Function at 0x1400a03c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x14c8
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x14b0], rax
mov r12, rcx
mov qword [rsp + 0xe0], rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x372]
mov r8d, 0xfe
xor edx, edx
mov word [rsp + 0x370], 0
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0xf2]
lea r8d, [rdx + 0x7e]
mov word [rsp + 0xf0], 0
call sub.ntdll.dll_memset
xor ebp, ebp
lea rcx, [rsp + 0xc92]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x78], rbp
mov word [rsp + Ordinal_3223], bp
call sub.ntdll.dll_memset
test rbx, rbx
mov r14d, ebp
setne r14b
mov dword [rsp + 0x84], Ordinal_265
test r14d, r14d
mov dword [rsp + 0x68], ebp
jne 0x1400a056c
lea rbx, [0x140434220]
xor edx, edx
mov r8d, 0x80
mov rcx, rbx
call sub.ntdll.dll_memset
lea edx, [rbp + 0x5c]
lea rcx, str..._bcd.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400a0543
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xe0]
mov r8d, reloc.MFC80U.DLL_Ordinal_1369
mov byte [rsp + 0xe0], bpl
mov qword [rsp + 0xe1], rax
mov word [rsp + 0xe9], ax
mov byte [rsp + 0xeb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400a0500
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400a0530
mov rbp, rbx
call fcn.140049470
lea r8, str.pcsDesDevSymName_NULL
lea rdx, str._s_return_code:_0x_08X___s.
mov rdi, qword [rax]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [rdi + 0x10]
jmp 0x1400a0f87
test rsi, rsi
mov r14d, ebp
setne r14b
test r14d, r14d
jne 0x1400a05b9
lea rcx, str..._bcd.cpp
mov edx, reloc.MFC80U.DLL_Ordinal_1370
call fcn.14009bd30
mov rdi, rax
call fcn.140049470
lea r8, str.pBootInfo_NULL
mov r10, qword [rax]
lea rdx, str._s_return_code:_0x_08X___s.
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x10]
jmp 0x1400a0f87
mov edi, ebp
nop
nop
lea rdx, str.AOMEIHive0_d
lea rcx, [rsp + 0xf0]
mov r8d, edi
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rdx, [rsp + 0xf0]
mov r8, rbx
mov rcx, r12
call fcn.14009e2c0
test eax, eax
jne 0x1400a05f7
add edi, 1
cmp edi, 0xa
jl 0x1400a05c0
cmp edi, 0xa
mov r14d, ebp
setl r14b
test r14d, r14d
jne 0x1400a06fc
lea rbx, [0x140434220]
xor edx, edx
mov r8d, 0x80
mov rcx, rbx
call sub.ntdll.dll_memset
lea edx, [r14 + 0x5c]
lea rcx, str..._bcd.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400a06d3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xe0]
mov r8d, 0x563
mov byte [rsp + 0xe0], bpl
mov qword [rsp + 0xe1], rax
mov word [rsp + 0xe9], ax
mov byte [rsp + 0xeb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400a0690
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400a06c0
mov rbp, rbx
call fcn.140049470
lea r8, str.i_10
lea rdx, str._s_return_code:_0x_08X___s.
mov rdi, qword [rax]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [rdi + 0x10]
jmp 0x1400a0f87
lea r8, [rsp + 0xf0]
lea rdx, str._sObjects
lea rcx, [rsp + 0x370]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rdx, [rsp + 0x78]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x370]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a083d
call fcn.140049470
lea rbx, [0x140434220]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str..._bcd.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400a0813
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xe0]
mov r8d, Ordinal_1388
mov byte [rsp + 0xe0], bpl
mov qword [rsp + 0xe1], rax
mov word [rsp + 0xe9], ax
mov byte [rsp + 0xeb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400a07d0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400a0800
mov rbp, rbx
mov rax, qword [rsi]
lea rdx, str._s:_Failed_to_RegOpenKeyEx_in_UpdateDosDevices.
mov r8, rbp
mov rcx, rsi
call qword [rax + 0x10]
lea rdx, [rsp + 0xf0]
mov rcx, r12
call fcn.14009e4c0
xor eax, eax
jmp 0x1400a0f9a
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0xa0]
lea r8, [rsp + 0x84]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xcc]
lea rdx, [rsp + 0xc90]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x68]
test eax, eax
mov r14d, ebp
setne r14b
test r14d, r14d
jne 0x1400a0910
lea rcx, str..._bcd.cpp
mov edx, Ordinal_1411
call fcn.14009bd30
mov rdi, rax
call fcn.140049470
lea r8, str.cSubKeys_0
mov r10, qword [rax]
lea rdx, str._s_return_code:_0x_08X___s.
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x10]
jmp 0x1400a0f87
test eax, eax
mov qword [rsp + 0x14c0], r15
mov r15d, ebp
je 0x1400a0f74
mov qword [rsp + 0x1500], r13
lea rdi, [0x1403b66f8]
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4272]
mov edx, r15d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x80], Ordinal_265
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400a0f55
lea rcx, [rsp + 0x872]
xor edx, edx
mov r8d, 0x206
mov word [rsp + Ordinal_2164], bp
call sub.ntdll.dll_memset
lea r9, [rsp + reloc.MFC80U.DLL_Ordinal_4272]
lea r8, [rsp + 0x370]
lea rdx, [0x1402e2530]
lea rcx, [rsp + 0x870]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x870]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a0f55
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_3746]
xor edx, edx
mov r8d, 0x206
mov word [rsp + Ordinal_3746], bp
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0xa8]
lea r8, [rsp + 0x94]
lea rdx, [rsp + 0xea0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xd8]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd4]
mov dword [rsp + 0x94], Ordinal_265
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xbc]
mov dword [rsp + 0x6c], ebp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edx, dword [rsp + 0x6c]
test edx, edx
je 0x1400a0f47
test edx, edx
mov r13d, ebp
je 0x1400a0f47
nop
nop
nop
nop
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x12b0]
mov edx, r13d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x90], Ordinal_265
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400a0f31
lea rcx, [rsp + 0xa82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + Ordinal_2692], bp
call sub.ntdll.dll_memset
lea r9, [rsp + 0x12b0]
lea r8, [rsp + 0x870]
lea rdx, [0x1402e0040]
lea rcx, [rsp + 0xa80]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rdx, [rsp + 0x60]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0xa80]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a0f31
lea rcx, [rsp + 0x172]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0x170], bp
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x170]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x70], reloc.MFC80U.DLL_Ordinal_512
mov r12d, ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400a0f26
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_1137]
xor edx, edx
mov r8d, 0x3ff
add r12d, 1
mov byte [rsp + Ordinal_1137], bpl
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x74]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x74], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a0ed2
mov ecx, dword [rsp + 0x74]
cmp ecx, 0x58
jne 0x1400a0e2e
mov ecx, dword [rsi]
mov edx, dword [rsp + 0x4a8]
mov rax, qword [rsp + 0x490]
cmp edx, ecx
jne 0x1400a0d01
cmp rax, qword [rsi + 8]
jne 0x1400a0d01
mov eax, dword [rsi + 4]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x170]
mov dword [rsp + Ordinal_1193], eax
mov rax, qword [rsi + 0x10]
mov r9d, 3
mov qword [rsp + Ordinal_1173], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov dword [rsp + 0x28], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a0ed2
call fcn.140049470
lea rcx, str..._bcd.cpp
mov edx, 0x5e2
mov rbx, qword [rax]
mov rdi, rax
call fcn.14009bd30
lea rdx, str._s:_Update_boot_information_failed.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
jmp 0x1400a0ed2
cmp edx, ecx
jne 0x1400a0d93
cmp rax, qword [rsi + 0x18]
jne 0x1400a0d93
mov eax, dword [rsi + 4]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x170]
mov dword [rsp + Ordinal_1193], eax
mov rax, qword [rsi + 0x20]
mov r9d, 3
mov qword [rsp + Ordinal_1173], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov dword [rsp + 0x28], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a0ed2
call fcn.140049470
lea rcx, str..._bcd.cpp
mov edx, 0x5ec
mov rbx, qword [rax]
mov rdi, rax
call fcn.14009bd30
lea rdx, str._s:_Update_boot_information_failed.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
jmp 0x1400a0ed2
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jle 0x1400a0ed2
cmp edx, ecx
jne 0x1400a0ed2
cmp rax, qword [rsi + 0x28]
jne 0x1400a0ed2
mov eax, dword [rsi + 4]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x170]
mov dword [rsp + Ordinal_1193], eax
lea rax, [rsp + 0x470]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x58
mov qword [rsp + Ordinal_1173], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a0ed2
call fcn.140049470
lea rcx, str..._bcd.cpp
mov edx, Ordinal_1532
mov rbx, qword [rax]
mov rdi, rax
call fcn.14009bd30
lea rdx, str._s:_Update_boot_information_failed.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
jmp 0x1400a0ed2
cmp ecx, 0xae
je 0x1400a0e42
cmp ecx, 0xf0
jbe 0x1400a0ed2
mov eax, dword [rsi]
cmp dword [rsp + 0x4dc], eax
jne 0x1400a0ed2
mov rax, qword [rsi + 0x18]
cmp qword [rsp + 0x4c4], rax
jne 0x1400a0ed2
mov eax, dword [rsi + 4]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x4dc], eax
mov rax, qword [rsi + 0x20]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x4c4], rax
lea rax, [rsp + 0x470]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a0ed2
call fcn.140049470
lea rcx, str..._bcd.cpp
mov edx, 0x607
mov rbx, qword [rax]
mov rdi, rax
call fcn.14009bd30
lea rdx, str._s:_Update_boot_information_failed.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x100
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x170]
mov edx, r12d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x70], reloc.MFC80U.DLL_Ordinal_512
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400a0bf0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r13d, 1
cmp r13d, dword [rsp + 0x6c]
jb 0x1400a0ad0
lea rdi, [0x1403b66f8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r15d, 1
cmp r15d, dword [rsp + 0x68]
jb 0x1400a0932
mov r12, qword [rsp + 0xe0]
mov r13, qword [rsp + 0x1500]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x14c0]
lea rdx, [rsp + 0xf0]
mov rcx, r12
call fcn.14009e4c0
mov eax, r14d
mov rcx, qword [rsp + 0x14b0]
xor rcx, rsp
call fcn.140161080
add rsp, 0x14c8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret