Function at 0x140028ec0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov rax, qword [0x14057bbc0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x50], 0
lea rax, str.SoftwareBolmax
mov qword [rsp + 0x68], rax
lea rax, str.BMID
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x140028f7c
lea rdx, [0x14044f568]
mov rcx, qword [rsp + 0x110]
call fcn.1400209e0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
jmp 0x1400291c9
mov dword [rsp + 0x90], Ordinal_41
mov dword [rsp + 0x94], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x94]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x140029015
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x110]
call fcn.1400209e0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
jmp 0x1400291c9
lea rcx, [rsp + 0xb8]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140029068
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14044f56c]
mov rcx, qword [rsp + 0x110]
call fcn.1400209e0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
jmp 0x1400291c9
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1400290c3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14044f570]
mov rcx, qword [rsp + 0x110]
call fcn.1400209e0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
jmp 0x1400291c9
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x98]
call fcn.1400209e0
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
lea rcx, [rsp + 0x98]
call fcn.1400267d0
inc rax
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x98]
call fcn.140024b60
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x140029186
lea rdx, [0x14044f574]
mov rcx, qword [rsp + 0x110]
call fcn.1400209e0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x98]
call fcn.140021d10
mov rax, qword [rsp + 0x110]
jmp 0x1400291c9
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x110]
call fcn.1400208c0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x98]
call fcn.140021d10
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140382d40
add rsp, 0x108
ret