Function at 0x140003b70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rsi
push r12
push r15
sub rsp, 0x170
mov rax, qword [0x14003a2a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor esi, esi
lea r8, [rsp + 0x38]
mov dword [rdx], esi
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x38], rsi
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov dword [rsp + 0x30], esi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140003e0b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.PagingFiles
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x1a0], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
jne 0x140003df6
mov ecx, dword [rsp + 0x30]
mov qword [rsp + 0x160], r14
call fcn.14000f398
mov r14, rax
test rax, rax
je 0x140003de9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.PagingFiles
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
jne 0x140003ddf
mov qword [rsp + 0x1a8], rbp
mov rcx, r14
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r14 + rax], sil
jne 0x140003c60
test rax, rax
je 0x140003c9e
nop
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140003c77
add rcx, rax
mov rax, 0xffffffffffffffff
inc esi
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140003c90
test rax, rax
jne 0x140003c70
mov eax, dword [rsp + 0x30]
imul edx, esi, 0x13
add eax, 3
add edx, eax
mov ecx, edx
mov dword [rsp + 0x30], edx
call fcn.14000f398
mov rbp, rax
test rax, rax
jne 0x140003cc5
lea ebx, [rax + 0x7a]
jmp 0x140003dd7
mov qword [rsp + 0x168], rdi
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
mov rdi, r14
call fcn.1400059c0
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rbp
call fcn.1400059c0
mov esi, esi
mov rbx, rbp
test rsi, rsi
je 0x140003d96
nop
mov r9d, 0x104
lea r8, [rsp + 0x40]
lea rdx, [0x14002cdc4]
mov rcx, rdi
call fcn.1400044e0
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140003a30
test eax, eax
je 0x140003d33
mov dword [r12], 1
mov edx, dword [rsp + 0x30]
lea r9, [rsp + 0x40]
sub rdx, rbx
mov qword [rsp + 0x28], r15
add rdx, rbp
mov qword [rsp + 0x20], r15
lea r8, str._s__I64d__I64d
mov rcx, rbx
call fcn.140001ef0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140003d62
inc rax
add rbx, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140003d80
add rdi, rax
sub rsi, 1
jne 0x140003d00
xor eax, eax
lea rdx, str.PagingFiles
mov word [rbx], ax
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
sub ebx, ebp
inc ebx
mov dword [rsp + 0x28], ebx
lea r9d, [rax + 7]
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbp
mov ebx, eax
call fcn.14000f5f8
mov rdi, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x1a8]
mov rcx, r14
call fcn.14000f5f8
jmp 0x140003dee
mov ebx, 0x7a
mov r14, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400045d0
add rsp, 0x170
pop r15
pop r12
pop rsi
ret