Function at 0x10001d278
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
and dword [rsp + 0x68], 0
xor esi, esi
mov dword [rsp + 0x78], esi
test rdx, rdx
jne 0x10001d2e1
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x10001d2d7
test byte [rcx + 0x1c], 1
je 0x10001d2d7
lea edx, [rsi + 0xa]
lea r8, [0x1000017e0]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
mov eax, 0x80070057
jmp 0x10001d4ca
cmp qword [rcx + 0x28], rsi
je 0x10001d4c5
cmp dword [rcx + 0x34], esi
je 0x10001d4c5
cmp dword [rcx + 4], esi
je 0x10001d4b0
cmp dword [rcx], esi
jne 0x10001d4b0
cmp dword [rcx + 0x24], esi
je 0x10001d345
or r8d, 0x20019
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, r8d
xor r8d, r8d
mov rdx, qword [rbx + 0x18]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10001d33c
mov ebx, 0x80004005
jmp 0x10001d4c1
mov esi, 1
mov dword [rsp + 0x78], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10001d37a
mov ebx, 0x80004005
jmp 0x10001d4b2
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x10001d394
cmp eax, 2
je 0x10001d394
cmp eax, 7
jne 0x10001d398
add dword [rsp + 0x68], 2
jmp 0x10001d398
inc dword [rsp + 0x68]
xor ecx, ecx
lea rdx, [0x1000017f4]
cmp dword [rdx], eax
je 0x10001d3b7
inc ecx
add rdx, 8
cmp ecx, 0xb
jb 0x10001d3a1
mov eax, 9
jmp 0x10001d3c3
mov eax, ecx
lea rcx, [0x1000017f0]
mov eax, dword [rcx + rax*8]
mov ecx, dword [rbx + 0x10]
cmp ecx, eax
je 0x10001d424
cmp ecx, 9
je 0x10001d424
cmp ecx, 5
jne 0x10001d3d9
cmp eax, 1
je 0x10001d424
cmp ecx, 1
jne 0x10001d3e3
cmp eax, 5
je 0x10001d424
test ecx, ecx
jne 0x10001d3ec
cmp eax, 1
je 0x10001d424
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x10001d41a
test byte [rcx + 0x1c], 1
je 0x10001d41a
mov edx, 0xb
lea r8, [0x1000017e0]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
mov ebx, 0x80004005
jmp 0x10001d4b2
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x10001d43a
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
and qword [rbx + 8], 0
mov ecx, dword [rsp + 0x68]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rbx + 8], rax
jmp 0x10001d452
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x10001d462
mov ebx, 0x8007000e
jmp 0x10001d4b2
mov r8d, dword [rsp + 0x68]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10001d4a3
mov ebx, 0x80004005
jmp 0x10001d4b2
mov dword [rbx], 1
mov eax, dword [rsp + 0x68]
mov dword [rbx + 0x14], eax
xor ebx, ebx
test esi, esi
je 0x10001d4c1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10001d4ca
mov eax, 0xe0000000
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret