Function at 0x1400a3c20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x140331888]
mov esi, r8d
mov r13, rdx
mov r14, rcx
cmp eax, 0xffffffff
jne 0x1400a3c55
call fcn.1400a6040
xor r15d, r15d
test eax, eax
jne 0x1400a40be
call fcn.1400a61e8
test eax, eax
jne 0x1400a40be
mov dl, 1
mov rcx, r14
call fcn.1400a33dc
test al, al
jne 0x1400a40be
cmp dword [0x14033e5c0], r15d
mov ebx, r15d
mov dword [rbp + 0x58], r15d
mov dil, r15b
mov dword [rbp - 0x20], r15d
je 0x1400a3ca6
lea rcx, [0x14033f088]
mov dil, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx r9d, word [r14 + 0x18]
lea r8, [rbp - 0x10]
mov rcx, qword [r14 + 0x10]
lea rdx, [rbp - 0x18]
shr r9d, 1
and r9d, 0x10
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov qword [rsp + 0x20], r15
call fcn.1400a2174
test eax, eax
jne 0x1400a3de8
mov r15, qword [rbp - 0x10]
xor edx, edx
mov r12, qword [rbp - 0x18]
mov rcx, r15
test r15, r15
jne 0x1400a3cee
mov rcx, qword [r12]
lea rax, [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov rdx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400a3d6e
mov eax, dword [rbp + 0x58]
test eax, eax
je 0x1400a3e45
mov ecx, eax
xor edx, edx
call fcn.14000e524
mov rsi, rax
test rax, rax
je 0x1400a3e40
test rbx, rbx
je 0x1400a3d3f
mov rcx, rbx
call fcn.14000e530
mov rbx, rsi
test r15, r15
jne 0x1400a3d4b
mov r15, qword [r12]
mov rdx, qword [r14]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0x3f2
je 0x1400a3d87
cmp esi, 0x3fa
je 0x1400a3d87
cmp esi, 6
jne 0x1400a3e45
mov rax, qword [r14 + 0x10]
xor r15d, r15d
mov rdx, r12
movzx ecx, word [rax + 0xa]
and ecx, 0xf
lea rax, [rcx + rcx*2]
lea rcx, [0x140000000]
mov qword [rcx + rax*8 + 0x331750], r15
lea rcx, [0x14033eaa0]
call fcn.1400a3008
movzx r9d, word [r14 + 0x18]
lea r8, [rbp - 0x10]
mov rcx, qword [r14 + 0x10]
lea rdx, [rbp - 0x18]
shr r9d, 1
and r9d, 0x10
mov qword [rbp - 0x18], r15
mov qword [rsp + 0x20], r15
call fcn.1400a2174
test eax, eax
je 0x1400a3cd8
mov esi, dword [rbp + 0x50]
mov rcx, qword [r14 + 8]
movabs rax, 0xcccccccccccccccc
cmp rcx, rax
je 0x1400a3ea2
movzx eax, word [r14 + 0x18]
and eax, 0xf
jle 0x1400a3fc4
cmp eax, 2
jle 0x1400a3fab
cmp eax, 4
je 0x1400a3f91
cmp eax, 0xb
jne 0x1400a3fc4
cmp esi, 8
je 0x1400a3f85
mov dword [0], 1
xor ecx, ecx
int 0x29
mov esi, 8
mov rcx, r12
call fcn.1400a4154
xor r15d, r15d
test esi, esi
jne 0x1400a3de5
test rbx, rbx
je 0x1400a3de5
movzx eax, word [r14 + 0x18]
and eax, 0xf
cmp dword [rbp - 0x20], eax
jne 0x1400a3ea2
dec eax
cmp eax, 1
ja 0x1400a3f58
mov eax, dword [rbp + 0x58]
mov r8, r13
shr rax, 1
sub r8, rbx
mov word [rbx + rax*2 - 2], r15w
mov rax, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400a3e9a
add rax, 2
test edx, edx
jne 0x1400a3e86
test ecx, ecx
je 0x1400a4092
mov r12d, dword [rbp + 0x50]
movzx r9d, word [r14 + 0x18]
lea r8, [rbp - 0x10]
mov rcx, qword [r14 + 0x10]
lea rdx, [rbp - 0x18]
and r9d, 0x20
mov qword [rsp + 0x20], r15
or r9d, 8
shr r9d, 1
call fcn.1400a2174
mov esi, eax
test eax, eax
jne 0x1400a403d
mov rcx, qword [rbp - 0x10]
mov r15, qword [rbp - 0x18]
test rcx, rcx
jne 0x1400a3ee6
mov rcx, qword [r15]
movzx r9d, word [r14 + 0x18]
xor r8d, r8d
mov rdx, qword [r14]
and r9d, 0xf
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp eax, 0x3f2
je 0x1400a3f1e
cmp eax, 0x3fa
je 0x1400a3f1e
cmp eax, 6
jne 0x1400a3fd3
mov rax, qword [r14 + 0x10]
mov rdx, r15
movzx ecx, word [rax + 0xa]
and ecx, 0xf
lea rax, [rcx + rcx*2]
lea rcx, [0x140000000]
and qword [rcx + rax*8 + 0x331750], 0
lea rcx, [0x14033eaa0]
call fcn.1400a3008
xor r15d, r15d
mov qword [rbp - 0x18], r15
jmp 0x1400a3ea6
mov r12d, dword [rbp + 0x50]
cmp dword [rbp + 0x58], r12d
jne 0x1400a3ea6
mov r8d, dword [rbp + 0x58]
mov rdx, r13
mov rcx, rbx
call fcn.140137fc0
test eax, eax
jne 0x1400a3ea6
mov esi, r15d
jmp 0x1400a4092
cmp qword [r13], rcx
jne 0x1400a3ea2
jmp 0x1400a3f7d
cmp esi, 4
je 0x1400a3fa5
mov dword [0], 1
xor ecx, ecx
int 0x29
cmp dword [r13], ecx
jmp 0x1400a3f89
cmp esi, 2
jae 0x1400a3fbf
mov dword [0], 1
xor ecx, ecx
int 0x29
cmp rcx, r13
jmp 0x1400a3f89
mov dword [0], 1
xor ecx, ecx
int 0x29
test eax, eax
je 0x1400a4030
mov ecx, 1
lock xadd dword [0x14033e8f0], ecx
mov r15, qword [rbp - 0x18]
inc ecx
movabs rax, 0x47ae147ae147ae15
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
lea rdx, [0x140000000]
shr rax, 5
imul rax, rax, 0x32
sub rcx, rax
movsxd rax, ecx
lea rcx, str.OrapiWriteFail:_RegSetValueExW
add rax, rax
mov dword [rdx + rax*8 + 0x33e5d0], esi
mov qword [rdx + rax*8 + 0x33e5d8], rcx
mov rcx, r15
call fcn.1400a4154
xor r15d, r15d
jmp 0x1400a4092
mov ecx, 1
lock xadd dword [0x14033e8f0], ecx
inc ecx
movabs rax, 0x47ae147ae147ae15
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
lea rdx, str.OrapiWriteFail:_CacheKey_in_WriteValue
shr rax, 5
imul rax, rax, 0x32
sub rcx, rax
movsxd rax, ecx
lea rcx, [0x140000000]
add rax, rax
mov dword [rcx + rax*8 + 0x33e5d0], esi
mov qword [rcx + rax*8 + 0x33e5d8], rdx
cmp dword [0x14033e5c0], r15d
je 0x1400a40ad
test dil, dil
je 0x1400a40ad
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400a40ba
mov rcx, rbx
call fcn.14000e530
mov eax, esi
jmp 0x1400a40c0
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret