Function at 0x100006a4c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0x128], rax
xor r13d, r13d
xor eax, eax
mov rdi, rdx
mov ebx, ecx
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x70], r13d
mov dword [r11 - 0x38], r13d
mov word [r11 - 0x34], ax
mov r14d, r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x78], r13
cmp ecx, r13d
je 0x100007172
cmp rdx, r13
je 0x100007172
lea esi, [rax + 1]
lea rdx, [r11 - 0xc8]
mov ecx, esi
call fcn.100002294
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x90]
mov rdx, rdi
mov ecx, ebx
call fcn.1000071c8
cmp eax, r13d
jne 0x100006afd
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
jmp 0x100006b39
cmp dword [rsp + 0x60], esi
jne 0x100006b12
mov ecx, esi
call fcn.100002d78
mov esi, r13d
jmp 0x100006cb0
lea rcx, [rsp + 0x90]
call fcn.100002f40
mov ebp, eax
cmp eax, r13d
jne 0x100006b47
or ecx, 0xffffffff
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000d760
jmp 0x100006cb0
mov eax, dword [rsp + 0x114]
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
or eax, 0x2001f
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r12d, 0x30
mov ebx, eax
cmp eax, r13d
jne 0x1000070ea
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
jne 0x100006bb6
mov ecx, 0x42b
jmp 0x100006b29
mov rdx, qword [rsp + 0xe8]
cmp rdx, r13
jne 0x100006bd8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov ecx, 0x57
jmp 0x100006b29
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100006c7b
xor r8d, r8d
mov edx, 0xca
xor ecx, ecx
call fcn.10000d950
mov r8d, esi
mov edx, 0xce
xor ecx, ecx
mov rdi, rax
call fcn.10000d950
mov rbx, rax
mov r9d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xe8]
mov r8, rbx
mov rcx, rdi
call fcn.10000239c
cmp eax, 2
jg 0x100006c1b
cmp eax, esi
je 0x100006cc4
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100006c58
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
mov ecx, 0x4c7
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x30]
call fcn.10000d760
jmp 0x100006b0a
cmp eax, 2
je 0x100006cc4
mov ecx, eax
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000d760
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100006cb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x90]
call fcn.10000230c
mov eax, esi
jmp 0x100007191
mov eax, dword [rsp + 0xc4]
mov ebp, esi
cmp eax, 3
je 0x100006fbb
jle 0x100006f92
cmp eax, 5
jle 0x100006ef9
cmp eax, 7
je 0x100006d88
cmp eax, 0xb
jne 0x100006f92
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
je 0x100006fc8
lea r9d, [rax - 9]
lea rdx, [0x100001d6c]
mov r8d, esi
lea edi, [rax - 1]
call fcn.10000e80c
lea r14d, [rdi + 6]
cmp eax, r13d
cmove edi, r14d
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, [rsp + 0x80]
mov dword [rax], r13d
mov rcx, qword [rsp + 0xf0]
mov r8d, edi
call qword [sym.imp.msvcrt.dll__wcstoui64]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x80]
cmp word [rax], r13w
jne 0x100006d7b
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x22
je 0x100006d7b
lea ebx, [r14 - 8]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], ebx
jmp 0x100006f68
mov ebp, r13d
mov ebx, 0x79
jmp 0x1000070ea
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
jne 0x100006d9a
mov r12d, r13d
jmp 0x100006da3
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12d, eax
lea rax, [rsp + 0xc8]
cmp rax, r13
jne 0x100006db5
mov r15d, r13d
jmp 0x100006dc6
lea rcx, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, eax
lea ecx, [r12 + r12 + 6]
call fcn.10000ef18
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, r13
jne 0x100006de7
mov ebx, 8
jmp 0x1000070e4
mov rdi, rax
test r12d, r12d
jle 0x100006e82
mov rcx, qword [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
mov r9d, r13d
mov r8d, esi
call fcn.10000e374
mov r14d, eax
cmp eax, 0xffffffff
je 0x100006e20
cmp eax, r13d
jne 0x100006e23
mov r14d, esi
jmp 0x100006e7f
mov r14d, r12d
mov rax, qword [rsp + 0xf0]
mov r8d, r14d
movsxd rcx, r13d
sub r8d, r13d
lea rdx, [rax + rcx*2]
mov rcx, rdi
add r8d, esi
call fcn.10000e668
xor r13d, r13d
cmp rdi, r13
jne 0x100006e50
mov eax, r13d
jmp 0x100006e59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rdi, [rdi + rax*2]
lea eax, [r12 + 2]
lea rcx, [rbx + rax*2]
cmp rdi, rcx
jae 0x100006ee1
lea r13d, [r15 + r14]
cmp r13d, r12d
jl 0x100006df3
mov r14d, dword [rsp + 0x68]
xor r13d, r13d
mov rcx, qword [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
xor r9d, r9d
mov r8d, esi
call fcn.10000e80c
cmp eax, r13d
jne 0x100006ee6
lea rdi, [rbx + 4]
mov r9d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
sub rdi, rbx
xor r8d, r8d
sar rdi, 1
add edi, edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
lea rcx, [rsp + 0x60]
jmp 0x1000070df
mov r14d, r13d
jmp 0x100006e82
add rdi, 2
cmp r14d, esi
jne 0x100006ea6
mov ebp, r13d
mov ebx, 0x7b
jmp 0x100006ed7
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
je 0x100006fc8
mov edi, 0xa
lea rdx, [0x100001d6c]
mov r8d, esi
lea r9d, [rdi - 8]
call fcn.10000e80c
mov rcx, qword [rsp + 0xf0]
lea r14d, [rdi + 6]
cmp eax, r13d
cmove edi, r14d
xor r8d, r8d
mov edx, edi
call fcn.10000de44
cmp eax, r13d
je 0x100006d7b
mov rcx, qword [rsp + 0xf0]
mov edx, edi
call fcn.10000db68
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov r9d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x1000070ea
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
je 0x100006fc8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xf0]
jmp 0x100006f68
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
jne 0x100006fd2
mov ebx, 0x57
jmp 0x1000070ea
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
and eax, esi
shr ecx, 1
lea r15d, [rcx + rax + 1]
mov ecx, r15d
call fcn.10000ef18
mov r13, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x100007000
lea ebx, [rax + 8]
jmp 0x1000070ea
mov rbx, qword [rsp + 0xf0]
xor r12d, r12d
xor eax, eax
lea ecx, [rax + 6]
lea rdi, [rsp + 0x120]
lea r14d, [r12 + 0x10]
rep stosb byte [rdi], al
mov rdi, r13
test rbx, rbx
jne 0x10000702b
xor eax, eax
jmp 0x100007034
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x58], eax
cmp eax, esi
jbe 0x1000070ad
test sil, al
jne 0x10000704a
movzx eax, word [rbx]
add rbx, 2
jmp 0x10000704f
mov eax, 0x30
mov word [rsp + 0x120], ax
movzx eax, word [rbx]
lea rcx, [rsp + 0x120]
mov r8d, esi
mov edx, r14d
add rbx, 2
mov word [rsp + 0x122], ax
call fcn.10000de44
test eax, eax
je 0x1000070a1
lea rcx, [rsp + 0x120]
mov edx, r14d
call fcn.10000db68
add r12d, esi
mov byte [rdi], al
add rdi, rsi
cmp r12d, r15d
jb 0x100007022
mov ebx, 0x42b
jmp 0x1000070d7
xor r13d, r13d
mov ebp, r13d
lea ebx, [r13 + 0x7a]
jmp 0x1000070da
mov r9d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
xor r13d, r13d
lea rcx, [rsp + 0x68]
call fcn.10000ee3c
mov r12d, 0x30
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x1000070ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x90]
call fcn.10000230c
cmp ebp, r13d
jne 0x100007132
call qword [sym.imp.msvcrt.dll___iob_func]
mov ecx, ebx
mov rdi, rax
call fcn.10000d918
lea rcx, [rdi + 0x60]
mov rdx, rax
call fcn.10000e8f4
jmp 0x100006cbd
cmp ebx, r13d
je 0x10000714f
mov ecx, ebx
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
jmp 0x100007168
xor ecx, ecx
mov esi, r13d
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [r12 + rax]
call fcn.10000d760
jmp 0x100006cbd
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
call fcn.10000d71c
mov eax, 1
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.100010090
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret