Function at 0x140015800
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x140053100]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov qword [rbp - 0x50], rdx
mov rdi, rcx
mov r14b, 1
lea rcx, [rsp + 0x40]
call fcn.140013060
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.http:__client.web.aol.com_toolbarfiles_Prod_Configs_
lea rdx, str._s__s__s_s
lea rcx, [rbp - 0x68]
call fcn.14000b330
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
je 0x1400158d6
mov rcx, r15
call qword [0x140040438]
test eax, eax
jne 0x1400158dd
lea r15, str.ietbres.zip
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx - 0x10]
or r12, 0xffffffffffffffff
test eax, eax
je 0x1400160ca
js 0x1400160ca
lea rdx, [0x1400451c8]
call fcn.1400267a8
mov rsi, rax
test rax, rax
je 0x1400160ca
sub rsi, qword [rsp + 0x40]
sar rsi, 1
cmp esi, r12d
je 0x1400160ca
mov r8d, esi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.14000ed10
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000aac0
lea rbx, [rax + 0x18]
mov qword [rbp - 0x20], rbx
xor r13d, r13d
test rbx, rbx
jne 0x140015953
mov ecx, r13d
jmp 0x140015964
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14000a480
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140015991
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400159b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000ece0
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000aac0
lea rbx, [rax + 0x18]
mov qword [rbp - 0x18], rbx
test rbx, rbx
jne 0x1400159e1
mov ecx, r13d
jmp 0x1400159f2
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000a480
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140015a1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140015a3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x48]
movsxd rbx, dword [rdi - 0x10]
test ebx, ebx
jns 0x140015a56
mov ecx, 0x80070057
call fcn.1400030f0
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140015a78
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.14000aa60
mov rdi, qword [rsp + 0x48]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140026f04
cmp ebx, dword [rdi - 0xc]
jg 0x1400160bf
mov dword [rdi - 0x10], ebx
mov word [rdi + rbx*2], r13w
lea r8, str..attempts
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.140019ca0
nop
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000aac0
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140015ae1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r8d, r8d
lea rdx, str.config
lea rcx, [0x1400599f0]
call fcn.14000cff0
mov rsi, rax
mov rdi, qword [rsp + 0x78]
test rax, rax
je 0x140015b5d
mov dword [rbp - 0x60], 4
mov dword [rbp - 0x80], 4
mov dword [rsp + 0x58], r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140015b5d
mov esi, dword [rsp + 0x58]
cmp esi, 0xa
jl 0x140015b60
xor r14b, r14b
jmp 0x1400160a2
mov esi, r13d
mov r8, qword [rsp + 0x40]
lea rdx, str.config
lea rcx, [0x1400599f0]
call fcn.14000cce0
movsxd rcx, eax
mov qword [rsp + 0x60], rcx
xor ecx, ecx
call fcn.140026b10
mov qword [rsp + 0x68], rax
mov rcx, qword [0x140059908]
cmp qword [rsp + 0x60], rcx
jl 0x140015c6c
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.1400272c0
mov ebx, r13d
test eax, eax
cmove ebx, dword [rbp - 4]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.1400272c0
mov ecx, r13d
test eax, eax
cmove ecx, dword [rbp + 0x4c]
cmp ebx, ecx
jne 0x140015c67
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x90]
call fcn.1400272c0
test eax, eax
jne 0x140015bf3
mov ebx, dword [rbp + 0xa0]
inc ebx
jmp 0x140015bf6
mov ebx, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x18]
call fcn.1400272c0
test eax, eax
jne 0x140015c0f
mov eax, dword [rbp + 0x28]
inc eax
jmp 0x140015c12
mov eax, r13d
cmp ebx, eax
jne 0x140015c67
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.1400272c0
test eax, eax
jne 0x140015c33
mov ebx, dword [rbp + 0x7c]
add ebx, 0x76c
jmp 0x140015c36
mov ebx, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xb8]
call fcn.1400272c0
test eax, eax
jne 0x140015c58
mov eax, dword [rbp + 0xcc]
add eax, 0x76c
jmp 0x140015c5b
mov eax, r13d
cmp ebx, eax
jne 0x140015c67
xor r14b, r14b
jmp 0x1400160a2
mov rax, qword [rsp + 0x68]
mov dword [rbp - 0x70], eax
mov r13, qword [rsp + 0x40]
mov r8b, 1
lea rdx, str.config
lea rcx, [0x1400599f0]
call fcn.14000cff0
mov rbx, rax
test rax, rax
je 0x140015cc1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rsi + 1]
mov dword [rbp - 0x78], eax
mov r8b, 1
lea rdx, str.config
lea rcx, [0x1400599f0]
call fcn.14000cff0
mov rbx, rax
test rax, rax
je 0x140015d14
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
mov rbx, qword [rsp + 0x70]
mov r9, rbx
mov r13, qword [rbp - 0x50]
mov r8, r13
lea rdx, [0x1400451f8]
lea rcx, [rsp + 0x30]
call fcn.14000b330
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov rsi, qword [rbp - 0x68]
mov r8, rsi
lea rdx, str._s__s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000b330
lea rcx, [rsp + 0x50]
call fcn.140013600
nop
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400157a0
test eax, eax
jne 0x14001603b
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8, r13
lea rdx, [0x140045228]
lea rcx, [rsp + 0x30]
call fcn.14000b330
lea rcx, [rsp + 0x30]
call fcn.140019ac0
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000b330
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400157a0
test eax, eax
jne 0x14001603b
lea rcx, [rbp - 0x58]
call fcn.140012e20
nop
xor r8d, r8d
mov r13d, r8d
test rbx, rbx
setne r13b
test r13d, r13d
jne 0x140015e4e
mov ecx, 0x80004005
call fcn.1400030f0
int3
mov r9, qword [rbp - 0x58]
mov rax, r9
mov rdx, rbx
sub rdx, r9
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140015e77
add rax, 2
test cx, cx
jne 0x140015e60
mov eax, r8d
jmp 0x140015e7c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140015ec7
mov qword [rsp + 0x20], rdi
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000b330
lea rcx, [rsp + 0x30]
call fcn.140019ac0
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400157a0
test eax, eax
jg 0x14001601b
mov rdi, qword [rsp + 0x30]
lea rcx, [rbp - 0x48]
call fcn.140012e20
nop
xor r8d, r8d
mov ecx, r8d
mov rax, qword [rbp - 0x58]
test rax, rax
setne cl
test ecx, ecx
jne 0x140015ef0
mov ecx, 0x80004005
call fcn.1400030f0
int3
mov r9, qword [rbp - 0x48]
mov rcx, r9
sub rax, r9
nop word [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140015f17
add rcx, 2
test dx, dx
jne 0x140015f00
mov eax, r8d
jmp 0x140015f1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140015f9e
test r13d, r13d
jne 0x140015f35
mov ecx, 0x80004005
call fcn.1400030f0
int3
mov rax, r9
sub rbx, r9
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rbx]
jne 0x140015f57
add rax, 2
test cx, cx
jne 0x140015f40
mov eax, r8d
jmp 0x140015f5c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140015f9e
mov qword [rsp + 0x20], rdi
mov r8, rsi
lea rdx, str._s__s__s
lea rcx, [rsp + 0x38]
call fcn.14000b330
lea rcx, [rsp + 0x30]
call fcn.140019ac0
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400157a0
test eax, eax
jg 0x140015ffb
mov r9, r15
mov r8, qword [rbp - 0x50]
lea rdx, [0x140045258]
lea rcx, [rsp + 0x30]
call fcn.14000b330
lea rcx, [rsp + 0x30]
call fcn.140019ac0
mov r9, qword [rsp + 0x30]
mov r8, rsi
lea rdx, str._s__s
lea rcx, [rsp + 0x38]
call fcn.14000b330
mov r8b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1400157a0
movzx r14d, r14b
test eax, eax
mov r8d, 0
cmove r14d, r8d
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001601b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001603b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001605c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001607d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001609d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x78]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400160cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400160cd
mov ecx, 0x80070057
call fcn.1400030f0
int3
xor r14b, r14b
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400160ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001610f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001612f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14001614f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, r14b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140025aa0
add rsp, 0x1f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret