Function at 0x140001450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140005038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1400033f0]
lea rcx, [rsp + 0x50]
xor ebx, ebx
mov qword [rcx], rax
mov rax, qword [0x1400033f8]
xor edx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x140003400]
mov r8d, 0xeb
mov qword [rcx + 0x10], rax
movzx eax, byte [0x140003408]
mov dword [rsp + 0x40], 4
mov byte [rcx + 0x18], al
lea rcx, [rsp + 0x69]
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x38], 0x3f6
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000176a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, [0x1400033e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000176a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, str.VERSION_Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001668
lea ebx, [rax + 1]
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
je 0x140001762
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9d, [rbx + 3]
lea rdx, str.VERSION_Value
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, [0x140003398]
mov rcx, rdi
call sub.MSVCR90.dll_strlen
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140003388]
inc eax
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, str.ff3487rbea4775grsn9_.uvu_an1135_1_bml_22114i81
mov rcx, rdi
call sub.MSVCR90.dll_strlen
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140003348]
inc eax
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.140001100
call fcn.140002110
mov rcx, qword [rsp + 0x30]
lea rax, [0x140005060]
lea r9d, [rbx + 3]
lea rdx, [0x1400033e0]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
lea rax, [0x140005064]
lea r9d, [rbx + 3]
lea rdx, [0x140003338]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x140001762
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, str.VERSION_Value
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, [0x140003398]
mov rcx, rdi
call sub.MSVCR90.dll_strlen
mov rcx, qword [rsp + 0x30]
mov ebx, 1
inc eax
lea rdx, [0x140003388]
mov r9d, ebx
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, str.ff3487rbea4775grsn9_.uvu_an1135_1_bml_22114i81
mov rcx, rdi
call sub.MSVCR90.dll_strlen
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140003348]
inc eax
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.140001100
call fcn.140002110
mov rcx, qword [rsp + 0x30]
lea rax, [0x140005060]
lea r9d, [rbx + 3]
lea rdx, [0x1400033e0]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
lea rax, [0x140005064]
lea r9d, [rbx + 3]
lea rdx, [0x140003338]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000177a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400022f0
add rsp, 0x170
pop rbx
ret