Function at 0x1400a06b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rsi, rdx
mov edi, ecx
xor r14d, r14d
mov ebx, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [0x14063fa20]
movdqu xmmword [rbp + 0x27], xmm1
mov word [rbp + 0x17], r14w
movups xmmword [rbp - 9], xmm0
movdqu xmmword [rbp + 7], xmm1
mov word [rbp - 9], r14w
mov qword [rbp + 0x7f], r14
lea rdx, [rbp + 0x17]
lea ecx, [r14 + 0xf]
call fcn.1400963b0
lea rdx, [rbp - 9]
lea ecx, [r14 + 0x10]
call fcn.1400963b0
mov eax, r14d
test edi, edi
sete al
mov ecx, 2
cmp edi, 1
cmove eax, ecx
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rsp + 0x40], r14
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400a07f2
test edi, edi
jne 0x1400a07b6
mov dword [rbp + 0x67], r14d
mov dword [rbp + 0x77], 4
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x67]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a07f2
cmp dword [rbp + 0x67], 4
jne 0x1400a07f2
lea ebx, [rdi + 1]
jmp 0x1400a07f2
cmp edi, 1
jne 0x1400a07f2
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
lea r9d, [rdi + 3]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, ebx
mov ebx, edi
test eax, eax
cmove ecx, ebx
mov ebx, ecx
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400a0802
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400a083e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a08a2
call fcn.14005fc58
movdqa xmm0, xmmword [0x14063fa20]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x1400a088c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a089c
call fcn.14005fc58
mov eax, ebx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140070b34
nop
call fcn.140070b34
nop
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, vtable.std::time_put_unsigned_short_int__class_std::ostreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov dword [rcx + 8], r8d
lea rsi, [rcx + 0x10]
mov qword [rcx], rax
and qword [rsi], 0
mov rdi, rcx
call fcn.14003eb28
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rsi, rax
je 0x1400a08ef
mov rcx, qword [rsi]
call fcn.1405eac84
mov qword [rsi], rbx
xor ebx, ebx
mov rcx, rbx
call fcn.1405eac84
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret