Function at 0x140092710
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c73e8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdx, qword [str.NtClose]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
lea rsi, [0x1401de4b0]
mov r8, rax
test rax, rax
je 0x140092b6b
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4050], rax
test dl, dl
jne 0x140092792
test rcx, rcx
je 0x140092792
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtCreateKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092b92
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d3fd0], rax
test dl, dl
jne 0x1400927e6
test rcx, rcx
je 0x1400927e6
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtOpenKeyEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092bb9
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4020], rax
test dl, dl
jne 0x14009283a
test rcx, rcx
je 0x14009283a
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtQueryKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092be0
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4040], rax
test dl, dl
jne 0x14009288e
test rcx, rcx
je 0x14009288e
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtQueryValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092c07
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4070], rax
test dl, dl
jne 0x1400928e2
test rcx, rcx
je 0x1400928e2
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtSetValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092c2e
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d3ff0], rax
test dl, dl
jne 0x140092936
test rcx, rcx
je 0x140092936
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtDeleteValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092c55
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4000], rax
test dl, dl
jne 0x14009298a
test rcx, rcx
je 0x14009298a
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtDeleteKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092c7c
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d3fe0], rax
test dl, dl
jne 0x1400929de
test rcx, rcx
je 0x1400929de
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtEnumerateKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092ca3
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4080], rax
test dl, dl
jne 0x140092a32
test rcx, rcx
je 0x140092a32
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtEnumerateValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092cca
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4060], rax
test dl, dl
jne 0x140092a86
test rcx, rcx
je 0x140092a86
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtRenameKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140092cf1
mov rcx, qword [rbp - 0x20]
mov dl, 1
mov qword [rbp - 0x30], rax
cmp dl, 1
mov byte [rbp - 0x18], dl
mov rax, rbx
cmove rax, r8
mov qword [0x1401d4030], rax
test dl, dl
jne 0x140092ada
test rcx, rcx
je 0x140092ada
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rdx, qword [str.NtNotifyChangeMultipleKeys]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
test rax, rax
je 0x140092b48
mov rcx, qword [rbp - 0x20]
mov al, 1
mov qword [rbp - 0x30], rdx
cmp al, 1
mov byte [rbp - 0x18], al
cmove rbx, rdx
mov qword [0x1401d4010], rbx
test al, al
jne 0x140092b26
test rcx, rcx
je 0x140092b26
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14016fb70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140122510
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
xor al, al
mov qword [rbp - 0x38], rsi
xor ecx, ecx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x30]
jmp 0x140092afc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092764
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x1400927b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x14009280c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092860
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x1400928b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092908
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x14009295c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x1400929b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092a04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092a58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp - 0x38], rsi
xor dl, dl
mov dword [rbp - 0x40], eax
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
movups xmmword [rbp - 0x30], xmm0
mov r8, qword [rbp - 0x30]
jmp 0x140092aac