Function at 0x140034bb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rdi, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140034e39
test r9, r9
je 0x140034e39
xor edx, edx
mov qword [rsp + 0x270], rbx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.14003aa80
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x140034c9f
mov rcx, qword [rsp + 0x48]
mov r9d, 0xffff
mov dword [rsp + 0x40], eax
mov r8, rbp
lea rax, [rsp + 0x278]
mov dword [rsp + 0x278], 0x200
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ebx, eax
test eax, eax
je 0x140034c92
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140034c92
mov r9, rbp
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s.
mov edx, 8
call fcn.140032570
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034cbf
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140034cc6
mov r9, rsi
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.140032570
mov rcx, qword [0x1400b80b8]
test ebx, ebx
jne 0x140034e2b
lea rax, [rsp + 0x278]
mov qword [rsp + 0x278], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x140034dcc
mov rdi, qword [rsp + 0x290]
test rdi, rdi
je 0x140034db7
lea rax, [rsp + 0x50]
lea ecx, [rbx + 1]
nop
cmp byte [rax], 0
jne 0x140034d2b
cmp byte [rax + 1], 0
je 0x140034d3a
cmp ecx, 0x200
jae 0x140034d3a
inc rax
inc ecx
jmp 0x140034d20
inc ecx
cmp ecx, 0x200
jae 0x140034da2
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x278]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x140034dbc
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140034dbc
mov r9, rdi
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s.
mov edx, 8
call fcn.140032570
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034dec
mov rcx, qword [rsp + 0x278]
mov ebx, 0x7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034dec
mov ebx, 0x57
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034dec
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140034df3
mov r9, rdi
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.140032570
mov rcx, qword [0x1400b80b8]
test ebx, ebx
je 0x140034e0d
test rcx, rcx
je 0x140034e0d
lea r8, str.CopyMultiSzRegValue:_SetMultiSzRegValue_failed
mov edx, 8
call fcn.140032570
mov eax, ebx
mov rbx, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rsi
ret
test rcx, rcx
je 0x140034e0d
lea r8, str.CopyMultiSzRegValue:_GetMultiSzRegValue_failed
jmp 0x140034e03
mov eax, 0x57
jmp 0x140034e17