Function at 0x14001b1b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xbf90]
mov eax, 0xc090
call fcn.1401d95d0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1402cb768]
xor rax, rsp
mov qword [rbp + 0xbf80], rax
mov rbx, r9
mov r12, r8
mov r15, rdx
mov sil, 1
mov dword [rsp + 0x5c], 0
call fcn.1400311c4
mov rcx, rax
test rax, rax
jne 0x14001b216
mov ecx, 0x80004005
call fcn.140009c20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [0x140280a88]
or rdi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x14001b25c
movzx r14d, dx
mov ecx, r14d
call fcn.1400316a4
test rax, rax
je 0x14001b277
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140009250
jmp 0x14001b277
mov rax, rdi
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x14001b260
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140009510
nop
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp - 0x80]
call fcn.1401de4e0
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp + 0x3f80]
call fcn.1401de4e0
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp + 0x7f80]
call fcn.1401de4e0
mov dword [rsp + 0x28], 0x2000
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 0x2000
lea rax, [rbp + 0x3f80]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
cmp byte [rbp + 0xbff0], r8b
je 0x14001b3eb
movsx eax, byte [rbx]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001b373
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x80]
mov r8d, 0xcc
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegCreateKeyEx_fail__szSubKeyHub3_s__dwErrorCode_d
call fcn.140009e20
xor sil, sil
jmp 0x14001b49e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x3f80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14001b3db
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3f80]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8d, 0xd5
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegSetValueEx_fail__lResult_d__wKeyName__ws___dwErrorCode_d
call fcn.140009e20
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x14001b493
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001b42b
xor sil, sil
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x80]
mov r8d, 0xe1
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegOpenKeyExW_fail__szSubKeyHub3_ws__dwErrorCode_d
call fcn.140009e20
jmp 0x14001b49e
mov dword [rsp + 0x58], 0x2000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x3f80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b490
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14001b493
lea rcx, [rbp + 0x7f80]
mov edx, eax
cmp word [rcx], 0
je 0x14001b484
movzx eax, byte [rcx]
mov byte [rbx], al
inc rbx
add rcx, 2
sub rdx, 1
jne 0x14001b476
jmp 0x14001b493
xor sil, sil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14001b4bb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
mov rcx, qword [rbp + 0xbf80]
xor rcx, rsp
call fcn.1401d87c0
add rsp, 0xc090
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret