Function at 0x100102bdc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x100347ae0]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r15d, r15d
mov r14, rdx
mov r13, rcx
lea rcx, [rsp + 0x70]
lea rdx, [0x100349170]
lea r8d, [r15 + 0x40]
mov dword [rsp + 0x40], r15d
mov esi, r15d
mov dword [rsp + 0x44], r15d
mov rbp, r15
mov qword [rsp + 0x48], r15
call sub.msvcrt.dll_memcpy
mov rdx, qword [r13]
lea rax, [rsp + 0x50]
lea r9d, [r15 + 8]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0x50], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x100102c86
mov ebx, r15d
jmp 0x100102fa1
lea rdx, [0x100331948]
cmp eax, r15d
jne 0x100102c97
mov ebx, r15d
jmp 0x100102caf
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jne 0x10010307d
mov r12d, r15d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xb0]
mov edx, r12d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x58], 0x25
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc r12d
cmp eax, 0x103
je 0x10010301e
cmp eax, r15d
je 0x100102d14
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jne 0x100103073
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.100052790
cmp eax, r15d
jl 0x100103017
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.1001055b4
cmp eax, r15d
mov ebx, eax
jl 0x100103085
mov r10, qword [rsp + 0x70]
mov ebx, r15d
mov edi, r15d
cmp esi, r15d
je 0x100102e38
mov r8d, esi
jle 0x100102e38
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
lea r11d, [rax + rdi]
movsxd rcx, r11d
shl rcx, 6
add rcx, rbp
cmp qword [rcx], r10
je 0x100102dd9
cmp r10, r15
lea rdx, [0x100039220]
lea rax, [0x100039220]
cmovne rdx, r10
cmp qword [rcx], r15
cmovne rax, qword [rcx]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x100102dc0
add rax, 2
test cx, cx
jne 0x100102da9
mov eax, r15d
jmp 0x100102dc5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
jge 0x100102dd9
or eax, 0xffffffff
lea edi, [r11 + 1]
sub eax, r9d
add r8d, eax
jmp 0x100102ddc
mov r8d, r9d
cmp r8d, r15d
jg 0x100102d6c
cmp edi, esi
jge 0x100102e38
movsxd rax, edi
shl rax, 6
add rax, rbp
cmp r10, qword [rax]
je 0x100102e34
cmp qword [rax], r15
lea rdx, [0x100039220]
cmovne rdx, qword [rax]
cmp r10, r15
lea rax, [0x100039220]
cmovne rax, r10
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x100102e2a
add rax, 2
test cx, cx
jne 0x100102e13
mov eax, r15d
jmp 0x100102e2f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
jl 0x100102e38
mov al, 1
jmp 0x100102e3b
mov al, r15b
cmp al, r15b
jne 0x100102f67
lea r8, [rsp + 0x5c]
mov edx, 1
mov ecx, esi
call fcn.100076eac
cmp eax, r15d
mov ebx, eax
jl 0x100102efc
mov edx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x40]
call fcn.100107f94
mov rbp, qword [rsp + 0x48]
mov esi, dword [rsp + 0x44]
cmp eax, r15d
mov ebx, eax
jl 0x100102efc
cmp edi, esi
jge 0x100102eb4
cmp rbp, r15
jne 0x100102e8f
mov rdx, r15
mov r9, r15
jmp 0x100102e95
mov rdx, rbp
mov r9, rbp
mov eax, esi
movsxd rcx, edi
shl rcx, 6
sub eax, edi
movsxd r8, eax
add rdx, rcx
lea rcx, [r9 + rcx + 0x40]
shl r8, 6
call sub.msvcrt.dll_memmove
movsxd rdi, edi
lea rdx, [0x100349170]
mov r8d, 0x40
shl rdi, 6
lea rbx, [rdi + rbp]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x30], r15
lea rcx, [rdi + rbp]
lea rdx, [rsp + 0x70]
mov qword [rbx + 0x38], r15
call fcn.100101b74
inc esi
mov dword [rsp + 0x44], esi
mov ebx, r15d
jmp 0x100102f2d
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x100102f3b
test byte [rcx + 0x3c], 2
je 0x100102f3b
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020598]
mov edx, 0xf
mov r9d, ebx
call fcn.100050618
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp ebx, r15d
jge 0x100102cb2
cmp rcx, rax
je 0x100102f6e
test byte [rcx + 0x3c], 2
je 0x100102f6e
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020598]
mov edx, 0x13
mov r9d, ebx
call fcn.100050618
mov rcx, qword [0x100331948]
cmp ebx, r15d
jge 0x100102cb2
lea rdx, [0x100331948]
cmp rcx, rdx
je 0x100102fa1
test byte [rcx + 0x3c], 2
je 0x100102fa1
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020568]
mov edx, 0xd
mov r9d, ebx
call fcn.100050618
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x100102fb6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x70]
call fcn.1001014f4
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.100106d68
mov rdi, qword [rsp + 0x48]
cmp rdi, r15
je 0x100102fea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1002edf64
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8004f807
jmp 0x100103073
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r15d
mov qword [rsp + 0x68], r15
call fcn.100107edc
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.100107edc
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.100106d68
mov rdi, qword [rsp + 0x68]
cmp rdi, r15
je 0x100103073
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x100331948]
cmp ebx, r15d
jge 0x100102fa1
jmp 0x10010308c
lea rdx, [0x100331948]
mov rcx, qword [0x100331948]
jmp 0x100102f7e