Function at 0x14004b770
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
mov eax, 0x2040
call fcn.1400c9ef0
sub rsp, rax
lea rax, [rsp + 0x2050]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x2050], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
test eax, eax
je 0x14004b831
mov r8d, 0x208
mov dword [rsp + 0x2060], 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2060]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
add rsp, 0x2040
pop rbx
ret
mov qword [rsp + 0x2068], rsi
lea rcx, [rsp + 0x30]
mov rsi, qword [rsp + 0x2050]
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2060]
mov dword [rsp + 0x2060], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b9cb
mov eax, dword [rsp + 0x2060]
test eax, eax
je 0x14004b928
mov qword [rsp + 0x2038], rdi
mov qword [rsp + 0x2030], r14
lea r14, str.abcdef012345789
nop word [rax + rax]
mov eax, ebx
lea rdi, [rsp + 0x30]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x14004b90b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x14004b8f0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x2060]
inc ebx
cmp ebx, eax
jb 0x14004b8c0
mov r14, qword [rsp + 0x2030]
mov rdi, qword [rsp + 0x2038]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x30]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [rsp + 0x2060]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rsp + 0x2058], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2058]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.ComputerHardwareIds
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_multi_string_of_length__d_n_n
call fcn.14000c200
jmp 0x14004ba2c
xor edx, edx
mov dword [rsp + 0x2058], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2058]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.ComputerHardwareIds
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2068]
add rsp, 0x2040
pop rbx
ret