Function at 0x14000f184
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov rax, qword [0x1400cd220]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rcx, qword [section..data]
lea rsi, section..data
cmp rcx, rsi
je 0x14000f1e9
test byte [rcx + 0x1c], 1
je 0x14000f1e9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x114
call fcn.1400062b0
xor r12d, r12d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r12d
lea r8, str.ComputerDisabledSharing
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r12d
call fcn.14000d490
test eax, eax
js 0x14000f5ec
cmp dword [rsp + 0x40], r12d
je 0x14000f5ec
mov r14d, r12d
lea r13d, [r12 + 2]
lea r15d, [r12 + 5]
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f25f
test byte [rcx + 0x1c], r13b
je 0x14000f25f
cmp byte [rcx + 0x19], r15b
jb 0x14000f25f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x115
mov r9d, r14d
call fcn.14000637c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov r9d, 0x20219
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400b4330]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000f4df
mov rdi, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov rcx, rdi
mov qword [rsp + 0x28], r12
mov edx, r14d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
cmp eax, 0x103
je 0x14000f4c9
test eax, eax
jne 0x14000f499
lea rdx, [0x1400b4330]
lea rcx, [rsp + 0x58]
call fcn.140005058
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000f303
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000543c
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x20206
mov qword [rsp + 0x60], r12
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000f428
mov rsi, qword [rsp + 0x60]
lea rax, [0x1400b2338]
mov rcx, rsi
mov dword [rsp + 0x28], r13d
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400b4308]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x14000f3c6
test byte [rcx + 0x1c], r13b
je 0x14000f3c6
cmp byte [rcx + 0x19], r15b
jb 0x14000f3c6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x119
mov r9d, eax
call fcn.14000ad20
test rsi, rsi
je 0x14000f3da
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000f405
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
test rdi, rdi
je 0x14000f419
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rsi, section..data
inc r14d
jmp 0x14000f22f
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f458
test byte [rcx + 0x1c], r13b
je 0x14000f458
cmp byte [rcx + 0x19], r13b
jb 0x14000f458
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x118
mov r9, rbx
call fcn.1400062dc
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000f483
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
test rdi, rdi
je 0x14000f420
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000f420
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f4c9
test byte [rcx + 0x1c], r13b
je 0x14000f4c9
cmp byte [rcx + 0x19], r13b
jb 0x14000f4c9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x117
mov r9d, eax
call fcn.14000ad20
test rdi, rdi
je 0x14000f519
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000f519
jle 0x14000f4e9
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f519
test byte [rcx + 0x1c], r13b
je 0x14000f519
cmp byte [rcx + 0x19], r13b
jb 0x14000f519
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x116
mov r9d, eax
call fcn.14000637c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
mov rcx, 0xffffffff80000002
mov rdi, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000f55c
mov rdi, qword [rsp + 0x68]
mov ebx, r12d
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f59c
test byte [rcx + 0x1c], r13b
je 0x14000f59c
movzx eax, byte [rcx + 0x19]
test ebx, ebx
cmovne r15d, r13d
cmp eax, r15d
jb 0x14000f59c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x11a
mov r9d, ebx
call fcn.14000ad20
mov rcx, qword [section..data]
test ebx, ebx
jne 0x14000f5d8
lea r9d, [rbx + 4]
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ComputerDisabledSharing
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [section..data]
test rdi, rdi
je 0x14000f5f3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14000f613
test byte [rcx + 0x1c], 1
je 0x14000f613
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b4390]
mov edx, 0x11b
call fcn.1400062b0
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140003680
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret