Function at 0x10007c914
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebp, ebp
mov r13, rdx
mov r15, rcx
cmp rdx, rbp
je 0x10007ce79
mov rcx, rdx
call fcn.100074d28
or esi, 0xffffffff
cmp eax, esi
jne 0x10007ce79
lea ecx, [rbp + 0x70]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, rbp
je 0x10007c979
lea rcx, [rax + 0x40]
call fcn.10007d40c
lea rcx, [rbx + 0x50]
call fcn.10007d40c
lea rcx, [rbx + 0x60]
call fcn.10007d40c
jmp 0x10007c97c
mov rbx, rbp
mov qword [rsp + 0x38], rbx
cmp rbx, rbp
je 0x10007ce79
lea rdx, [0x100032ae0]
mov rcx, rbx
mov r8d, 0x40
call sub.msvcrt.dll_memcpy
lea rcx, [rbx + 0x40]
mov r8d, esi
mov rdx, r13
call fcn.10007d57c
cmp eax, ebp
jge 0x10007c9da
lea rcx, [rbx + 0x60]
call fcn.10007d970
lea rcx, [rbx + 0x50]
call fcn.10007d970
lea rcx, [rbx + 0x40]
call fcn.10007d970
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10007ce79
mov rax, qword [rbx + 0x40]
lea rcx, [rsp + 0x60]
mov qword [rbx], rax
call fcn.10007d40c
lea rdx, [0x100029f80]
lea rcx, [rsp + 0x60]
mov r8d, esi
call fcn.10007d57c
lea rcx, [rsp + 0x60]
mov r8d, esi
mov rdx, r13
call fcn.10007d7d4
mov r12, qword [rsp + 0x60]
mov eax, ebp
cmp r12, rbp
je 0x10007ca23
cmp word [r12], bp
setne al
lea r14, [0x100020690]
cmp al, bpl
je 0x10007cbe4
lea rcx, [rsp + 0x50]
call fcn.10007d40c
lea rcx, [rsp + 0x50]
call fcn.10007d970
cmp r12, rbp
je 0x10007ca67
lea r9, [0x100030e40]
lea rcx, [rsp + 0x50]
mov r8, r12
mov rdx, 0xffffffff80000000
call fcn.10007dcf0
mov rsi, qword [rsp + 0x50]
mov eax, ebp
cmp rsi, rbp
je 0x10007ca79
cmp word [rsi], bp
setne al
cmp al, bpl
je 0x10007cacc
lea rdx, [0x100032a00]
mov rcx, rsi
call fcn.10007d3c0
cmp al, bpl
je 0x10007ca99
mov edi, 2
jmp 0x10007cac9
cmp rsi, rbp
je 0x10007cacc
mov edi, ebp
mov rbp, r14
mov rdx, qword [rbp]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x10007cac2
inc edi
add rbp, 0x18
cmp edi, 6
jb 0x10007caa3
or edi, 0xffffffff
xor ebp, ebp
cmp edi, 0xffffffff
je 0x10007cacc
mov dword [rbx + 0x18], edi
lea rcx, [rsp + 0x40]
call fcn.10007d40c
lea rcx, [rsp + 0x40]
call fcn.10007d970
cmp r12, rbp
je 0x10007cb00
lea r9, [0x100030e60]
lea rcx, [rsp + 0x40]
mov r8, r12
mov rdx, 0xffffffff80000000
call fcn.10007dcf0
mov rdi, qword [rsp + 0x40]
mov eax, ebp
cmp rdi, rbp
je 0x10007cb12
cmp word [rdi], bp
setne al
cmp al, bpl
je 0x10007cbcd
mov rsi, rdi
cmp rdi, rbp
je 0x10007cb83
cmp word [rdi], bp
je 0x10007cb3d
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rsi], ax
add rsi, 2
cmp word [rsi], bp
jne 0x10007cb28
mov edx, 0x2f
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rsi, rax
cmp rax, rbp
je 0x10007cb5b
sub rsi, rdi
sar rsi, 1
jmp 0x10007cb5e
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x10007cb83
lea rbp, [rbx + 0x50]
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call fcn.10007d57c
movsxd r11, esi
lea rcx, [rbx + 0x60]
lea rdx, [rdi + r11*2 + 2]
jmp 0x10007cb8d
lea rbp, [rbx + 0x50]
mov rdx, rdi
mov rcx, rbp
or r8d, 0xffffffff
call fcn.10007d57c
mov rcx, qword [rbp]
xor edx, edx
mov eax, edx
cmp rcx, rdx
je 0x10007cba9
cmp word [rcx], dx
setne al
cmp al, dl
je 0x10007cbb1
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x60]
xor ebp, ebp
mov eax, ebp
cmp rcx, rbp
je 0x10007cbc4
cmp word [rcx], bp
setne al
cmp al, bpl
je 0x10007cbcd
mov qword [rbx + 0x10], rcx
lea rcx, [rsp + 0x40]
call fcn.10007d970
lea rcx, [rsp + 0x50]
call fcn.10007d970
or esi, 0xffffffff
mov eax, ebp
cmp r12, rbp
je 0x10007cbf3
cmp word [r12], bp
setne al
cmp al, bpl
je 0x10007cdb4
lea rcx, [rsp + 0x50]
call fcn.10007d40c
lea rdx, [0x100032b20]
lea rcx, [rsp + 0x50]
mov r8d, esi
call fcn.10007d57c
lea rcx, [rsp + 0x50]
mov r8d, esi
mov rdx, r12
call fcn.10007d7d4
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rsi, rbp
mov qword [rsp + 0x40], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10007cd62
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
lea rdx, [0x100031810]
mov edi, 4
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc0], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xc0]
cmp r11d, 0x10
jae 0x10007ccb9
mov dword [rbx + 0x30], r11d
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea rdx, [0x1000319e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0xb8], ebp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xb8]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and r11d, 0x9f
lea rax, [rsp + 0xc8]
mov dword [rsp + 0xb8], r11d
mov dword [rbx + 0x38], r11d
lea rdx, [0x100031b50]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0xc8], 0x3000
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0xc8]
mov dword [rbx + 0x34], r11d
jmp 0x10007cd9c
mov rcx, qword [rbx + 0x50]
lea rdx, [0x100032a00]
call fcn.10007d3c0
cmp al, bpl
jne 0x10007cd87
cmp dword [rbx + 0x18], 2
je 0x10007cd87
mov edi, 4
mov dword [rbx + 0x30], edi
jmp 0x10007cd95
mov dword [rbx + 0x30], 0xb
mov dword [rbx + 0x34], 0x3800
mov dword [rbx + 0x38], 0x97
cmp rsi, rbp
je 0x10007cdaa
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x50]
call fcn.10007d970
lea rcx, [rsp + 0x50]
call fcn.10007d40c
lea rcx, [rsp + 0x50]
call fcn.10007d970
lea r8, [0x100032b90]
lea rcx, [rsp + 0x50]
mov r9, r13
mov rdx, 0xffffffff80000002
call fcn.10007dcf0
mov rsi, qword [rsp + 0x50]
mov eax, ebp
cmp rsi, rbp
je 0x10007cdf5
cmp word [rsi], bp
setne al
cmp al, bpl
je 0x10007ce27
cmp rsi, rbp
je 0x10007ce27
mov edi, ebp
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
je 0x10007ce1f
inc edi
add r14, 0x18
cmp edi, 6
jb 0x10007ce01
or edi, 0xffffffff
cmp edi, 0xffffffff
je 0x10007ce27
mov dword [rbx + 0x1c], edi
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.10007d05c
cmp eax, ebp
jge 0x10007ce65
mov rbx, qword [rsp + 0x38]
cmp rbx, rbp
je 0x10007ce65
lea rcx, [rbx + 0x60]
call fcn.10007d970
lea rcx, [rbx + 0x50]
call fcn.10007d970
lea rcx, [rbx + 0x40]
call fcn.10007d970
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x50]
call fcn.10007d970
lea rcx, [rsp + 0x60]
call fcn.10007d970
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret