Function at 0x1400a06f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rsi, rdx
mov edi, ecx
xor r14d, r14d
mov ebx, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [0x14063ea20]
movdqu xmmword [rbp + 0x27], xmm1
mov word [rbp + 0x17], r14w
movups xmmword [rbp - 9], xmm0
movdqu xmmword [rbp + 7], xmm1
mov word [rbp - 9], r14w
mov qword [rbp + 0x7f], r14
lea rdx, [rbp + 0x17]
lea ecx, [r14 + 0xf]
call fcn.1400963f0
lea rdx, [rbp - 9]
lea ecx, [r14 + 0x10]
call fcn.1400963f0
mov eax, r14d
test edi, edi
sete al
mov ecx, 2
cmp edi, 1
cmove eax, ecx
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rsp + 0x40], r14
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400a0832
test edi, edi
jne 0x1400a07f6
mov dword [rbp + 0x67], r14d
mov dword [rbp + 0x77], 4
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x67]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a0832
cmp dword [rbp + 0x67], 4
jne 0x1400a0832
lea ebx, [rdi + 1]
jmp 0x1400a0832
cmp edi, 1
jne 0x1400a0832
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
lea r9d, [rdi + 3]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, ebx
mov ebx, edi
test eax, eax
cmove ecx, ebx
mov ebx, ecx
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400a0842
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400a087e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0879
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a08e2
call fcn.14005fc98
movdqa xmm0, xmmword [0x14063ea20]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x1400a08cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a08c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a08dc
call fcn.14005fc98
mov eax, ebx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140070b74
nop
call fcn.140070b74
nop
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, vtable.std::time_put_unsigned_short_int__class_std::ostreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov dword [rcx + 8], r8d
lea rsi, [rcx + 0x10]
mov qword [rcx], rax
and qword [rsi], 0
mov rdi, rcx
call fcn.14003eb48
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rsi, rax
je 0x1400a092f
mov rcx, qword [rsi]
call fcn.1405ea4b4
mov qword [rsi], rbx
xor ebx, ebx
mov rcx, rbx
call fcn.1405ea4b4
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret