Function at 0x546620
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x5b0
mov rbp, rsp
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0x5a8], 0
nop
lea rcx, [rbp + 0x5a8]
call fcn.0040e080
lea rcx, [rbp + 0x94]
lea rdx, [0x00546998]
call sub.kernel32.dll_lstrcpyA
lea rcx, [rbp + 0x94]
lea rdx, [0x0054699c]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469a0]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469a4]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469a8]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469ab]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469ae]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469b2]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469b6]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469ba]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469be]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469c1]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469c5]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469c9]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469cd]
call sub.kernel32.dll_lstrcatA
mov rcx, 0xffffffff80000002
lea rdx, [rbp + 0x94]
xor r8, r8
mov r9d, 1
lea rax, [rbp + 0x498]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x546933
mov dword [rbp + 0x494], 0x104
lea rcx, [rbp + 0x94]
lea rdx, [0x005469d0]
call sub.kernel32.dll_lstrcpyA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469d4]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469d8]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469dc]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x94]
lea rdx, [0x005469e0]
call sub.kernel32.dll_lstrcatA
mov rcx, qword [rbp + 0x498]
lea rdx, [rbp + 0x94]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x4a4]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x494]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x546933
lea rcx, [rbp + 0x5a8]
lea rdx, [rbp + 0x4a4]
mov r8d, 0x104
xor r9, r9
call fcn.0040ecc0
mov rcx, qword [rbp + 0x5a8]
call fcn.0040f240
mov rcx, rax
call sub.kernel32.dll_lstrlenA
lea rcx, [rbp + 0x5a8]
mov edx, eax
xor r8, r8
call fcn.0040f4b0
lea rcx, [rbp + 0x5a8]
lea rdx, [0x005469f0]
call fcn.0040ed80
lea rcx, [rbp + 0x5a8]
mov edx, 0xd
mov r8, qword [rbp + 0x5a8]
lea r9, [0x00546a00]
lea rax, [0x00546a10]
mov qword [rsp + 0x20], rax
lea rax, [0x00546a20]
mov qword [rsp + 0x28], rax
lea rax, [0x00546a30]
mov qword [rsp + 0x30], rax
lea rax, [0x00546a40]
mov qword [rsp + 0x38], rax
lea rax, [0x00546a50]
mov qword [rsp + 0x40], rax
lea rax, [0x00546a60]
mov qword [rsp + 0x48], rax
lea rax, [0x00546a70]
mov qword [rsp + 0x50], rax
lea rax, [0x00546a80]
mov qword [rsp + 0x58], rax
lea rax, [0x00546a90]
mov qword [rsp + 0x60], rax
lea rax, [0x00546aa0]
mov qword [rsp + 0x68], rax
lea rax, [0x00546ab0]
mov qword [rsp + 0x70], rax
call fcn.0040f110
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x5a8]
call fcn.0040e770
nop
lea rcx, [rbp + 0x5a8]
test al, 5
add byte [rax], al