]
lea r8, [rsp + 0x470]
lea edx, [rbp + 0x24]
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x30], r12d
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebp
je 0x100036f45
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
lea rdx, [rsp + 0x470]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100036f45
cmp dword [rsp + 0x30], r12d
jne 0x100036f45
lea rax, [rsp + 0x50]
mov r9, rbx
mov rdx, r13
lea rcx, [rsp + 0x50]
mov r8d, ebp
sub r9, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x100036ebe
movzx eax, word [r9 + rcx]
cmp ax, bp
je 0x100036ebe
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x100036e9c
cmp rdx, rbp
jne 0x100036ecd
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x100036f45
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x100036eea
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.10002e3d4
cmp eax, ebp
jl 0x100036f45
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x100036f19
lea rcx, [rsp + 0x50]
call fcn.10003fff0
jmp 0x100036f1b
mov eax, ebp
cmp eax, ebp
je 0x100036f45
mov edx, dword [rdi]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.10002e35c
cmp eax, ebp
jl 0x100036f45
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r12d
jmp 0x10003710a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.1000366c0
cmp eax, ebp
je 0x10003703a
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x260]
mov r9d, r13d
mov edx, 0x21
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebp
je 0x10003703a
lea rax, [rsp + 0x50]
mov r9, rbx
mov rdx, r13
lea rcx, [rsp + 0x50]
mov r8d, ebp
sub r9, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x100036fc2
movzx eax, word [r9 + rcx]
cmp ax, bp
je 0x100036fc2
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x100036fa0
cmp rdx, rbp
jne 0x100036fd1
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003703a
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x100036fee
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.10002e3d4
cmp eax, ebp
jl 0x10003703a
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x10003701d
lea rcx, [rsp + 0x50]
call fcn.10003fff0
jmp 0x10003701f
mov eax, ebp
cmp eax, ebp
je 0x10003703a
mov edx, dword [rdi]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.10002e35c
cmp eax, ebp
jge 0x100036f3d
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.1000366c0
cmp eax, ebp
je 0x100037108
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x260]
mov r9d, r13d
mov edx, 0x25
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebp
je 0x100037108
lea rax, [rsp + 0x50]
mov r9, rbx
mov rdx, r13
lea rcx, [rsp + 0x50]
mov r8d, ebp
sub r9, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000370ac
movzx eax, word [r9 + rcx]
cmp ax, bp
je 0x1000370ac
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x10003708a
cmp rdx, rbp
jne 0x1000370bb
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x100037108
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x1000370d8
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.10002e3d4
cmp eax, ebp
jl 0x100037108
mov edx, dword [rdi]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.10002e35c
cmp eax, ebp
jge 0x100036f3d
xor eax, eax
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret