Function at 0x100009bbc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r13, r8
mov rax, rcx
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
cmp rcx, rbx
je 0x100009e9a
cmp rdx, rbx
je 0x100009e9a
cmp r8, rbx
je 0x100009e9a
cmp r9, rbx
je 0x100009e9a
mov r12, qword [rsp + 0xb0]
cmp r12, rbx
je 0x100009e9a
mov rbp, qword [rsp + 0xc0]
cmp rbp, rbx
je 0x100009e9a
mov edi, dword [rsp + 0xb8]
cmp edi, ebx
je 0x100009c4c
cmp edi, 1
jne 0x100009c59
cmp dword [rbp], 1
jne 0x100009c59
xor eax, eax
jmp 0x100009ea8
lea rcx, [rsp + 0x34]
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov rdx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, ebx
je 0x100009c90
mov ecx, eax
call fcn.100002fe8
mov eax, esi
jmp 0x100009ea8
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, ebx
jne 0x100009c82
mov ecx, dword [rsp + 0x34]
cmp edi, ebx
je 0x100009cc6
cmp edi, 1
jne 0x100009cde
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
jne 0x100009e8e
cmp ecx, dword [rsp + 0x30]
jne 0x100009e8e
inc ecx
mov esi, 0xfffffffe
and ecx, esi
mov dword [rsp + 0x34], ecx
add ecx, 2
call fcn.10000ef18
mov r14, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x100009d0a
mov ebx, 0xe
jmp 0x100009e9f
mov ecx, dword [rsp + 0x30]
inc ecx
and ecx, esi
mov dword [rsp + 0x30], ecx
add ecx, 2
call fcn.10000ef18
mov r15, rax
mov qword [rsp + 0x48], rax
cmp rax, rbx
jne 0x100009d37
lea rcx, [rsp + 0x40]
call fcn.10000ee3c
jmp 0x100009d00
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, ebx
jne 0x100009e73
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, ebx
jne 0x100009e73
mov r10d, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
cmp r10d, dword [rsp + 0x38]
jne 0x100009df8
cmp ecx, dword [rsp + 0x30]
jne 0x100009df8
cmp ecx, ebx
jbe 0x100009dca
mov r8, r14
mov rdx, r15
sub r8, r15
mov al, byte [rdx]
cmp byte [r8 + rdx], al
jne 0x100009df8
inc ebx
inc rdx
cmp ebx, ecx
jb 0x100009db9
cmp edi, 2
je 0x100009dd4
cmp edi, 4
jne 0x100009e53
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x98]
mov r9, r14
mov r8d, r10d
mov rdx, r12
call fcn.10000a098
jmp 0x100009e53
cmp edi, 3
je 0x100009e02
cmp edi, 4
jne 0x100009e4c
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x98]
mov r9, r14
mov r8d, r10d
mov rdx, r12
call fcn.10000a098
mov eax, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
mov r9, r15
mov rdx, r12
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call fcn.10000a098
mov dword [rbp], 1
lea rcx, [rsp + 0x40]
call fcn.10000ee3c
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
xor ecx, ecx
call fcn.100002fe8
jmp 0x100009c52
lea rcx, [rsp + 0x40]
call fcn.10000ee3c
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
mov ecx, esi
jmp 0x100009c84
mov dword [rbp], 1
jmp 0x100009c52
mov ebx, 0x57
mov ecx, ebx
call fcn.100002fe8
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret