Function at 0x1400283a0
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rbx, qword [str.SOFTWARENitroPro13SettingsPreferences]
call fcn.140027350
mov rcx, rax
test rax, rax
je 0x140028752
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x14002841c
cmp rbx, 0x10000
jae 0x140028405
movzx edx, bx
lea rcx, [rbp + 0x58]
call fcn.1400027a0
jmp 0x14002842e
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140028410
jmp 0x14002841e
xor eax, eax
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.140002f50
nop
lea rsi, str.kPreferences
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140028440
mov r15, rsi
mov rbx, qword [rbp + 0x58]
sub r15, rbx
sar r15, 1
mov r12d, dword [rbx - 0x10]
test eax, eax
js 0x14002875d
movsxd rdx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r13, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140028768
lea r14d, [r12 + rax]
test r14d, r14d
js 0x140028773
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400284b1
mov edx, r14d
lea rcx, [rbp + 0x58]
call fcn.140002930
mov rbx, qword [rbp + 0x58]
cmp r15, r12
ja 0x1400284ba
lea rsi, [rbx + r15*2]
movsxd rdx, r13d
add rdx, rdx
lea rcx, [rbx + r12*2]
mov r9, rdx
mov r8, rsi
call fcn.140015180
cmp r14d, dword [rbx - 0xc]
jg 0x140028747
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov qword [rbp - 0x20], r14
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400285ba
call fcn.140027350
mov rcx, rax
test rax, rax
je 0x14002877e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rdx, str._b_1
lea rcx, [rbp - 0x28]
call fcn.14000bc50
mov rbx, qword [rbp - 0x28]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0xa
or ecx, eax
jge 0x14002856c
lea edx, [r14 + 0xa]
lea rcx, [rbp - 0x28]
call fcn.140002930
mov rbx, qword [rbp - 0x28]
mov dword [rsp + 0x28], select
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.kWasCrash
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], r14
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400285ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [str.SOFTWARENitroPro13Settings]
call fcn.140027350
mov rcx, rax
test rax, rax
je 0x14002873c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
test rbx, rbx
je 0x14002860c
cmp rbx, 0x10000
jae 0x1400285fc
movzx edx, bx
lea rcx, [rbp - 0x18]
call fcn.1400027a0
jmp 0x14002861f
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140028600
jmp 0x14002860f
mov eax, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.140002f50
nop
mov qword [rbp + 0x60], r14
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400286f6
mov dword [rbp + 0x50], r14d
mov dword [rbp + 0x48], r14d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.exepath
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400286e8
mov ecx, dword [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov r8d, dword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.exepath
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400286e8
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x60], r14
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140028710
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002872b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001ff0
int3
mov ecx, 0x80070057
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80070057
call fcn.140001ff0
int3
mov ecx, 0x80070057
call fcn.140001ff0
int3
mov ecx, 0x80070057
call fcn.140001ff0
int3
mov ecx, 0x80004005
call fcn.140001ff0
int3