Function at 0x140098090
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r8
mov r12, rdx
mov r13, rcx
lea r14, section..data
mov eax, 5
mov rcx, qword [section..data]
cmp rcx, r14
je 0x1400980f4
test byte [rcx + 0x1c], 1
je 0x1400980f4
cmp byte [rcx + 0x19], al
jb 0x1400980f4
lea edx, [rax + 0x21]
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
mov r9, r12
mov rcx, qword [rcx + 0x10]
call fcn.14009a030
xor edi, edi
and dword [rbp + 0x48], edi
lea r8, [rbp + 0x48]
mov rdx, r12
mov rcx, r13
call fcn.1400985d4
mov ebx, eax
mov r15d, dword [rbp + 0x48]
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140098149
test byte [rcx + 0x1c], 2
je 0x140098149
lea edx, [rdi + 2]
test eax, eax
lea eax, [rdi + 5]
cmove edx, eax
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jb 0x140098149
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.140099f5c
test ebx, ebx
jne 0x140098184
cmp r15d, 1
jne 0x140098184
mov dword [rsi], 2
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140098184
test byte [rcx + 0x1c], 2
je 0x140098184
cmp byte [rcx + 0x19], 4
jb 0x140098184
lea edx, [rbx + 0x28]
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
xor r14d, r14d
mov qword [rbp - 0x20], r14
and qword [rbp - 0x18], r14
and qword [rbp - 0x10], r14
mov rbx, qword [rbp - 0x28]
test r15d, r15d
jne 0x140098495
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140099628
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140098201
test byte [rcx + 0x1c], 2
je 0x140098201
cmp byte [rcx + 0x19], 4
jb 0x140098201
lea edx, [r14 + 0x29]
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rcx, qword [section..data]
mov r14, qword [rbp - 0x20]
test edi, edi
jne 0x14009849c
and dword [rsi], edi
or r15d, 0xffffffff
mov dword [rbp - 0x4c], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x48]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140098254
mov eax, dword [rbp - 0x48]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140098295
test byte [rcx + 0x1c], 2
je 0x140098295
cmp byte [rcx + 0x19], 4
jb 0x140098295
mov eax, dword [rsi]
mov edx, 0x2a
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
mov rcx, qword [section..data]
cmp edi, 2
je 0x1400982aa
test edi, edi
jne 0x14009849c
cmp dword [rsi], edi
jne 0x14009849c
test edi, edi
jne 0x1400982b1
mov r15d, dword [rsi]
mov dword [rbp - 0x44], 4
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, [0x1400bd790]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400982f6
mov eax, dword [rbp - 0x40]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009833b
test byte [rcx + 0x1c], 2
je 0x14009833b
cmp byte [rcx + 0x19], 4
jb 0x14009833b
mov edx, 0x2b
mov dword [rsp + 0x28], edi
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
lea r9, [0x1400bd790]
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
mov rcx, qword [section..data]
cmp edi, 2
jne 0x1400983bc
and dword [rsi], 0
and dword [rbp - 0x38], 0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 2]
xor r8d, r8d
lea rdx, [0x1400bd790]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400983bc
test byte [rcx + 0x1c], 2
je 0x1400983bc
cmp byte [rcx + 0x19], 4
jb 0x1400983bc
mov edx, 0x2c
mov dword [rsp + 0x28], edi
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
lea r9, [0x1400bd790]
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
mov rcx, qword [section..data]
test edi, edi
jne 0x140098437
mov eax, dword [rsi]
cmp eax, r15d
je 0x140098437
mov dword [rbp - 0x30], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 4]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140098437
test byte [rcx + 0x1c], 2
je 0x140098437
cmp byte [rcx + 0x19], 4
jb 0x140098437
mov eax, dword [rsi]
mov edx, 0x2d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14009a0e4
mov rcx, qword [section..data]
cmp dword [rsi], 0
jne 0x14009849c
and dword [rbp - 0x50], 0
lea r9, [rbp - 0x50]
lea r8, str.DefaultAuthorization
mov rdx, rbx
mov rcx, r13
call fcn.1400988ac
test eax, eax
jne 0x140098466
cmp dword [rbp - 0x50], 1
jne 0x140098466
mov dword [rsi], 1
mov rcx, qword [section..data]
cmp dword [rsi], 0
jne 0x14009849c
mov rax, qword [r13]
movabs r10, 0x9d6487c338563970
mov r8, rsi
mov rdx, r12
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x140071786.0]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400984dd
test byte [rcx + 0x1c], 1
je 0x1400984dd
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x1400984dd
mov edx, 0x2e
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
nop
test r14, r14
je 0x1400984f2
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009851d
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov eax, edi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret