Function at 0x14000bcf0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x1a8], 0xfffffffffffffffe
mov rax, qword [0x14002f100]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x1e0]
mov dword [rax + 0x20], 0
mov rax, qword [rsp + 0x1e0]
mov dword [rax + 0x24], 0
mov rax, qword [rsp + 0x1e0]
mov dword [rax + 0x28], 0
lea rcx, [rsp + 0xc0]
call fcn.14000d110
nop
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x1e0]
call fcn.14000bc30
cmp dword [0x140031d44], 0
je 0x14000bd86
lea rcx, [rsp + 0xc0]
call fcn.140024f10
jmp 0x14000bff0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002910]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0
je 0x14000be28
lea rcx, [rsp + 0xc0]
call fcn.14000a870
mov qword [rsp + 0x1b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x1b0]
mov r8, rcx
mov edx, eax
lea rcx, [0x140002960]
call qword [0x140030960]
nop
lea rcx, [rsp + 0xc0]
call fcn.140024f10
jmp 0x14000bff0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0x1b8]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x140002988]
mov edx, 0x20
lea rcx, [rsp + 0x60]
call fcn.14000a220
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
lea rax, [rsp + rax*2 + 0x60]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0xa0]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov ecx, 0x20
sub rcx, rax
mov rax, rcx
mov r9d, dword [rsp + 0x50]
lea r8, [0x1400029a0]
mov edx, eax
mov rcx, qword [rsp + 0xa0]
call fcn.14000a220
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000bf02
jmp 0x14000bf0e
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
jmp 0x14000be91
lea rcx, [rsp + 0xc0]
call fcn.14000d6f0
mov dword [rsp + 0x1bc], eax
lea rcx, [rsp + 0xc0]
call fcn.14000a870
mov ecx, dword [rsp + 0x1bc]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0
je 0x14000bfa3
lea rcx, [rsp + 0xc0]
call fcn.14000a870
mov qword [rsp + 0x1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x1c0]
mov r8, rcx
mov edx, eax
lea rcx, [0x140002960]
call qword [0x140030960]
jmp 0x14000bfd4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x1e0]
mov dword [rcx + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x1e0]
mov dword [rcx + 0x24], eax
mov rax, qword [rsp + 0x1e0]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x28], ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0xc0]
call fcn.140024f10
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.140029820
add rsp, 0x1d0
pop rdi
ret