Function at 0x100005f08
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor ebp, ebp
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x64], ebp
mov dword [r11 + 8], ebp
mov dword [rsp + 0x60], ebp
cmp rcx, rbp
je 0x1000061c0
cmp rdx, rbp
je 0x1000061c0
cmp rbx, rbp
je 0x1000061c0
cmp r9, rbp
je 0x1000061c0
mov qword [r11 - 0x50], rbp
mov qword [r11 - 0x58], rbp
mov qword [r11 - 0x60], rbp
lea rax, [r11 + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x68], rax
lea rax, [r11 - 0x48]
xor edx, edx
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], rbp
mov qword [r11 - 0x80], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp eax, ebp
je 0x100005fb4
mov ecx, eax
call fcn.100002fe8
mov eax, esi
jmp 0x1000061ce
mov ecx, dword [rsp + 0xb0]
inc ecx
mov dword [rsp + 0xb0], ecx
add ecx, ecx
call fcn.10000ef18
xor esi, esi
mov rbp, rax
mov qword [rsp + 0x78], rax
cmp rax, rsi
jne 0x100005fe9
lea ecx, [rsi + 0xe]
call fcn.100002fe8
xor eax, eax
jmp 0x1000061ce
mov r12d, esi
mov r13d, esi
cmp dword [rsp + 0x60], esi
jbe 0x100006197
mov eax, dword [rsp + 0xb0]
xor edx, edx
mov rcx, rbp
mov r8, rax
mov dword [rsp + 0x64], eax
add r8, r8
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
mov r8, rbp
mov edx, r13d
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
cmp eax, esi
jne 0x100006190
mov rdx, qword [rbx + 0x58]
cmp rdx, rsi
je 0x10000606b
mov r8d, 0x102
mov rcx, rbp
call fcn.10000f43c
cmp eax, esi
je 0x10000617b
mov rcx, qword [rbx + 0x78]
cmp rcx, rsi
je 0x1000060a2
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x70]
mov edx, 1
mov r8d, 0x30000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x20], esi
call fcn.10000f7b4
cmp eax, 0xffffffff
je 0x10000617b
mov dword [rdi + 8], 1
test byte [rbx + 0x68], 2
je 0x10000613d
cmp dword [rbx + 0x28], 0
mov rdx, qword [rbx + 0x70]
mov qword [rsp + 0x70], rsi
mov esi, 1
mov rcx, rbp
jne 0x1000060eb
mov eax, dword [rbx + 0x24]
neg eax
sbb r8d, r8d
not r8d
and r8d, 0x100
or r8d, 2
call fcn.10000f43c
test eax, eax
jne 0x10000610f
jmp 0x100006102
xor r8d, r8d
cmp dword [rbx + 0x24], r8d
sete r8b
xor r9d, r9d
call fcn.10000e80c
test eax, eax
je 0x10000610f
mov ecx, 0x490
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x70]
call fcn.10000ee3c
mov dword [rdi + 8], esi
test esi, esi
jne 0x10000612a
cmp dword [rbx + 0x68], 2
je 0x10000617b
xor esi, esi
jmp 0x100006151
xor esi, esi
cmp qword [rbx + 0x58], rsi
jne 0x100006151
cmp qword [rbx + 0x78], rsi
jne 0x100006151
inc dword [rdi + 0x10]
jmp 0x100006151
cmp dword [rbx + 0x68], esi
je 0x100006151
cmp qword [rbx + 0x58], rsi
jne 0x100006151
cmp qword [rbx + 0x78], rsi
jne 0x100006151
mov dword [rdi + 8], esi
cmp dword [rdi + 8], 1
je 0x100006162
cmp dword [rbx + 0x68], esi
je 0x100006162
test byte [rbx + 0x68], 4
je 0x10000617b
mov r9, rbx
mov r8, rbp
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rdi
call fcn.100005c24
mov r12d, eax
inc r13d
mov esi, 0
cmp r13d, dword [rsp + 0x60]
jb 0x100005ff9
jmp 0x100006197
mov ecx, eax
call fcn.100002fe8
cmp dword [rdi], esi
jne 0x1000061b1
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x100001a20]
lea rcx, [rax + 0x30]
call fcn.10000e8f4
lea rcx, [rsp + 0x78]
call fcn.10000ee3c
mov eax, r12d
jmp 0x1000061ce
mov ebx, 0x57
mov ecx, ebx
call fcn.100002fe8
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret