Function at 0x1400037d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
lea rbp, [r11 - 0xbc8]
sub rsp, 0xcb0
mov rax, qword [0x1402f8c60]
xor rax, rsp
mov qword [rbp + 0xb90], rax
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x140003a64
test rdx, rdx
je 0x140003a64
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r15
xor r15d, r15d
mov dword [rsp + 0x54], r15d
mov ebx, r15d
nop word [rax + rax]
xor edx, edx
mov dword [rsp + 0x50], 0x208
mov r8d, 0x208
lea rcx, [rbp + 0x770]
call fcn.1401f5d40
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x770]
mov edx, ebx
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
test eax, eax
jne 0x140003949
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x140003830
cmp eax, 2
jbe 0x1400038d0
cmp eax, 3
je 0x1400038c0
cmp eax, 4
je 0x1400038b0
cmp eax, 0xb
jne 0x140003830
mov dword [rsp + 0x50], 8
lea r8d, [rax - 3]
jmp 0x1400038de
mov dword [rsp + 0x50], 4
mov r8d, 4
jmp 0x1400038de
mov dword [rsp + 0x50], 0x400
mov r8d, 0x400
jmp 0x1400038de
mov dword [rsp + 0x50], 0x800
mov r8d, 0x800
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1401f5d40
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x70]
mov rcx, rsi
lea rdx, [rbp + 0x770]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003949
mov eax, dword [rsp + 0x50]
lea rdx, [rbp + 0x770]
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rcx, r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140003830
mov edi, r15d
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x980]
mov r8d, 0x208
call fcn.1401f5d40
mov qword [rsp + 0x38], r15
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x980]
mov qword [rsp + 0x28], r15
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc edi
mov ebx, eax
test eax, eax
jne 0x140003a48
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r15
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x980]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003a30
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x980]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140003a20
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400037d0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003a30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003a40
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140003950
mov r15, qword [rsp + 0xca0]
mov eax, ebx
mov rbx, qword [rsp + 0xce0]
mov rdi, qword [rsp + 0xca8]
jmp 0x140003a66
xor eax, eax
mov rcx, qword [rbp + 0xb90]
xor rcx, rsp
call fcn.140072680
add rsp, 0xcb0
pop r14
pop rsi
pop rbp
ret