Function at 0x140032650
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor r12d, r12d
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
mov edi, r9d
lea rax, [rbp + 7]
mov qword [rbp - 1], r12
mov qword [rsp + 0x38], rax
lea r9, [rbp - 9]
lea rax, [rbp + 0x67]
mov qword [rbp - 0x11], r12
mov qword [rsp + 0x30], rax
mov r14, r8
lea rax, [rbp + 0x17]
mov qword [rbp - 9], r12
mov qword [rsp + 0x28], rax
lea r8, [rbp - 1]
lea rax, [rbp + 0xf]
mov qword [rbp + 0xf], r12
mov rcx, rdx
mov qword [rsp + 0x20], rax
mov ebx, r12d
mov qword [rbp + 0x17], r12
mov dword [rbp + 0x67], r12d
mov dword [rbp - 0x19], r12d
mov qword [rbp + 7], r12
call fcn.140032ce8
mov r13, qword [rbp + 0xf]
mov rsi, qword [rbp + 0x17]
cmp qword [rbp - 1], r12
je 0x14003283f
cmp qword [rbp - 9], r12
je 0x14003283f
mov rdx, qword [rbp - 9]
lea rax, [rbp - 0x11]
mov rcx, qword [rbp - 1]
lea r15d, [r12 + 3]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003283f
test edi, edi
je 0x140032b34
mov rdi, qword [rbp + 7]
test rsi, rsi
jne 0x140032790
test rdi, rdi
jne 0x140032790
mov rcx, qword [rbp - 0x11]
lea rax, [0x140040718]
mov dword [rsp + 0x28], 2
lea r9d, [r12 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14003282c
mov r14d, dword [rbp + 0x67]
test r14b, 2
je 0x1400327c1
mov rcx, qword [rbp - 0x11]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140032828
mov eax, 0x10001
cmp r14d, eax
ja 0x140032887
je 0x140032b04
mov eax, r14d
test r14d, r14d
je 0x1400328b0
sub eax, 1
je 0x1400327fc
sub eax, 1
je 0x1400328b0
sub eax, 1
je 0x1400327fc
cmp eax, 5
jmp 0x1400328ae
test rdi, rdi
je 0x140032828
mov eax, dword [rbp - 0x19]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r14, qword [rbp + 0x77]
mov edi, dword [rbp + 0x7f]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x140032866
test r13, r13
jne 0x140032866
test rsi, rsi
jne 0x140032866
cmp qword [rbp - 9], r12
je 0x140032866
cmp qword [rbp - 1], r12
je 0x140032866
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call fcn.14001bd98
test ebx, ebx
je 0x140032b7f
test edi, edi
jne 0x140032b57
cmp ebx, 2
jne 0x140032b57
mov ebx, r12d
jmp 0x140032b7f
mov eax, r14d
sub eax, 0x10003
je 0x140032b04
sub eax, 0xfffd
je 0x140032ad2
sub eax, 2
je 0x140032ad2
cmp eax, 0x20006
je 0x1400328e2
test rsi, rsi
je 0x140032828
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x1400328bd
lea eax, [rdi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
jmp 0x140032810
test rsi, rsi
je 0x140032828
or rdi, 0xffffffffffffffff
mov dword [rbp + 0x67], r12d
mov dword [rbp - 0x19], 7
bt r14d, 0x12
jae 0x140032a4a
mov rcx, qword [rbp - 0x11]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140032a4a
cmp dword [rbp - 0x19], 7
jne 0x140032a4a
mov rcx, rdi
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x140032942
mov r14d, dword [rbp + 0x67]
mov eax, 2
shr r14, 1
add r14, r15
add r14, rcx
mul r14
cmovo rax, rdi
mov rcx, rax
call fcn.14000130c
mov r15, rax
test rax, rax
jne 0x14003297d
lea ebx, [rax + 0xe]
jmp 0x140032a4a
mov rcx, qword [rbp - 0x11]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140032a42
mov r12, r15
xor r11d, r11d
mov rcx, r12
cmp r11w, word [r12]
je 0x140032a05
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
je 0x1400329ea
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r11w
jne 0x1400329d6
lea r12, [r12 + rax*2]
add r12, 2
jmp 0x1400329b3
mov rcx, rdi
xor r12d, r12d
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x1400329f0
mov rax, rdi
sub rax, rcx
add r14, rax
jmp 0x140032a3b
lea rdx, [r14 - 1]
mov r8, rsi
call fcn.1400104bc
test eax, eax
js 0x140032a2d
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r11w
jne 0x140032a18
mov word [r12 + rax*2 + 2], r11w
xor r12d, r12d
jmp 0x140032a3b
mov rcx, r15
call fcn.1400012c0
xor r12d, r12d
mov r15d, r12d
test r15, r15
jne 0x140032a9a
jmp 0x140032a4a
mov rcx, r15
call fcn.1400012c0
mov r14, rdi
inc r14
cmp word [rsi + r14*2], r12w
jne 0x140032a4d
add r14, 2
mov eax, 2
mul r14
cmovo rax, rdi
mov rcx, rax
call fcn.14000130c
mov r15, rax
test rax, rax
je 0x140032828
lea rdx, [r14 - 1]
mov r8, rsi
mov rcx, rax
call fcn.1400104bc
inc rdi
cmp word [r15 + rdi*2], r12w
jne 0x140032a8a
mov word [r15 + rdi*2 + 2], r12w
mov rcx, qword [rbp - 0x11]
lea eax, [r14 + r14]
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, r15
mov ebx, eax
call fcn.1400012c0
jmp 0x140032828
test rsi, rsi
je 0x140032828
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x140032adf
lea eax, [rdi*2 + 2]
mov r9d, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
jmp 0x140032810
test rsi, rsi
je 0x140032828
mov rcx, rsi
call fcn.14001d800
mov dword [rbp + 0x67], eax
mov r9d, 4
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x140032810
test r13, r13
je 0x14003282f
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14003282f
mov r8d, ebx
lea rdx, str.ERROR:_Registry_key_change_failed:_lRes__0x_x._r_n
mov ecx, 2
call fcn.140018ed8
mov r8, r14
lea rdx, str.ERROR:_Registry_transaction_failure_for:__S._r_n
mov ecx, 2
call fcn.140018ed8
lea rax, str.DELREG
mov dword [rsp + 0x20], ebx
test edi, edi
lea r8, str.ADDREG
mov r9, r14
lea rdx, str._Processed__S_line:__S__result_0x_x._r_n
cmove r8, rax
mov ecx, 4
call fcn.140018ed8
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140032bbe
mov edx, 1
call fcn.140001684
cmp qword [rbp - 9], r12
je 0x140032bcd
mov rcx, qword [rbp - 9]
call fcn.1400012c0
test r13, r13
je 0x140032bda
mov rcx, r13
call fcn.1400012c0
test rsi, rsi
je 0x140032be7
mov rcx, rsi
call fcn.1400012c0
test ebx, ebx
jle 0x140032bf4
movzx ebx, bx
or ebx, 0x80070000
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret