Function at 0x140013a34
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rdi, r8
mov r14, rdx
mov rcx, qword [section..data]
lea rax, section..data
mov r15d, 5
cmp rcx, rax
je 0x140013a93
test byte [rcx + 0x1c], 1
je 0x140013a93
cmp byte [rcx + 0x19], r15b
jb 0x140013a93
mov r9, qword [r14]
lea r8, [0x1400b4390]
mov rcx, qword [rcx + 0x10]
mov edx, 0xf2
call fcn.1400062dc
xor r12d, r12d
mov rcx, rdi
mov qword [rbp - 0x30], r12
mov esi, r12d
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
call fcn.1400056f8
lea r8, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Media_Servers
mov dword [rsp + 0x28], 0x2011f
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x30]
call fcn.14000d90c
mov ebx, eax
mov r10, qword [section..data]
lea rax, section..data
lea r13d, [r12 + 2]
cmp r10, rax
je 0x140013b29
test byte [r10 + 0x1c], r13b
je 0x140013b29
movzx eax, byte [r10 + 0x19]
test ebx, ebx
mov edx, r13d
cmove edx, r15d
cmp eax, edx
jb 0x140013b29
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400b4390]
mov edx, 0xf3
mov r9d, ebx
call fcn.14000ad20
mov r10, qword [section..data]
mov r15, qword [rbp - 0x30]
test ebx, ebx
jne 0x140013cbb
mov rdx, qword [r14]
lea rax, [rbp + 0x40]
mov r9d, 0x2011f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x40], r12
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140013b6e
mov rsi, qword [rbp + 0x40]
mov ebx, r12d
mov qword [rbp - 0x18], rsi
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140013bc2
test byte [r10 + 0x1c], r13b
je 0x140013bc2
movzx ecx, byte [r10 + 0x19]
test ebx, ebx
mov eax, 5
cmovne eax, r13d
cmp ecx, eax
jb 0x140013bc2
mov rax, qword [r14]
lea r8, [0x1400b4390]
mov rcx, qword [r10 + 0x10]
mov edx, 0xf4
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.140019220
mov r10, qword [section..data]
test ebx, ebx
jne 0x140013cbb
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], r12d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.UPnPDeviceID
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140013cb4
mov eax, dword [rbp + 0x58]
dec eax
cmp eax, 1
ja 0x140013cb4
mov r14d, dword [rbp + 0x40]
mov ecx, 1
mov r8, qword [rdi]
shr r14d, 1
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
lea ebx, [r14 + 1]
sub eax, ebx
mov dword [rbp + 0x40], ebx
or ecx, eax
jge 0x140013c40
mov edx, ebx
mov rcx, rdi
call fcn.140005c2c
mov r8, qword [rdi]
test ebx, ebx
js 0x140013d44
cmp ebx, dword [r8 - 0xc]
jg 0x140013d44
mov dword [r8 - 0x10], ebx
lea r9, [rbp + 0x40]
mov rax, qword [rdi]
lea rdx, str.UPnPDeviceID
lea rcx, [rbp - 0x18]
mov word [rax + r14*2 + 2], r12w
call fcn.140013998
mov rcx, qword [rdi]
test eax, eax
jne 0x140013d2e
test rcx, rcx
jne 0x140013c88
mov eax, r12d
jmp 0x140013c9e
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140013c8c
test eax, eax
js 0x140013d44
cmp eax, dword [rcx - 0xc]
jg 0x140013d44
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140013ced
test byte [r10 + 0x1c], 1
je 0x140013ced
cmp byte [r10 + 0x19], 5
jb 0x140013ced
mov r9, qword [rdi]
lea r8, [0x1400b4390]
mov rcx, qword [r10 + 0x10]
mov edx, 0xf5
call fcn.1400062dc
test rsi, rsi
je 0x140013d01
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r15, r15
je 0x140013d15
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rcx - 0xc], r12d
jl 0x140013d44
mov dword [rcx - 0x10], r12d
mov rax, qword [rdi]
mov word [rax], r12w
jmp 0x140013cb4
mov ecx, 0x80070057
call fcn.1400055a0
int3