Function at 0x140097e50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r8
mov r12, rdx
mov r13, rcx
lea r14, section..data
mov eax, 5
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140097eb4
test byte [rcx + 0x1c], 1
je 0x140097eb4
cmp byte [rcx + 0x19], al
jb 0x140097eb4
lea edx, [rax + 0x21]
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
mov r9, r12
mov rcx, qword [rcx + 0x10]
call fcn.140099df0
xor edi, edi
and dword [rbp + 0x48], edi
lea r8, [rbp + 0x48]
mov rdx, r12
mov rcx, r13
call fcn.140098394
mov ebx, eax
mov r15d, dword [rbp + 0x48]
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140097f09
test byte [rcx + 0x1c], 2
je 0x140097f09
lea edx, [rdi + 2]
test eax, eax
lea eax, [rdi + 5]
cmove edx, eax
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jb 0x140097f09
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.140099d1c
test ebx, ebx
jne 0x140097f44
cmp r15d, 1
jne 0x140097f44
mov dword [rsi], 2
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140097f44
test byte [rcx + 0x1c], 2
je 0x140097f44
cmp byte [rcx + 0x19], 4
jb 0x140097f44
lea edx, [rbx + 0x28]
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
xor r14d, r14d
mov qword [rbp - 0x20], r14
and qword [rbp - 0x18], r14
and qword [rbp - 0x10], r14
mov rbx, qword [rbp - 0x28]
test r15d, r15d
jne 0x140098255
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.1400993e8
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140097fc1
test byte [rcx + 0x1c], 2
je 0x140097fc1
cmp byte [rcx + 0x19], 4
jb 0x140097fc1
lea edx, [r14 + 0x29]
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rcx, qword [section..data]
mov r14, qword [rbp - 0x20]
test edi, edi
jne 0x14009825c
and dword [rsi], edi
or r15d, 0xffffffff
mov dword [rbp - 0x4c], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x48]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140098014
mov eax, dword [rbp - 0x48]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140098055
test byte [rcx + 0x1c], 2
je 0x140098055
cmp byte [rcx + 0x19], 4
jb 0x140098055
mov eax, dword [rsi]
mov edx, 0x2a
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140099ea4
mov rcx, qword [section..data]
cmp edi, 2
je 0x14009806a
test edi, edi
jne 0x14009825c
cmp dword [rsi], edi
jne 0x14009825c
test edi, edi
jne 0x140098071
mov r15d, dword [rsi]
mov dword [rbp - 0x44], 4
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, [0x1400bd810]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400980b6
mov eax, dword [rbp - 0x40]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400980fb
test byte [rcx + 0x1c], 2
je 0x1400980fb
cmp byte [rcx + 0x19], 4
jb 0x1400980fb
mov edx, 0x2b
mov dword [rsp + 0x28], edi
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
lea r9, [0x1400bd810]
mov rcx, qword [rcx + 0x10]
call fcn.140099ea4
mov rcx, qword [section..data]
cmp edi, 2
jne 0x14009817c
and dword [rsi], 0
and dword [rbp - 0x38], 0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 2]
xor r8d, r8d
lea rdx, [0x1400bd810]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009817c
test byte [rcx + 0x1c], 2
je 0x14009817c
cmp byte [rcx + 0x19], 4
jb 0x14009817c
mov edx, 0x2c
mov dword [rsp + 0x28], edi
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
lea r9, [0x1400bd810]
mov rcx, qword [rcx + 0x10]
call fcn.140099ea4
mov rcx, qword [section..data]
test edi, edi
jne 0x1400981f7
mov eax, dword [rsi]
cmp eax, r15d
je 0x1400981f7
mov dword [rbp - 0x30], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 4]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400981f7
test byte [rcx + 0x1c], 2
je 0x1400981f7
cmp byte [rcx + 0x19], 4
jb 0x1400981f7
mov eax, dword [rsi]
mov edx, 0x2d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140099ea4
mov rcx, qword [section..data]
cmp dword [rsi], 0
jne 0x14009825c
and dword [rbp - 0x50], 0
lea r9, [rbp - 0x50]
lea r8, str.DefaultAuthorization
mov rdx, rbx
mov rcx, r13
call fcn.14009866c
test eax, eax
jne 0x140098226
cmp dword [rbp - 0x50], 1
jne 0x140098226
mov dword [rsi], 1
mov rcx, qword [section..data]
cmp dword [rsi], 0
jne 0x14009825c
mov rax, qword [r13]
movabs r10, 0x9d6487c338563970
mov r8, rsi
mov rdx, r12
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x140071786.0]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009829d
test byte [rcx + 0x1c], 1
je 0x14009829d
movzx r9d, byte [rcx + 0x19]
mov eax, edi
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x14009829d
mov edx, 0x2e
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
nop
test r14, r14
je 0x1400982b2
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400982dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov eax, edi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret