Function at 0x422160
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xaa8
mov qword [rsp + 0x280], 0xffffffff80000002
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x160], 0
mov rax, qword [rsp + 0xab0]
add rax, 0x114
lea r8, [0x004399d8]
lea rdx, [0x004399e8]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_sprintf]
mov rax, qword [rsp + 0xab0]
add rax, 0x10
lea r8, str.NOT_DETECTED
lea rdx, [0x00439a00]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_sprintf]
mov rax, qword [rsp + 0xab0]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xab0]
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xab0]
mov r9d, dword [rax + 4]
mov rax, qword [rsp + 0xab0]
mov r8d, dword [rax]
lea rdx, str.VEN__04XDEV__04XSUBSYS__08lXREV__02X
lea rcx, [rsp + 0x760]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x5d0]
call sub.msvcrt.dll_memset
call fcn.004323f0
mov dword [rsp + 0xa90], eax
cmp dword [rsp + 0xa90], 0x10
je 0x422254
cmp dword [rsp + 0xa90], 0x20
je 0x422254
jmp 0x422289
lea r8, [0x00439a30]
lea rdx, [0x00439a54]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [0x00439a58]
lea rdx, [0x00439a80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r9, [rsp + 0x760]
lea r8, [rsp + 0x5d0]
lea rdx, [0x00439a84]
lea rcx, [rsp + 0x290]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rax, [rsp + 0x5c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422612
mov dword [rsp + 0x870], 0
mov dword [rsp + 0x874], 1
mov dword [rsp + 0x4a0], 0x64
cmp dword [rsp + 0x874], 1
jne 0x4224ac
mov dword [rsp + 0x40], 0x104
mov eax, dword [rsp + 0x870]
mov dword [rsp + 0xa94], eax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x170]
mov edx, dword [rsp + 0xa94]
mov rcx, qword [rsp + 0x5c0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x160], eax
mov eax, dword [rsp + 0x870]
inc eax
mov dword [rsp + 0x870], eax
cmp dword [rsp + 0x160], 0
je 0x4223c9
cmp dword [rsp + 0x160], 0xea
je 0x4223c9
cmp dword [rsp + 0x160], 0x103
jne 0x4223be
mov dword [rsp + 0x874], 0
jmp 0x422303
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
call fcn.004323f0
mov dword [rsp + 0xa98], eax
cmp dword [rsp + 0xa98], 0x10
je 0x4223eb
cmp dword [rsp + 0xa98], 0x20
je 0x4223eb
jmp 0x422410
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x290]
lea rdx, str._s_sControl
lea rcx, [rsp + 0x880]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rax, [rsp + 0x5c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x880]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4224a7
mov rcx, qword [rsp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x290]
lea rdx, [0x00439aa0]
lea rcx, [rsp + 0x880]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r9, qword [rsp + 0x280]
lea r8, [0x00439aa8]
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x880]
call fcn.004226b0
mov dword [rsp + 0x874], 0
jmp 0x422303
jmp 0x422303
lea r9, [rsp + 0x4b0]
lea r8, [rsp + 0x50]
lea rdx, [0x00439ab0]
lea rcx, [rsp + 0x290]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422604
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x6f0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x4a0], 0x64
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x00439ab8]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0xab0]
add rax, 0x10
lea r8, [rsp + 0x6f0]
lea rdx, [0x00439ac4]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x6f0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x4a0], 0x64
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x00439ac8]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0xab0]
add rax, 0x114
lea r8, [rsp + 0x6f0]
lea rdx, [0x00439ad8]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_sprintf]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x5c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0xaa8
ret