Function at 0x140013554
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
cmp rcx, rbp
jne 0x140013597
mov eax, 0xa0
jmp 0x140013a7d
call fcn.140014fb4
mov ecx, dword [0x1400bfb04]
cmp eax, ebp
cmovne ecx, dword [0x1400be7f4]
cmp ecx, ebp
jne 0x140013a7b
call fcn.140014fac
cmp eax, ebp
jne 0x140013a7b
cmp dword [0x1400be7e8], ebp
je 0x140013722
mov r12, rbp
call fcn.140014fb4
mov ecx, dword [0x1400bfb04]
cmp eax, ebp
cmovne ecx, dword [0x1400be7f4]
cmp ecx, ebp
je 0x1400135f1
test byte [rsi + 0x18], 0x10
je 0x140013722
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov ebx, ebp
cmp dword [0x1400be7f8], ebp
je 0x140013617
lea rcx, [0x1400be770]
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx r9d, word [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x38]
and r9d, 0x20
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
or r9d, 4
shr r9d, 1
call fcn.140012af4
mov edi, eax
cmp eax, ebp
jne 0x1400136f2
mov rcx, qword [rsi]
cmp rcx, rbp
je 0x140013659
call fcn.14001b900
mov r12, rax
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor r13d, r13d
cmp rcx, r13
jne 0x14001366f
mov rcx, qword [rbp]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdi, eax
cmp r12, r13
je 0x140013698
mov rcx, r12
call fcn.140009e7c
cmp edi, 0x3f2
je 0x1400136ad
cmp edi, 0x3fa
je 0x1400136ad
cmp edi, 6
jne 0x1400136e1
mov rcx, rdi
mov edx, 0x796d7463
call fcn.140011e00
mov edx, 0x796d7468
xor ecx, ecx
call fcn.140011e00
lea rcx, [0x1400be800]
mov rdx, rbp
call fcn.140012a68
xor ebp, ebp
mov qword [rsp + 0x40], rbp
jmp 0x140013617
lea rcx, [0x1400be800]
mov rdx, rbp
call fcn.140012944
xor ebp, ebp
xor r12d, r12d
cmp edi, r12d
sete bpl
cmp dword [0x1400be7f8], r12d
je 0x140013717
cmp ebx, r12d
je 0x140013717
lea rcx, [0x1400be770]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebp, r12d
jne 0x140013a7b
xor ebp, ebp
mov rcx, qword [rsi]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x30], ebp
mov r13, rbp
mov dword [rsp + 0x50], ebp
cmp rcx, rbp
je 0x140013742
call fcn.14001b900
mov r13, rax
mov ebx, ebp
cmp dword [0x1400be7f8], ebp
je 0x14001375e
lea rcx, [0x1400be770]
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x40], rbp
movzx r9d, word [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x40]
shr r9d, 1
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rbp
and r9d, 0x10
mov qword [rsp + 0x38], rbp
call fcn.140012af4
cmp eax, ebp
jne 0x1400139b5
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbp
cmp rbp, rdx
jne 0x1400137ac
mov rcx, qword [r12]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov edi, eax
cmp eax, ecx
jne 0x140013826
mov eax, dword [rsp + 0x30]
cmp eax, ecx
je 0x14001386f
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.14000a0e8
xor ecx, ecx
cmp eax, ecx
je 0x14001386a
cmp rbp, rcx
jne 0x1400137fc
mov rbp, qword [r12]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rdx, r13
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 0x3f2
je 0x14001383b
cmp edi, 0x3fa
je 0x14001383b
cmp edi, 6
jne 0x14001386f
movsxd rcx, edi
mov edx, 0x796d7463
call fcn.140011e00
mov edx, 0x796d7469
xor ecx, ecx
call fcn.140011e00
lea rcx, [0x1400be800]
mov rdx, r12
call fcn.140012a68
xor ebp, ebp
jmp 0x140013763
mov edi, 8
lea rcx, [0x1400be800]
mov rdx, r12
call fcn.140012944
xor ebp, ebp
cmp edi, ebp
jne 0x1400139b5
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1400139b5
movzx eax, word [rsi + 0x18]
and eax, 0xf
cmp dword [rsp + 0x50], eax
jne 0x1400138d3
dec eax
cmp eax, 1
ja 0x140013989
mov eax, dword [rsp + 0x30]
lea r8d, [rbp + 4]
mov rdx, r14
shr rax, 1
mov word [rcx + rax*2 - 2], bp
mov rcx, qword [rsp + 0x48]
call fcn.1400210b8
cmp eax, ebp
jne 0x140013a3d
movzx r9d, word [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x40]
and r9d, 0x20
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rbp
or r9d, 8
shr r9d, 1
call fcn.140012af4
mov edi, eax
cmp eax, ebp
jne 0x140013a3d
mov rcx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
xor edx, edx
cmp rcx, rdx
jne 0x14001391a
mov rcx, qword [rbp]
movzx r9d, word [rsi + 0x18]
xor r8d, r8d
mov rdx, r13
and r9d, 0xf
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdi, eax
cmp edi, 0x3f2
je 0x140013955
cmp edi, 0x3fa
je 0x140013955
cmp edi, 6
jne 0x140013a2c
mov rcx, rdi
mov edx, 0x796d7463
call fcn.140011e00
mov edx, 0x796d746a
xor ecx, ecx
call fcn.140011e00
lea rcx, [0x1400be800]
mov rdx, rbp
call fcn.140012a68
xor ebp, ebp
mov qword [rsp + 0x38], rbp
jmp 0x1400138d3
cmp dword [rsp + 0x30], r15d
jne 0x1400138d3
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov rdx, r14
call sub.MSVCR90.dll_memcmp
cmp eax, ebp
jne 0x1400138d3
mov edi, ebp
jmp 0x140013a3d
mov rcx, qword [rsi + 8]
movabs rax, 0xcccccccccccccccc
cmp rcx, rax
je 0x1400138d3
movzx eax, word [rsi + 0x18]
and eax, 0xf
jle 0x140013a11
cmp eax, 2
jle 0x1400139e4
cmp eax, 4
jne 0x140013a11
cmp dword [r14], ecx
jmp 0x1400139a8
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call fcn.140019ac0
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, r14
call fcn.1400210b8
cmp eax, ebp
je 0x1400138d3
jmp 0x1400139ae
xor edx, edx
mov ecx, 0x6661626f
call fcn.140011d08
mov rdx, qword [rsi + 8]
mov r8, r15
mov rcx, r14
jmp 0x1400139a1
lea rcx, [0x1400be800]
mov rdx, rbp
call fcn.140012944
xor ebp, ebp
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x140013a51
call fcn.140009e7c
mov qword [rsp + 0x48], rbp
cmp r13, rbp
je 0x140013a5e
mov rcx, r13
call fcn.140009e7c
cmp dword [0x1400be7f8], ebp
je 0x140013a77
cmp ebx, ebp
je 0x140013a77
lea rcx, [0x1400be770]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x140013a7d
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140008a98
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret