Function at 0x14009f980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1400ee0e8]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r13, rdx
mov dword [rsp + 0x6c], ecx
lea rdx, [0x1400db5a0]
xor r12d, r12d
lea rcx, [rsp + 0x78]
call fcn.14008f000
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, qword [rsp + 0x78]
mov ebx, eax
add rdx, 0xffffffffffffffe8
or r15, 0xffffffffffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
lea rdi, [0x1400de840]
sub ecx, 1
jg 0x14009fa26
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
cmp rcx, rdi
jne 0x14009ffba
mov rcx, qword [r8 + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x14009fa93
lea rdx, [0x1400db600]
lea rcx, [rbp - 0x80]
call fcn.14008f000
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov rdx, qword [rbp - 0x80]
test eax, eax
mov eax, r15d
sete bl
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009fa8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14009ffc4
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
je 0x14009fa9e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x40], 1
mov r8d, 0x104
mov dword [rsp + 0x68], 0x104
lea rcx, [rbp + 0x180]
call fcn.1400572a0
lea rdx, [0x1400db650]
lea rcx, [rbp - 0x78]
call fcn.14008f000
lea rcx, [rsp + 0x68]
mov r8, r13
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x40]
lea rcx, [rbp + 0x180]
mov rdx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rdx, qword [rbp - 0x78]
mov ecx, r15d
add rdx, 0xffffffffffffffe8
mov ebx, eax
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14009fb3d
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
cmp rcx, rdi
jne 0x14009ffcc
mov rcx, qword [r8 + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x3d0], rsi
mov qword [rsp + 0x3e0], r14
cmp ebx, 2
jne 0x14009fce7
xor ecx, ecx
call fcn.14005a8c0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
xor eax, eax
mov byte [rbp + 0x140], r12b
lea rcx, [rbp - 0x58]
mov qword [rbp + 0x141], rax
mov qword [rbp + 0x149], rax
mov qword [rbp + 0x151], rax
mov dword [rbp + 0x159], eax
mov word [rbp + 0x15d], ax
mov byte [rbp + 0x15f], al
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x58]
mov edi, r15d
lea rcx, [rbp - 0x30]
cmove edi, dword [rbp - 0x54]
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x58]
mov esi, r15d
lea rcx, [rbp - 8]
cmove esi, dword [rbp - 0x28]
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x58]
mov r14d, r12d
lea rcx, [rbp + 0x20]
cmove r14d, dword [rbp + 4]
call fcn.14005aff8
test eax, eax
jne 0x14009fbf2
mov ebx, dword [rbp + 0x30]
inc ebx
jmp 0x14009fbf5
mov ebx, r12d
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.14005aff8
test eax, eax
jne 0x14009fc12
mov r12d, dword [rbp + 0x5c]
add r12d, 0x76c
mov dword [rsp + 0x38], edi
lea r8, [0x1400db508]
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x140]
mov dword [rsp + 0x28], r14d
mov r9d, r12d
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x20], ebx
call fcn.14000d420
lea rdx, [0x1400db690]
mov dword [rsp + 0x40], 1
lea rcx, [rbp - 0x70]
call fcn.14008f000
lea r8, [rbp + 0x140]
mov rdx, r15
inc rdx
cmp byte [r8 + rdx], 0
jne 0x14009fc60
mov r9d, dword [rsp + 0x40]
mov r8, r13
mov dword [rsp + 0x28], edx
mov rcx, 0xffffffff80000002
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14009fcdd
mov rcx, qword [rdx]
lea r9, [0x1400de840]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r9
jne 0x14009ffd6
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x14009ff83
mov eax, 1
jmp 0x14009ff83
test ebx, ebx
jne 0x14009ff80
lea rcx, [rbp + 0x180]
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x14009fd00
cmp rax, 0xc
jb 0x14009ff80
xor eax, eax
lea rcx, [rsp + 0x44]
mov dword [rbp + 0x139], eax
mov eax, dword [rbp + 0x180]
mov dword [rbp + 0x138], eax
xor eax, eax
mov word [rsp + 0x51], ax
movzx eax, word [rbp + 0x184]
mov word [rsp + 0x50], ax
xor eax, eax
mov word [rsp + 0x4d], ax
movzx eax, word [rbp + 0x186]
mov word [rsp + 0x4c], ax
xor eax, eax
mov word [rsp + 0x49], ax
movzx eax, word [rbp + 0x188]
mov word [rsp + 0x48], ax
xor eax, eax
mov word [rsp + 0x45], ax
movzx eax, word [rbp + 0x18a]
mov word [rsp + 0x44], ax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x48]
mov r14d, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x4c]
mov esi, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x50]
mov edi, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rbp + 0x138]
mov ebx, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x68]
mov edx, eax
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8d, ebx
call fcn.14000c960
xor ecx, ecx
call fcn.14005a8c0
movsxd rcx, dword [rsp + 0x6c]
imul rdx, rcx, 0x3c
mov qword [rsp + 0x60], rax
sub rax, rdx
cmp rax, qword [rbp - 0x68]
jle 0x14009ff80
xor eax, eax
mov byte [rbp + 0x160], r12b
lea rdx, [rsp + 0x60]
mov qword [rbp + 0x161], rax
lea rcx, [rbp + 0x70]
mov qword [rbp + 0x169], rax
mov qword [rbp + 0x171], rax
mov dword [rbp + 0x179], eax
mov word [rbp + 0x17d], ax
mov byte [rbp + 0x17f], al
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x60]
mov edi, r15d
lea rcx, [rbp + 0x98]
cmove edi, dword [rbp + 0x74]
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x60]
mov esi, r15d
lea rcx, [rbp + 0xc0]
cmove esi, dword [rbp + 0xa0]
call fcn.14005aff8
test eax, eax
lea rdx, [rsp + 0x60]
mov r14d, r12d
lea rcx, [rbp + 0xe8]
cmove r14d, dword [rbp + 0xcc]
call fcn.14005aff8
test eax, eax
jne 0x14009fe93
mov ebx, dword [rbp + 0xf8]
inc ebx
jmp 0x14009fe96
mov ebx, r12d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x110]
call fcn.14005aff8
test eax, eax
jne 0x14009feb9
mov r12d, dword [rbp + 0x124]
add r12d, 0x76c
mov dword [rsp + 0x38], edi
lea r8, str._4.4d_2.2d_2.2d_2.2d_2.2d
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x160]
mov dword [rsp + 0x28], r14d
mov r9d, r12d
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x20], ebx
call fcn.14000d420
lea rdx, [0x1400db700]
mov dword [rsp + 0x40], 1
lea rcx, [rbp - 0x60]
call fcn.14008f000
lea rdx, [rbp + 0x160]
mov rcx, r15
inc rcx
cmp byte [rdx + rcx], 0
jne 0x14009ff07
mov r9d, dword [rsp + 0x40]
mov r8, r13
mov rdx, qword [rax]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14009fcdd
mov rcx, qword [rdx]
lea r9, [0x1400de840]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r9
jne 0x14009ffd6
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x14009ff83
mov eax, r12d
mov r14, qword [rsp + 0x3e0]
mov rsi, qword [rsp + 0x3d0]
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400518f0
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3a0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, r8
call rax
jmp 0x14009fa26
call r8
jmp 0x14009fa8f
mov rcx, r8
call rax
jmp 0x14009fb3d
call r8
jmp 0x14009fcdd