Function at 0x140011880
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x808]
sub rsp, 0x908
mov qword [rbp - 0x48], 0xfffffffffffffffe
movaps xmmword [rsp + 0x8f0], xmm6
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov qword [rsp + 0x40], r9
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x68], rdx
mov r15, rcx
mov qword [rbp - 0x60], rcx
mov bl, 1
mov dword [rsp + 0x34], ebx
lea rax, [rcx + 0xc10]
cmp r8, rax
sete byte [rsp + 0x30]
test rdx, rdx
je 0x140011f28
test r8, r8
je 0x140011f28
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov edx, dword [rcx + 0xbf0]
lea rcx, [rsp + 0x78]
call fcn.1400150e0
mov edx, dword [r15 + 0xbf0]
lea rcx, [rsp + 0x58]
call fcn.1400151a0
lea r12, [r15 + 0xbb0]
cmp qword [r12 + 0x40], 0
jne 0x14001194e
mov rcx, r12
call fcn.14003aaf0
mov rax, qword [r12 + 0x38]
mov rax, qword [rax]
mov qword [r12 + 0x58], rax
mov rdi, qword [rbp - 0x80]
mov r13, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
add rax, 0x20
je 0x140011e1e
xorpd xmm6, xmm6
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x40]
nop word [rax + rax]
mov ebx, dword [rax + 4]
mov dword [rsp + 0x48], ebx
movsd qword [rsp + 0x38], xmm6
test r10, r10
je 0x1400119fc
or rcx, 0xffffffffffffffff
xor eax, eax
mov edx, eax
mov r8d, eax
mov r9, qword [r10 + 0xc8]
sub r9, qword [r10 + 0xc0]
sar r9, 2
nop
cmp edx, r9d
jge 0x1400119e0
mov rax, qword [r10 + 0xc0]
cmp dword [rax + r8*4], ebx
cmove rcx, r8
inc edx
inc r8
test rcx, rcx
js 0x1400119c0
jmp 0x1400119e5
test rcx, rcx
js 0x1400119fc
mov rax, qword [r10 + 0xe0]
movsd xmm0, qword [rax + rcx*8]
movsd qword [rsp + 0x38], xmm0
jmp 0x140011a89
lea rax, [rsp + 0x38]
test rax, rax
je 0x140011d6e
mov r8d, ebx
lea rdx, str.Param_u
lea rcx, [rbp - 0x40]
call fcn.14001de80
mov dword [rsp + 0x50], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
sete cl
test ecx, ecx
jne 0x140011a89
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140011d69
lea r8, [rsp + 0x38]
mov edx, ebx
call fcn.14001ae20
xor ecx, ecx
test al, al
setne cl
test ecx, ecx
je 0x140011d69
cmp byte [rsp + 0x30], 0
je 0x140011d33
movsd qword [rsp + 0x50], xmm6
cmp dword [rbp + 0x870], 0
jne 0x140011acc
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, ebx
call qword [rax + 0x20]
test al, al
je 0x140011acc
movsd xmm0, qword [rsp + 0x50]
ucomisd xmm0, qword [rsp + 0x38]
jp 0x140011acc
je 0x140011d69
lea rax, [rsp + 0x48]
cmp rax, rdi
jae 0x140011b79
lea rax, [rsp + 0x48]
cmp r13, rax
ja 0x140011b79
lea rbx, [rsp + 0x48]
sub rbx, r13
sar rbx, 2
mov rax, qword [rbp - 0x78]
cmp rdi, rax
jne 0x140011b67
mov rcx, rdi
sub rcx, r13
sar rcx, 2
movabs rdx, 0x3ffffffffffffffe
cmp rcx, rdx
ja 0x140011de6
inc rcx
mov rdx, rax
sub rdx, r13
sar rdx, 2
cmp rcx, rdx
jbe 0x140011b67
mov r8, rdx
shr r8, 1
movabs rax, 0x3fffffffffffffff
sub rax, r8
cmp rax, rdx
jae 0x140011b4a
xor eax, eax
mov edx, eax
jmp 0x140011b4d
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.1400150e0
mov rdi, qword [rbp - 0x80]
mov r13, qword [rsp + 0x78]
test rdi, rdi
je 0x140011bf3
mov eax, dword [r13 + rbx*4]
mov dword [rdi], eax
jmp 0x140011bf3
mov rax, qword [rbp - 0x78]
cmp rdi, rax
jne 0x140011bec
mov rcx, rdi
sub rcx, r13
sar rcx, 2
movabs rdx, 0x3ffffffffffffffe
cmp rcx, rdx
ja 0x140011df3
inc rcx
mov rdx, rax
sub rdx, r13
sar rdx, 2
cmp rcx, rdx
jbe 0x140011bec
mov r8, rdx
shr r8, 1
movabs rax, 0x3fffffffffffffff
sub rax, r8
cmp rax, rdx
jae 0x140011bcf
xor eax, eax
mov edx, eax
jmp 0x140011bd2
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.1400150e0
mov rdi, qword [rbp - 0x80]
mov r13, qword [rsp + 0x78]
test rdi, rdi
je 0x140011bf3
mov dword [rdi], ebx
add rdi, 4
mov qword [rbp - 0x80], rdi
lea rax, [rsp + 0x38]
cmp rax, rsi
jae 0x140011cad
lea rax, [rsp + 0x38]
cmp r14, rax
ja 0x140011cad
lea rbx, [rsp + 0x38]
sub rbx, r14
sar rbx, 3
cmp rsi, r15
jne 0x140011c98
mov rcx, rsi
sub rcx, r14
sar rcx, 3
movabs rax, 0x1ffffffffffffffe
cmp rcx, rax
ja 0x140011e00
inc rcx
mov rdx, r15
sub rdx, r14
sar rdx, 3
cmp rcx, rdx
jbe 0x140011c98
mov r8, rdx
shr r8, 1
movabs rax, 0x1fffffffffffffff
sub rax, r8
cmp rax, rdx
jae 0x140011c75
xor eax, eax
mov edx, eax
jmp 0x140011c78
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.1400151a0
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x140011d60
mov rax, qword [r14 + rbx*8]
mov qword [rsi], rax
jmp 0x140011d60
cmp rsi, r15
jne 0x140011d22
mov rcx, rsi
sub rcx, r14
sar rcx, 3
movabs rax, 0x1ffffffffffffffe
cmp rcx, rax
ja 0x140011e0d
inc rcx
mov rdx, r15
sub rdx, r14
sar rdx, 3
cmp rcx, rdx
jbe 0x140011d22
mov r8, rdx
shr r8, 1
movabs rax, 0x1fffffffffffffff
sub rax, r8
cmp rax, rdx
jae 0x140011cff
xor eax, eax
mov edx, eax
jmp 0x140011d02
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.1400151a0
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x140011d60
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsi], xmm0
jmp 0x140011d60
movsd xmm2, qword [rsp + 0x38]
mov edx, ebx
mov rcx, qword [rbp - 0x58]
call fcn.14001fda0
mov ebx, dword [rsp + 0x34]
movzx ebx, bl
test eax, eax
mov eax, 0
cmove ebx, eax
mov dword [rsp + 0x34], ebx
mov r10, qword [rsp + 0x40]
jmp 0x140011d72
add rsi, 8
mov qword [rsp + 0x60], rsi
mov r10, qword [rsp + 0x40]
mov ebx, dword [rsp + 0x34]
mov rax, qword [r12 + 0x58]
cmp byte [rax + 0x31], 0
jne 0x140011dcf
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x31], 0
jne 0x140011d9e
mov rax, qword [rcx]
cmp byte [rax + 0x31], 0
jne 0x140011dca
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x31], 0
je 0x140011d90
jmp 0x140011dca
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x31], 0
jne 0x140011dca
nop dword [rax + rax]
mov rax, qword [rcx + 0x10]
cmp qword [r12 + 0x58], rax
jne 0x140011dca
mov qword [r12 + 0x58], rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x31], 0
je 0x140011db0
mov qword [r12 + 0x58], rcx
mov rax, qword [r12 + 0x58]
cmp rax, qword [r12 + 0x38]
je 0x140011e1a
add rax, 0x20
je 0x140011e1a
jmp 0x140011990
lea rcx, str.vector_T__too_long
call fcn.140023a8c
int3
lea rcx, str.vector_T__too_long
call fcn.140023a8c
int3
lea rcx, str.vector_T__too_long
call fcn.140023a8c
int3
lea rcx, str.vector_T__too_long
call fcn.140023a8c
int3
mov r15, qword [rbp - 0x60]
mov rax, rdi
sub rax, r13
sar rax, 2
test rax, rax
je 0x140011e44
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, r14
mov rdx, r13
mov rcx, r15
call fcn.14000ffc0
cmp r13, rdi
je 0x140011e5b
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.140023e70
mov qword [rbp - 0x80], r13
cmp r14, rsi
je 0x140011e73
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140023e70
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x4c], 0x800
lea rax, [rbp - 0x20]
test rax, rax
je 0x140011ee7
lea r9, [rsp + 0x4c]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x68]
call fcn.14001ff60
test eax, eax
je 0x140011ee7
mov ebx, dword [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.Chunk_u
lea rcx, [rbp - 0x40]
call fcn.14001de80
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140011ee3
xor bl, bl
jmp 0x140011f0d
mov ebx, dword [rsp + 0x34]
test bl, bl
je 0x140011f0d
cmp byte [rsp + 0x30], 0
je 0x140011f0d
mov rcx, qword [r15 + 0xdd0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 0xdb0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test r14, r14
je 0x140011f1b
mov rcx, r14
call fcn.140023c7c
nop
test r13, r13
je 0x140011f28
mov rcx, r13
call fcn.140023c7c
movzx eax, bl
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.140023ca0
movaps xmm6, xmmword [rsp + 0x8f0]
add rsp, 0x908
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret