Function at 0x140010a20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x140056010]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r15d, r15d
mov dword [rsp + 0x68], r8d
mov r13, rdx
mov qword [rsp + 0x78], r15
mov rdi, rcx
mov qword [rsp + 0x50], r15
lea r8, str.RegModify_1_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
mov rbx, 0xffffffffffffffff
mov rcx, rbx
cmp word [rdi + rcx*2 + 2], r15w
lea rcx, [rcx + 1]
jne 0x140010a83
mov qword [rsp + 0x2e8], r12
lea rcx, [rcx*2 + 4]
mov qword [rsp + 0x290], r14
call fcn.14001bda4
mov qword [rsp + 0x58], rax
mov rsi, rax
test rax, rax
jne 0x140010aeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x140051380]
lea rdx, [0x140090f60]
test rdi, rdi
je 0x140010ad7
mov r9, rdi
jmp 0x140010b4a
mov r9d, eax
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
jmp 0x14001109c
mov rdx, rbx
nop
inc rdx
cmp word [rdi + rdx*2], r15w
jne 0x140010af0
inc rdx
mov r8, rdi
mov rcx, rsi
call fcn.14001b57c
mov r12d, eax
test eax, eax
je 0x140010b1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x140051390]
jmp 0x140010ac6
mov edx, 0x5c
mov rcx, rsi
call fcn.14001353c
mov r14, rax
test rax, rax
jne 0x140010b5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1400513a0]
mov r9, rsi
lea rdx, [0x140090f60]
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
mov dword [rsp + 0x20], eax
call fcn.140001030
jmp 0x14001109c
add r14, 2
mov edx, 0x5c
mov rcx, r14
call fcn.140013488
mov rdi, rax
test rax, rax
jne 0x140010b9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1400513b0]
lea rdx, [0x140090f60]
test r14, r14
je 0x140010ad7
mov r9, r14
jmp 0x140010b4a
lea r8, [rsp + 0x78]
mov word [rax], r15w
lea rdx, [0x14003a3c4]
mov rcx, rsi
add rdi, 2
call fcn.14001b968
mov rsi, rax
test rax, rax
jne 0x140010bd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x58]
lea r8, [0x1400513c0]
jmp 0x140010b40
lea r8, [0x1400513d0]
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
mov r9, rbx
inc r9
cmp word [rsi + r9*2], r15w
jne 0x140010bf0
lea rax, [0x1400513f0]
mov dword [rsp + 0x28], 4
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140010c2b
mov esi, r15d
jmp 0x140010cac
mov r9, rbx
nop
inc r9
cmp word [rsi + r9*2], r15w
jne 0x140010c30
lea rax, [0x140051400]
mov dword [rsp + 0x28], 4
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140010c68
lea esi, [rax - 1]
jmp 0x140010cac
mov r9, rbx
nop dword [rax + rax]
inc r9
cmp word [rsi + r9*2], r15w
jne 0x140010c70
lea rax, [0x140051410]
mov dword [rsp + 0x28], 4
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov esi, dword [rsp + 0x6c]
mov ecx, 2
cmp eax, ecx
cmove esi, ecx
mov ecx, esi
test esi, esi
je 0x140010cd2
sub ecx, 1
je 0x140010cc9
cmp ecx, 1
jne 0x140010d55
mov rcx, 0xffffffff80000000
jmp 0x140010cd9
mov rcx, 0xffffffff80000001
jmp 0x140010cd9
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, eax
test eax, eax
je 0x140010d55
cmp eax, 2
jne 0x140010e93
test esi, esi
je 0x140010e5d
sub esi, 1
je 0x140010e27
cmp esi, 1
jne 0x140010d55
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, r14
mov dword [rsp + 0x20], r15d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r12d, eax
lea r8, str.RegModify_3_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
test r12d, r12d
jne 0x140010e0e
mov r14d, r15d
nop dword [rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x6c]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x80]
mov edx, r14d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x6c], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
lea rcx, [rbp - 0x80]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140010dc6
mov r9, rbx
inc r9
cmp word [rdi + r9*2], r15w
jne 0x140010dd3
mov dword [rsp + 0x28], eax
mov r8, rdi
lea rax, [rbp - 0x80]
xor edx, edx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140010ec7
inc r14d
test esi, esi
je 0x140010d80
mov ecx, dword [rsp + 0x68]
cmp ecx, 4
jne 0x140010fe0
mov dword [rsp + 0x28], ecx
mov r9d, ecx
jmp 0x14001100c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, r14
mov dword [rsp + 0x20], r15d
mov rcx, 0xffffffff80000001
jmp 0x140010d4c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, r14
mov dword [rsp + 0x20], r15d
mov rcx, 0xffffffff80000002
jmp 0x140010d4c
lea r8, [0x1400514b0]
lea rdx, [0x140090f60]
test r14, r14
je 0x140010ebf
mov r9, r14
mov dword [rsp + 0x20], r12d
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011097
mov r9d, r12d
jmp 0x14001108b
mov ecx, dword [rsp + 0x60]
call fcn.14001bda4
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x64]
mov r15, rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x68]
cmp eax, 4
jne 0x140010f0a
mov dword [rsp + 0x28], eax
mov r9d, eax
jmp 0x140010f3d
cmp eax, 3
jne 0x140010f20
mov dword [rsp + 0x28], 4
mov r9d, eax
jmp 0x140010f3d
cmp word [r13 + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140010f20
mov r9d, dword [rsp + 0x64]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140010f86
lea r8, [0x1400514f0]
lea rdx, [0x140090f60]
test rdi, rdi
je 0x140011088
mov r9, rdi
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011097
mov eax, dword [rsp + 0x60]
xor r8d, r8d
mov r9d, dword [rsp + 0x64]
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400110cd
lea r8, [0x140051510]
lea rdx, [0x140090f60]
test rdi, rdi
je 0x140011088
mov r9, rdi
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011097
cmp ecx, 3
jne 0x140010ff2
mov dword [rsp + 0x28], 4
mov r9d, ecx
jmp 0x14001100c
cmp word [r13 + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x140010ff2
lea eax, [rbx*2 + 2]
mov r9d, ecx
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001104e
lea r8, [0x140051530]
lea rdx, [0x140090f60]
test rdi, rdi
je 0x140011088
mov r9, rdi
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011097
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400110cd
lea r8, str.RegDeleteKey
lea rdx, [0x140090f60]
test rdi, rdi
je 0x140011088
mov r9, rdi
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011097
mov r9d, eax
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400110ac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1400110b9
mov rcx, r15
call fcn.14001bd9c
test rsi, rsi
je 0x1400110c6
mov rcx, rsi
call fcn.14001bd9c
mov eax, 0x65b
jmp 0x1400110f6
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400110dd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1400110ea
mov rcx, r15
call fcn.14001bd9c
mov rcx, qword [rsp + 0x58]
call fcn.14001bd9c
xor eax, eax
mov r14, qword [rsp + 0x290]
mov r12, qword [rsp + 0x2e8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140011970
add rsp, 0x298
pop r15
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret