Function at 0x10000ef34
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x90], rsi
mov rax, qword [0x100090120]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0x28], rdx
xor ebx, ebx
mov dword [rbp + 0x20], ebx
mov sil, 1
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, r13
call fcn.100001740
mov dword [rbp + 0x20], 1
lea rcx, [rbp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidCreateNil]
cmp qword [0x100092230], rbx
je 0x1000214c1
mov edi, 0x25
mov rcx, rdi
call fcn.1000080f0
mov qword [rbp], rax
cmp rax, rbx
je 0x10000f078
mov dword [rbp + 0x18], edi
mov dword [rbp + 8], ebx
lea rdx, [0x10006b010]
lea rcx, [rbp + 0x10]
call fcn.10000f0b0
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.10000a1a4
nop
lea rcx, [rbp + 0x10]
call fcn.1000012a0
lea r11, [rbp + 0x18]
mov qword [rsp + 0x28], r11
mov rax, qword [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c]
xor r8d, r8d
lea rdx, str.UserID
mov rcx, qword [0x100092230]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
movabs r15, 0xffffffffffffff0
cmp eax, ebx
jne 0x10000f066
cmp dword [rbp + 0x1c], 1
jne 0x10000f066
mov rax, qword [rbp]
mov byte [rax + 0x24], bl
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp]
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
cmp eax, ebx
je 0x1000214d6
cmp dword [rbp + 8], ebx
jne 0x10000f066
cmp sil, bl
je 0x100021587
mov sil, bl
mov rcx, qword [rbp]
call sub.msvcrt.dll_free
cmp sil, bl
jne 0x1000215ba
mov rax, r13
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.100001100
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x90]
lea rsp, [rbp + 0x50]
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, r12
call fcn.10000edd8
cmp al, bl
jne 0x10000efac
jmp 0x10000f078
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidIsNil]
cmp eax, ebx
jne 0x10000f055
cmp dword [rbp + 8], ebx
je 0x10002157f
mov rsi, qword [rbp]
cmp rsi, rbx
jne 0x100021503
mov rdx, rbx
jmp 0x100021577
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x10002151e
mov rdx, rbx
jmp 0x100021577
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x100021530
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.100002240
sub rsp, rcx
lea r12, [rsp + 0x30]
cmp r12, rbx
je 0x100021574
mov word [r12], bx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, r12
jmp 0x100021577
mov rdx, rbx
mov rcx, r13
call fcn.100002354
mov sil, bl
jmp 0x10000f055
mov dword [rsp + 0x28], ebx
lea rax, [0x10006d542]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.UserID
mov rcx, qword [0x100092230]
call qword [sym.imp.KERNEL32.dll_RegSetValueExA]
nop
jmp 0x10000f063
cmp dword [rbp + 8], ebx
je 0x10000f078
lea rcx, [rbp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
lea rdx, [rbp]
lea rcx, [rbp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
cmp eax, ebx
jne 0x10000f078
mov r8, qword [rbp]
cmp r8, rbx
je 0x100021615
mov rcx, rdi
mov rdx, r8
mov eax, ebx
cmp byte [rdx], bl
je 0x100021601
inc rdx
sub rcx, 1
jne 0x1000215f4
cmp rcx, rbx
jne 0x100021610
mov eax, 0x80070057
mov rdi, rbx
jmp 0x10002161e
sub rdi, rcx
jmp 0x10002161e
mov eax, 0x80070057
mov rdi, qword [rbp + 0x28]
cmp eax, ebx
cmovl rdi, rbx
cmp eax, ebx
jne 0x1000216ce
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
lea rdx, str.UserID
mov rcx, qword [0x100092230]
call qword [sym.imp.KERNEL32.dll_RegSetValueExA]
mov rsi, qword [rbp]
cmp rsi, rbx
je 0x1000216c3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x1000216c3
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x100021683
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.100002240
sub rsp, rcx
lea rdi, [rsp + 0x30]
cmp rdi, rbx
je 0x1000216c3
mov word [rdi], bx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rbx, rbx
and rbx, rdi
mov rdx, rbx
mov rcx, r13
call fcn.100002354
lea rcx, [rbp]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
nop
jmp 0x10000f078