Function at 0x140032470
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rdi, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400326f9
test r9, r9
je 0x1400326f9
xor edx, edx
mov qword [rsp + 0x270], rbx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.140038310
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x14003255f
mov rcx, qword [rsp + 0x48]
mov r9d, 0xffff
mov dword [rsp + 0x40], eax
mov r8, rbp
lea rax, [rsp + 0x278]
mov dword [rsp + 0x278], 0x200
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ebx, eax
test eax, eax
je 0x140032552
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140032552
mov r9, rbp
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s.
mov edx, 8
call fcn.14002fe30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003257f
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x140032586
mov r9, rsi
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.14002fe30
mov rcx, qword [0x1400b5090]
test ebx, ebx
jne 0x1400326eb
lea rax, [rsp + 0x278]
mov qword [rsp + 0x278], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x14003268c
mov rdi, qword [rsp + 0x290]
test rdi, rdi
je 0x140032677
lea rax, [rsp + 0x50]
lea ecx, [rbx + 1]
nop
cmp byte [rax], 0
jne 0x1400325eb
cmp byte [rax + 1], 0
je 0x1400325fa
cmp ecx, 0x200
jae 0x1400325fa
inc rax
inc ecx
jmp 0x1400325e0
inc ecx
cmp ecx, 0x200
jae 0x140032662
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x278]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x14003267c
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x14003267c
mov r9, rdi
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s.
mov edx, 8
call fcn.14002fe30
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400326ac
mov rcx, qword [rsp + 0x278]
mov ebx, 0x7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400326ac
mov ebx, 0x57
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400326ac
mov rcx, qword [0x1400b5090]
test rcx, rcx
je 0x1400326b3
mov r9, rdi
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.14002fe30
mov rcx, qword [0x1400b5090]
test ebx, ebx
je 0x1400326cd
test rcx, rcx
je 0x1400326cd
lea r8, str.CopyMultiSzRegValue:_SetMultiSzRegValue_failed
mov edx, 8
call fcn.14002fe30
mov eax, ebx
mov rbx, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rsi
ret
test rcx, rcx
je 0x1400326cd
lea r8, str.CopyMultiSzRegValue:_GetMultiSzRegValue_failed
jmp 0x1400326c3
mov eax, 0x57
jmp 0x1400326d7