Function at 0x14001a280
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xbf90]
mov eax, 0xc090
call fcn.1401d8290
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1402c9768]
xor rax, rsp
mov qword [rbp + 0xbf80], rax
mov rbx, r9
mov r12, r8
mov r15, rdx
mov sil, 1
mov dword [rsp + 0x5c], 0
call fcn.14002fe48
mov rcx, rax
test rax, rax
jne 0x14001a2e6
mov ecx, 0x80004005
call fcn.1400093e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [0x14027fa78]
or rdi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x14001a32c
movzx r14d, dx
mov ecx, r14d
call fcn.140030320
test rax, rax
je 0x14001a347
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140008a10
jmp 0x14001a347
mov rax, rdi
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x14001a330
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140008cd0
nop
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp - 0x80]
call fcn.1401dd1a0
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp + 0x3f80]
call fcn.1401dd1a0
xor edx, edx
mov r8d, 0x4000
lea rcx, [rbp + 0x7f80]
call fcn.1401dd1a0
mov dword [rsp + 0x28], 0x2000
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 0x2000
lea rax, [rbp + 0x3f80]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
cmp byte [rbp + 0xbff0], r8b
je 0x14001a4bb
movsx eax, byte [rbx]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001a443
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x80]
mov r8d, 0xcc
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegCreateKeyEx_fail__szSubKeyHub3_s__dwErrorCode_d
call fcn.1400095e0
xor sil, sil
jmp 0x14001a56e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x3f80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14001a4ab
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3f80]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8d, 0xd5
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegSetValueEx_fail__lResult_d__wKeyName__ws___dwErrorCode_d
call fcn.1400095e0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x14001a563
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001a4fb
xor sil, sil
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x80]
mov r8d, 0xe1
lea rdx, str.Utility::bRegistryReadWrite
lea rcx, str._r_n_s:_d:_RegOpenKeyExW_fail__szSubKeyHub3_ws__dwErrorCode_d
call fcn.1400095e0
jmp 0x14001a56e
mov dword [rsp + 0x58], 0x2000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x3f80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a560
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14001a563
lea rcx, [rbp + 0x7f80]
mov edx, eax
cmp word [rcx], 0
je 0x14001a554
movzx eax, byte [rcx]
mov byte [rbx], al
inc rbx
add rcx, 2
sub rdx, 1
jne 0x14001a546
jmp 0x14001a563
xor sil, sil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14001a58b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
mov rcx, qword [rbp + 0xbf80]
xor rcx, rsp
call fcn.1401d7480
add rsp, 0xc090
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret