keys = [ r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", 
r"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run", 
r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components", 
r"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components", 
r"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", 
r"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" ]


def Reg2Markdown(baseKey,regResp):
    res, mdRows  = [], ''
    if isError(regResp[0]):
        res += regResp
    elif len(regResp) > 1 :
        res.append( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Unexpected output from D2RegQuery - more than one entry returned:\n'+'\n'.join( [ str(x) for x in regResp ] ) } )
    else:
        subkeys = regResp[0]['Contents']
        for sk in subkeys:
            if type(subkeys[sk]) == dict:
                for ssk in subkeys[sk]: 
                    mdRows += '\n|' + str(baseKey) + '\\' + str(sk) + '|' + str(ssk) + '|' + str( subkeys[sk][ssk] ) + '|'
            else:
                mdRows += '\n|' + str(baseKey) + '|' + str(sk) + '|' + str( subkeys[sk] ) + '|'
    return ( res, mdRows )


res = []
if 'system' in demisto.args():
    system = demisto.args()['system']
elif 'using' in demisto.args():
    system = demisto.args()['using']
else:
    demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'You must provide "system" or "using" as arguments.'} )
    sys.exit(0)
    
mdTable = '### Results for short registry probe of system *' + system + '*'
mdTable += '\n|Key|SubKey|Value|'
mdTable += '\n|-----|------|-----|'
for k in keys:
    regPath = NormalizeRegistryPath( k )
    cmdResp = demisto.executeCommand( 'D2RegQuery', { 'using' : system, 'regpath' : regPath } )
    moreEntries , moreRows = Reg2Markdown( regPath, cmdResp )
    mdTable += moreRows
    res += moreEntries
res.append ( { 'Type' : entryTypes['note'], 'ContentsFormat' : formats['markdown'], 'Contents' : mdTable } )
demisto.results(res)
