Function at 0x7ff7529725d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r15
sub rsp, 0x78
xor edi, edi
mov r15, r9
mov qword [r11 - 0x48], rdi
mov r13, r8
test rdx, rdx
je 0x7ff752972b42
test r8, r8
je 0x7ff752972b42
test r9, r9
je 0x7ff752972b42
mov r12, qword [rsp + 0xc0]
test r12, r12
je 0x7ff752972b42
mov rax, 0xffffffffffffffff
mov qword [r11 + 0x18], rbx
mov dword [r12], eax
lea rdx, str.SOFTWAREMicrosoftPowerShell
mov rbx, qword [r9]
lea rax, [r11 - 0x48]
mov r9d, 0x20019
mov qword [r11 - 0x78], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edx, eax
test eax, eax
je 0x7ff7529726f6
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
cmp edx, 2
jne 0x7ff7529726ce
test rbx, rbx
jne 0x7ff7529726a1
movabs r10, 0x93002f291450c270
mov rax, qword [rax + 8]
lea r9, str.SOFTWAREMicrosoftPowerShell
xor edx, edx
lea r8d, [rdi + 0x1e]
call qword [0x7ff752984648]
xor al, al
jmp 0x7ff752972b2d
movabs r10, 0x93002f291450c270
mov rax, qword [rax + 8]
lea r9, str.SOFTWAREMicrosoftPowerShell
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r8d, [rdx + 0x27]
call qword [0x7ff752984648]
xor al, al
jmp 0x7ff752972b2d
movabs r10, 0x9ee8179d36db4970
mov rax, qword [rax + 0x10]
lea r9, str.SOFTWAREMicrosoftPowerShell
mov r8d, 0x14
call qword [0x7ff752984648]
xor al, al
jmp 0x7ff752972b2d
mov ecx, 0x200
mov qword [rsp + 0x70], rbp
call fcn.7ff752974da8
mov rbp, rax
test rax, rax
jne 0x7ff752972714
xor bl, bl
jmp 0x7ff752972afb
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x30], rdi
mov r8, rbp
mov qword [rsp + 0x68], rsi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov rsi, rdi
mov qword [rsp + 0x60], r14
mov r14d, edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0xa0], 0x100
mov dword [rsp + 0x48], 1
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0x103
je 0x7ff752972acb
nop dword [rax + rax]
test edx, edx
jne 0x7ff752972a9e
mov rdx, rbp
mov dword [rsp + 0x40], edi
call fcn.7ff7529736b0
test al, al
jne 0x7ff75297293e
call fcn.7ff7529736b0
test al, al
jne 0x7ff75297293e
mov edx, 0x2e
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor edx, edx
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7ff75297293e
test rdi, rdi
je 0x7ff752972807
lea r9, [rsp + 0x40]
mov r8, rdi
mov rdx, rbp
call fcn.7ff752981c08
test al, al
je 0x7ff75297293e
mov eax, dword [rsp + 0x40]
add rdi, 2
jmp 0x7ff752972885
movzx eax, word [rax]
mov rcx, rbp
sub ax, 0x30
cmp ax, 9
jbe 0x7ff75297293e
xor edi, edi
cmp di, word [rbp]
je 0x7ff75297293e
cmp rbp, rbx
jae 0x7ff75297293e
cmp word [rcx], 0x30
jne 0x7ff75297283f
add rcx, 2
cmp rcx, rbx
jb 0x7ff752972830
mov rax, rbx
sub rax, rcx
and rax, 0xfffffffffffffffe
cmp rax, 0x14
jg 0x7ff75297293e
mov r8d, 0xa
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcstoul]
nop dword [rax + rax]
cmp rbx, qword [rsp + 0x40]
jne 0x7ff75297293e
cmp eax, 0x7fffffff
ja 0x7ff75297293e
test rdi, rdi
jne 0x7ff75297293e
cmp eax, r14d
jle 0x7ff75297293e
mov ebx, dword [rsp + 0xa0]
mov r14d, eax
inc ebx
test rsi, rsi
je 0x7ff7529728b7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.7ff752974da8
mov rsi, rax
test rax, rax
je 0x7ff752972aef
test rbx, rbx
je 0x7ff752972aef
cmp rbx, 0x7fffffff
ja 0x7ff75297299c
mov edx, 0x7ffffffe
mov r8, rbp
sub rdx, rbx
mov rcx, rax
sub r8, rax
lea rax, [rdx + rbx]
test rax, rax
je 0x7ff752972925
movzx eax, word [r8 + rcx]
test ax, ax
je 0x7ff752972925
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x7ff752972905
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
test rbx, rbx
je 0x7ff752972aef
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
mov edx, eax
inc eax
mov dword [rsp + 0xa0], 0x100
mov dword [rsp + 0x48], eax
mov r8, rbp
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0x103
je 0x7ff7529729a6
xor edi, edi
jmp 0x7ff752972780
xor ecx, ecx
mov word [rax], cx
jmp 0x7ff752972aef
test rsi, rsi
je 0x7ff752972acb
mov qword [r15], rsi
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rsi
lea rdx, str.SOFTWAREMicrosoftPowerShell_1_ls_PowerShellEngine
mov r8, r13
mov dword [r12], r14d
lea rcx, [0x7ff75298d068]
mov dword [rsp + 0x20], 0x17
call fcn.7ff7529736d0
test al, al
je 0x7ff752972aef
mov rdi, qword [r13]
mov r9d, 0x20019
mov rax, qword [rsp + 0xa8]
mov rdx, rdi
mov rsi, qword [r15]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edx, eax
test eax, eax
je 0x7ff752972af1
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
cmp edx, 2
jne 0x7ff752972a7f
test rsi, rsi
jne 0x7ff752972a5b
movabs r10, 0x93002f291450c270
mov rax, qword [rax + 8]
lea r8d, [rsi + 0x1e]
mov r9, rdi
xor edx, edx
call qword [0x7ff752984648]
jmp 0x7ff752972aef
movabs r10, 0x93002f291450c270
mov rax, qword [rax + 8]
xor edx, edx
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8d, [rdx + 0x27]
call qword [0x7ff752984648]
jmp 0x7ff752972aef
movabs r10, 0x9ee8179d36db4970
mov rax, qword [rax + 0x10]
mov r9, rdi
mov r8d, 0x14
call qword [0x7ff752984648]
jmp 0x7ff752972aef
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
movabs r10, 0x9ee8179d36db4970
mov rax, qword [rax + 0x10]
lea r9, str.SOFTWAREMicrosoftPowerShell
mov r8d, 0x13
call qword [0x7ff752984648]
jmp 0x7ff752972aef
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
mov rax, qword [rax + 8]
xor edx, edx
lea r8d, [rdx + 0x1d]
call qword [0x7ff752984648]
xor bl, bl
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x7ff752972b11
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rbp, rbp
je 0x7ff752972b25
mov rcx, rbp
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x70]
movzx eax, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x78
pop r15
pop r13
pop r12
pop rdi
ret
xor al, al
add rsp, 0x78
pop r15
pop r13
pop r12
pop rdi
ret