Function at 0x2eda33160
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5e8
xor r12d, r12d
mov qword [rsp + 0x630], rcx
lea rcx, [0x2eda3e4c0]
call fcn.2eda35e40
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov r9d, 0x108
mov r13, rax
lea rax, [rsp + 0xa0]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r13
call rdi
test eax, eax
jne 0x2eda3337a
mov ecx, 0x40000
call fcn.2eda34ed0
mov r12, rax
test rax, rax
je 0x2eda3336c
mov byte [rax], 0
lea rcx, [0x2eda3e530]
xor ebx, ebx
lea rbp, [rsp + 0x98]
lea rsi, [rsp + 0x1c0]
lea r15, [rsp + 0xa8]
call fcn.2eda35e40
lea rcx, [0x2eda3e550]
mov qword [rsp + 0x48], rax
call fcn.2eda35e40
lea rcx, [0x2eda3e578]
mov qword [rsp + 0x58], rax
call fcn.2eda35e40
lea rcx, [0x2eda3e597]
mov qword [rsp + 0x60], rax
call fcn.2eda35dc0
lea rcx, [0x2eda3e5a1]
mov qword [rsp + 0x50], rax
call fcn.2eda35dc0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x9c]
mov r13, rax
jmp 0x2eda33263
add ebx, 1
mov dword [rsp + 0x98], 0x104
mov r9, rbp
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x2eda33320
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov r9d, 0x101
mov rdx, rsi
mov rcx, qword [rsp + 0xa0]
call rdi
test eax, eax
jne 0x2eda33260
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rdx, qword [rsp + 0x48]
lea r14, [rsp + 0x3d0]
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x2eda333a0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2eda33260
mov rcx, r12
mov r13, qword [rsp + 0x70]
call sub.msvcrt.dll_strlen
mov rdi, qword [rsp + 0x630]
mov rcx, qword [rsp + 0x68]
add eax, 1
mov dword [rdi], eax
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x50]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x60]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x58]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x48]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call fcn.2eda35ed0
mov rax, r12
add rsp, 0x5e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x9c]
mov rcx, r14
mov byte [rsp + rax + 0x3d0], 0
lea rax, [rsp + 0x3d1]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x9c]
mov byte [rsp + rax + 0x3d1], 0
call fcn.2eda32790
mov r9, rax
test rax, rax
je 0x2eda3344b
cmp byte [r12], 0
je 0x2eda333ea
test ebx, ebx
jne 0x2eda33620
mov rcx, r9
mov qword [rsp + 0x80], r9
call sub.msvcrt.dll_strlen
mov r9, qword [rsp + 0x80]
lea r10, [rsp + 0xb0]
mov rcx, r10
mov r8d, eax
mov qword [rsp + 0x80], r10
mov rdx, r9
mov qword [rsp + 0x88], r9
call fcn.2eda31580
mov r10, qword [rsp + 0x80]
mov rcx, r12
mov rdx, r10
call sub.msvcrt.dll_strcat
mov r9, qword [rsp + 0x88]
mov rcx, r9
call fcn.2eda34f30
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r14
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x2eda33550
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call sub.msvcrt.dll_strcat
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], r14
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x9c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2eda33600
mov eax, dword [rsp + 0x9c]
mov rdx, qword [rsp + 0x78]
mov rcx, r14
mov byte [r14 + rax], 0
mov eax, dword [rsp + 0x9c]
mov byte [rax + rdx], 0
call fcn.2eda32790
mov r14, rax
test rax, rax
je 0x2eda33309
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rcx, r14
call sub.msvcrt.dll_strlen
lea r9, [rsp + 0xb0]
mov rdx, r14
mov r8d, eax
mov rcx, r9
mov qword [rsp + 0x78], r9
call fcn.2eda31580
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov rdx, r9
call sub.msvcrt.dll_strcat
mov rcx, r14
call fcn.2eda34f30
jmp 0x2eda33309
mov eax, dword [rsp + 0x9c]
mov rdx, qword [rsp + 0x78]
mov rcx, r14
mov byte [r14 + rax], 0
mov eax, dword [rsp + 0x9c]
mov byte [rax + rdx], 0
call fcn.2eda32790
test rax, rax
mov qword [rsp + 0x80], rax
je 0x2eda3349b
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov r9, qword [rsp + 0x80]
mov rcx, r9
call sub.msvcrt.dll_strlen
mov r9, qword [rsp + 0x80]
lea r10, [rsp + 0xb0]
mov r8d, eax
mov rcx, r10
mov qword [rsp + 0x80], r10
mov rdx, r9
mov qword [rsp + 0x88], r9
call fcn.2eda31580
mov r10, qword [rsp + 0x80]
mov rcx, r12
mov rdx, r10
call sub.msvcrt.dll_strcat
mov r9, qword [rsp + 0x88]
mov rcx, r9
call fcn.2eda34f30
jmp 0x2eda3349b
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call sub.msvcrt.dll_strcat
jmp 0x2eda33309
mov rdx, qword [rsp + 0x50]
mov rcx, r12
mov qword [rsp + 0x80], rax
call sub.msvcrt.dll_strcat
mov r9, qword [rsp + 0x80]
jmp 0x2eda333ea