Function at 0x140030ba0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
sub rsp, 0x5d0
lea rbp, [rsp + 0x60]
mov eax, dword [rsp]
mov eax, 0x400
sub rsp, rax
lea rbx, [rsp + 0x60]
mov eax, dword [rbx]
test rbx, rbx
jne 0x140030bd8
lea rcx, str.FAILURE:_Failed_at__alloca_for_paclKey
call fcn.14000cbb0
jmp 0x140030f5e
xor edi, edi
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
call fcn.140067500
cmp eax, 3
jne 0x140030cf7
lea rax, [rbp]
lea r8d, [rdi + 0x20]
lea rcx, [rbp + 0x590]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], edi
mov qword [rbp], rdi
mov dword [rsp + 0x20], edi
mov qword [rbp + 8], rdi
mov byte [rbp + 0x590], dil
mov byte [rbp + 0x591], dil
mov byte [rbp + 0x592], dil
mov byte [rbp + 0x593], dil
mov byte [rbp + 0x594], dil
mov byte [rbp + 0x595], 5
mov byte [rbp + 0x598], dil
mov byte [rbp + 0x599], dil
mov byte [rbp + 0x59a], dil
mov byte [rbp + 0x59b], dil
mov byte [rbp + 0x59c], dil
mov byte [rbp + 0x59d], 1
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140030cc4
lea rax, [rbp + 8]
lea rcx, [rbp + 0x598]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dl, 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140030cf7
lea rcx, str.FAILURE:_Failed_at_AllocateAndInitializeSid
call fcn.14000cbb0
mov rcx, qword [rbp]
test rcx, rcx
je 0x140030cdf
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140030f5e
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x140030f5e
mov r9, qword [rbp + 8]
mov r8, qword [rbp]
lea rcx, [rbp + 0x30]
mov rdx, rbx
call fcn.140030920
test eax, eax
je 0x140030f5e
call fcn.14000cbc0
lea rdx, [rbp + 0x60]
xor r8d, r8d
mov rcx, rax
call fcn.1400660a0
cmp eax, 1
jne 0x140030f5e
lea rax, [rbp + 0x10]
lea rdx, [rbp + 0x64]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x598], 0x14
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x590], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140030f5e
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 0x598]
lea rdx, str.DefaultMode
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140030f54
lea rax, [rbp + 0x5a0]
lea r9, str.REG_SZ
lea rdx, [rbp + 0x64]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x5a8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000005
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140030f54
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x24]
lea rdx, str.DefaultSettings.BitsPerPel
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x18]
lea rdx, str.DefaultSettings.Flags
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x28]
lea rdx, str.DefaultSettings.VRefresh
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x590]
lea rdx, str.DefaultSettings.XPanning
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x1c]
lea rdx, str.DefaultSettings.XResolution
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x590]
lea rdx, str.DefaultSettings.YPanning
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
lea rax, [rbp + 0x20]
lea rdx, str.DefaultSettings.YResolution
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x10]
lea rdx, str.DefaultMode
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140030f6d
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140030f7c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
lea rsp, [rbp + 0x570]
pop rdi
pop rbx
pop rbp
ret