Function at 0x140001000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r12d, 1
mov rbx, rdx
mov esi, ecx
lea rdx, [rsp + 0x80]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x88]
call sym.parse_registry_key
test eax, eax
je 0x1400010de
cmp esi, 3
jle 0x140001388
xor r10d, r10d
mov rbp, qword [sym.imp.kernel32.dll_lstrcmpiW]
xor r13d, r13d
xor r12d, r12d
mov dword [rsp + 0x6c], 0
mov edi, 3
mov word [rsp + 0x6a], r10w
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
movsxd rax, edi
mov r14, qword [rbx + rax*8]
movzx eax, word [r14]
and eax, 0xfffffffd
cmp ax, 0x2d
jne case.0x140001286.1
lea r15, [r14 + 2]
lea rdx, section..rdata
mov rcx, r15
call rbp
test eax, eax
jne 0x1400011e8
test r12d, r12d
je 0x1400010f8
mov ecx, 0x69
mov r12d, 1
call sym.output_message
mov rcx, qword [rbx + 8]
call qword [sym.imp.ucrtbase.dll__wcsupr]
mov ecx, 0x6a
mov rdx, rax
call sym.output_message
mov eax, r12d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12d, 1
inc edi
cmp esi, edi
jg 0x140001086
cmp qword [rsp + 0x58], 0
setne al
test al, r12b
jne case.0x140001286.1
cmp r13d, 0x300
je case.0x140001286.1
lea rax, [rsp + 0x7c]
or r13d, 0x2001f
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000156e
mov r8d, dword [rsp + 0x6c]
test r8d, r8d
je 0x140001a46
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1400018bd
mov rbp, qword [sym.imp.ucrtbase.dll__wcsicmp]
lea rdi, str.REG_NONE
xor esi, esi
nop
mov rcx, qword [rdi]
mov rdx, rbx
call rbp
test eax, eax
je 0x140001478
inc esi
add rdi, 0x10
cmp esi, 9
jne 0x1400011a0
mov rcx, qword [rsp + 0x90]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x60]
mov ecx, 0xcc
call sym.output_message
jmp 0x1400010de
lea rdx, [0x140009006]
mov rcx, r15
call rbp
test eax, eax
jne 0x140001218
test r13d, 0x200
jne case.0x140001286.1
or r13d, 0x200
jmp 0x1400010fe
lea rdx, [0x140009014]
mov rcx, r15
call rbp
test eax, eax
jne 0x140001248
test r13d, 0x100
jne case.0x140001286.1
or r13d, 0x100
jmp 0x1400010fe
movzx ecx, word [r14 + 2]
test cx, cx
je case.0x140001286.1
cmp word [r14 + 4], 0
jne case.0x140001286.1
call qword [sym.imp.ucrtbase.dll_towlower]
sub eax, 0x64
cmp ax, 0x12
ja case.0x140001286.1
lea rdx, [0x140009024]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp qword [rsp + 0x60], 0
jne case.0x140001286.1
inc edi
movsxd rax, edi
mov rax, qword [rbx + rax*8]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400010fe
jmp case.0x140001286.1
inc edi
cmp word [rsp + 0x6a], 0
movsxd rax, edi
mov rdx, qword [rbx + rax*8]
jne case.0x140001286.1
test rdx, rdx
je case.0x140001286.1
movzx eax, word [rdx]
mov word [rsp + 0x6a], ax
test ax, ax
je case.0x140001286.1
mov rax, rdx
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x1400012e8
sub rax, rdx
sar rax, 1
cmp eax, 1
je 0x1400010fe
jmp case.0x140001286.1
cmp qword [rsp + 0x58], 0
jne case.0x140001286.1
inc edi
movsxd rax, edi
mov rax, qword [rbx + rax*8]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400010fe
jmp case.0x140001286.1
mov r9d, dword [rsp + 0x6c]
test r9d, r9d
jne case.0x140001286.1
mov dword [rsp + 0x6c], 1
jmp 0x1400010fe
cmp qword [rsp + 0x50], 0
jne case.0x140001286.1
inc edi
movsxd rax, edi
mov rax, qword [rbx + rax*8]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400010fe
jmp case.0x140001286.1
lea rax, [rsp + 0x7c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000156e
cmp dword [rsp + 0x7c], 2
jne 0x14000192f
mov qword [rsp + 0x60], 0
xor ecx, ecx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov word [rsp + 0x6a], cx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001181
mov rdx, qword [rsp + 0x58]
mov ecx, 0xcd
call sym.ask_confirm
mov r12d, eax
test eax, eax
jne 0x140001181
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, 0x6d
call sym.output_message
jmp 0x1400010de
movsxd rbx, eax
shl rsi, 4
lea rax, [0x140009840]
mov esi, dword [rax + rsi]
cmp esi, 0xffffffff
je 0x1400011bb
lea eax, [rsi - 4]
cmp eax, 1
ja 0x140001583
cmp qword [rsp + 0x50], 0
je 0x1400019c5
mov rdi, qword [rsp + 0x50]
movzx ecx, word [rdi + 2]
call qword [sym.imp.ucrtbase.dll_towlower]
mov r8d, 0x10
lea rdx, [rsp + 0x98]
mov rcx, rdi
cmp ax, 0x78
mov eax, 0xa
cmovne r8d, eax
call qword [sym.imp.ucrtbase.dll_wcstoul]
mov ebx, eax
mov rax, qword [rsp + 0x98]
cmp word [rax], 0
jne 0x1400019aa
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x2d
je 0x1400019aa
cmp ebx, 0xffffffff
je 0x1400019f2
mov ecx, 4
mov edi, 4
call qword [sym.imp.ucrtbase.dll_malloc]
mov dword [rax], ebx
mov r13, rax
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov r9d, esi
mov dword [rsp + 0x28], edi
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], r13
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.ucrtbase.dll_free]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test r12d, r12d
jne 0x14000156e
mov ecx, 0x6c
call sym.output_message
jmp 0x1400010de
mov ecx, 0x6b
mov r12d, 1
call sym.output_message
jmp 0x1400010de
cmp qword [rsp + 0x50], 0
jne 0x1400018a2
cmp esi, 0xb
ja case.0x1400015a4.6
lea rdx, [0x140009070]
mov eax, esi
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea rax, [0x1400090d0]
xor ebx, ebx
mov ecx, 2
mov edi, 2
mov qword [rsp + 0x50], rax
call qword [sym.imp.ucrtbase.dll_malloc]
mov rdx, qword [rsp + 0x50]
mov r13, rax
xor eax, eax
jmp 0x1400015d4
movzx ebx, word [rdx + rax]
mov word [r13 + rax], bx
add rax, 2
test bx, bx
jne 0x1400015d0
jmp 0x14000151e
lea rax, [0x1400090d0]
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x50]
mov edx, esi
mov ecx, 0xcb
xor r13d, r13d
xor edi, edi
call sym.output_message
jmp 0x14000151e
lea rax, [0x1400090d0]
mov qword [rsp + 0x50], rax
jmp case.0x1400018bb.4
lea rax, [0x1400090d0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx r12d, word [rax]
test r12w, r12w
je 0x1400019b6
add rax, 2
cmp word [rax], 0
jne 0x14000163f
sub rax, qword [rsp + 0x50]
sar rax, 1
mov rbp, rax
mov esi, eax
test eax, eax
je 0x1400019b6
mov ecx, 2
cdq
idiv ecx
lea eax, [rdx + rbp]
cdq
idiv ecx
mov ecx, eax
mov rdi, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test bpl, 1
je 0x1400016ba
lea eax, [r12 - 0x30]
cmp ax, 9
jbe 0x140001a3d
lea eax, [r12 - 0x61]
cmp ax, 5
jbe 0x140001a34
lea eax, [r12 - 0x41]
cmp ax, 5
ja 0x140001986
sub r12d, 0x37
mov byte [r13], r12b
mov ebx, 1
lea ecx, [rbx + 1]
cmp ecx, ebp
jge 0x1400019e8
mov r9, qword [rsp + 0x50]
mov r8d, 0xffffffff
jmp 0x140001749
lea edx, [rax - 0x61]
cmp dx, 5
jbe 0x14000191f
lea edx, [rax - 0x41]
sub eax, 0x37
cmp dx, 6
cmovae eax, r8d
movsxd rdx, ecx
movzx edx, word [r9 + rdx*2]
lea r10d, [rdx - 0x30]
cmp r10w, 9
jbe 0x1400018f9
lea r10d, [rdx - 0x61]
cmp r10w, 5
jbe 0x140001927
lea r10d, [rdx - 0x41]
cmp r10w, 5
ja 0x140001986
sub edx, 0x37
cmp al, 0xff
je 0x140001986
shl eax, 4
add ecx, 2
lea r10d, [rbx + 1]
or eax, edx
mov byte [r13 + rbx], al
cmp esi, ecx
jle 0x1400019e8
movsxd rbx, r10d
lea eax, [rcx - 1]
cdqe
movzx eax, word [r9 + rax*2]
lea edx, [rax - 0x30]
cmp dx, 9
ja 0x1400016d2
sub eax, 0x30
jmp 0x1400016ed
lea rax, [0x1400090d0]
mov qword [rsp + 0x50], rax
mov rsi, qword [rsp + 0x50]
movzx ecx, word [rsi + 2]
call qword [sym.imp.ucrtbase.dll_towlower]
mov r8d, 0x10
lea rdx, [rsp + 0x98]
mov rcx, rsi
cmp ax, 0x78
mov eax, 0xa
cmovne r8d, eax
call qword [sym.imp.ucrtbase.dll__wcstoui64]
mov rbx, rax
mov rax, qword [rsp + 0x98]
cmp word [rax], 0
jne 0x1400019aa
cmp rbx, 0xffffffffffffffff
je 0x14000199b
mov ecx, 8
mov esi, 0xb
mov edi, 8
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rax], rbx
mov r13, rax
jmp 0x14000151e
lea rax, [0x1400090d0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx edi, word [rax]
test di, di
je 0x140001a56
add rax, 2
cmp word [rax], 0
jne 0x140001800
mov r15, qword [rsp + 0x50]
sub rax, r15
sar rax, 1
lea ecx, [rax + 2]
mov rsi, rax
mov ebp, eax
movsxd rcx, ecx
add rcx, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test esi, esi
jle 0x140001a64
movzx r8d, word [rsp + 0x6a]
xor eax, eax
mov r9, r15
jmp 0x140001881
mov word [rcx], di
test eax, eax
je 0x14000186a
lea edx, [rax - 1]
movsxd rdx, edx
cmp word [r13 + rdx*2], 0
jne 0x14000186a
cmp word [rcx], 0
je 0x14000195a
cmp eax, 1
je 0x14000195a
inc ebx
lea edx, [rax + 1]
cmp ebp, ebx
jle 0x140001a03
movsxd rax, ebx
movzx edi, word [r9 + rax*2]
mov eax, edx
movsxd rdx, eax
lea rcx, [r13 + rdx*2]
test r8w, r8w
jne 0x140001895
cmp di, 0x5c
je 0x140001901
cmp di, r8w
jne 0x140001841
xor edx, edx
mov word [rcx], dx
jmp 0x140001844
cmp esi, 0xb
ja case.0x1400018bb.6
lea rdx, [0x1400090a0]
mov eax, esi
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp qword [rsp + 0x50], 0
mov esi, 1
je 0x140001938
mov rax, qword [rsp + 0x50]
movzx ebx, word [rax]
test bx, bx
je 0x140001a6f
add rax, 2
cmp word [rax], 0
jne 0x1400018db
sub rax, qword [rsp + 0x50]
sar rax, 1
lea ecx, [rax + rax + 2]
mov rdi, rcx
jmp 0x1400015be
sub edx, 0x30
jmp 0x140001725
lea edx, [rbx + 1]
movsxd r10, edx
cmp word [r9 + r10*2], 0x30
jne 0x140001841
mov word [rcx], 0
mov ebx, edx
jmp 0x140001844
sub eax, 0x57
jmp 0x1400016ed
sub edx, 0x57
jmp 0x140001725
mov qword [rsp + 0x58], 0
lea rax, [0x1400090d0]
xor ebx, ebx
mov ecx, 2
mov edi, 2
mov qword [rsp + 0x50], rax
mov esi, 1
jmp 0x1400015be
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
mov ecx, 0xca
call sym.output_message
mov rcx, qword [rsp + 0x90]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x1400010de
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
mov ecx, 0xc9
call sym.output_message
jmp 0x14000196d
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 0x22
jne 0x1400017c3
mov ecx, 0xc8
call sym.output_message
jmp 0x14000196d
mov esi, 3
xor r13d, r13d
xor edi, edi
jmp 0x14000151e
mov rcx, qword [rsp + 0x90]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, 0xce
call sym.output_message
jmp 0x1400010de
mov esi, 3
jmp 0x14000151e
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 0x22
jne 0x140001509
jmp 0x1400019aa
movsxd r8, edx
mov word [r13 + r8*2], 0
test edx, edx
je 0x140001a26
cmp word [rcx], 0
je 0x140001a26
lea edx, [rax + 2]
movsxd rax, edx
mov word [r13 + rax*2], 0
lea edi, [rdx + rdx + 2]
mov esi, 7
jmp 0x14000151e
sub r12d, 0x57
jmp 0x1400016b1
sub r12d, 0x30
jmp 0x1400016b1
cmp dword [rsp + 0x7c], 2
jne 0x140001181
jmp 0x140001409
mov ecx, 4
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
mov word [r13], 0
xor edx, edx
jmp 0x140001a26
mov ecx, 2
mov edi, 2
jmp 0x1400015be