Function at 0x401000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov r12d, 1
mov rbx, rdx
mov esi, ecx
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x98]
call sym.parse_registry_key
test eax, eax
je 0x4010ec
cmp esi, 3
jle 0x4013b8
xor r11d, r11d
mov rbp, qword [sym.imp.kernel32.dll_lstrcmpiW]
xor r12d, r12d
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x7c], 0
mov edi, 3
mov word [rsp + 0x7a], r11w
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
movsxd rax, edi
mov r13, qword [rbx + rax*8]
lea r14, [rax*8]
movzx eax, word [r13]
and eax, 0xfffffffd
cmp ax, 0x2d
jne case.0x4012ae.1
lea r15, [r13 + 2]
lea rdx, section..rdata
mov rcx, r15
call rbp
test eax, eax
jne 0x401210
test r12d, r12d
je 0x401108
mov ecx, 0x69
mov r12d, 1
call sym.output_message
mov rcx, qword [rbx + 8]
call qword [sym.imp.ucrtbase.dll__wcsupr]
mov ecx, 0x6a
mov rdx, rax
call sym.output_message
mov eax, r12d
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12d, 1
add edi, 1
cmp esi, edi
jg 0x40108b
cmp qword [rsp + 0x68], 0
setne al
test al, r12b
jne case.0x4012ae.1
cmp dword [rsp + 0x5c], 0x300
je case.0x4012ae.1
mov r13d, dword [rsp + 0x5c]
lea rax, [rsp + 0x8c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
or r13d, 0x2001f
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40159e
mov r9d, dword [rsp + 0x7c]
test r9d, r9d
je 0x401a6e
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x4018ea
mov rdi, qword [0x00409a70]
mov rbp, qword [sym.imp.ucrtbase.dll__wcsicmp]
xor esi, esi
lea r12, [rdi + 8]
nop dword [rax]
mov rcx, qword [r12]
mov rdx, rbx
call rbp
test eax, eax
je 0x4014b0
add esi, 1
add r12, 0x10
cmp esi, 9
jne 0x4011c8
mov rcx, qword [rsp + 0xa0]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x70]
mov ecx, 0xcc
call sym.output_message
jmp 0x4010ec
lea rdx, [0x00409006]
mov rcx, r15
call rbp
test eax, eax
jne 0x401240
mov eax, dword [rsp + 0x5c]
test ah, 2
jne case.0x4012ae.1
or ah, 2
mov dword [rsp + 0x5c], eax
jmp 0x40110e
lea rdx, [0x00409014]
mov rcx, r15
call rbp
test eax, eax
jne 0x401270
mov eax, dword [rsp + 0x5c]
test ah, 1
jne case.0x4012ae.1
or ah, 1
mov dword [rsp + 0x5c], eax
jmp 0x40110e
movzx ecx, word [r13 + 2]
test cx, cx
je case.0x4012ae.1
cmp word [r13 + 4], 0
jne case.0x4012ae.1
call qword [sym.imp.ucrtbase.dll_towlower]
sub eax, 0x64
cmp ax, 0x12
ja case.0x4012ae.1
lea rdx, [0x00409024]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp qword [rsp + 0x70], 0
jne case.0x4012ae.1
mov rax, qword [rbx + r14 + 8]
add edi, 1
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x40110e
jmp case.0x4012ae.1
add edi, 1
cmp word [rsp + 0x7a], 0
mov rdx, qword [rbx + r14 + 8]
jne case.0x4012ae.1
test rdx, rdx
je case.0x4012ae.1
movzx eax, word [rdx]
mov word [rsp + 0x7a], ax
test ax, ax
je case.0x4012ae.1
mov rax, rdx
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x401318
sub rax, rdx
sar rax, 1
cmp eax, 1
je 0x40110e
jmp case.0x4012ae.1
cmp qword [rsp + 0x68], 0
jne case.0x4012ae.1
mov rax, qword [rbx + r14 + 8]
add edi, 1
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x40110e
jmp case.0x4012ae.1
mov r10d, dword [rsp + 0x7c]
test r10d, r10d
jne case.0x4012ae.1
mov dword [rsp + 0x7c], 1
jmp 0x40110e
cmp qword [rsp + 0x60], 0
jne case.0x4012ae.1
mov rax, qword [rbx + r14 + 8]
add edi, 1
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x40110e
jmp case.0x4012ae.1
lea rax, [rsp + 0x8c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40159e
cmp dword [rsp + 0x8c], 2
jne 0x40195c
mov qword [rsp + 0x68], 0
xor r8d, r8d
mov word [rsp + 0x7a], r8w
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x40119f
mov rdx, qword [rsp + 0x68]
mov ecx, 0xcd
call sym.ask_confirm
mov r12d, eax
test eax, eax
jne 0x40119f
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, 0x6d
call sym.output_message
jmp 0x4010ec
shl rsi, 4
mov ebx, eax
mov esi, dword [rdi + rsi]
cmp esi, 0xffffffff
je 0x4011e5
lea eax, [rsi - 4]
cmp eax, 1
ja 0x4015b3
cmp qword [rsp + 0x60], 0
je 0x4019f0
mov rdi, qword [rsp + 0x60]
movzx ecx, word [rdi + 2]
call qword [sym.imp.ucrtbase.dll_towlower]
mov r8d, 0x10
lea rdx, [rsp + 0xa8]
mov rcx, rdi
cmp ax, 0x78
mov eax, 0xa
cmovne r8d, eax
call qword [sym.imp.ucrtbase.dll_wcstoul]
mov ebx, eax
mov rax, qword [rsp + 0xa8]
cmp word [rax], 0
jne 0x4019d5
mov rax, qword [rsp + 0x60]
cmp word [rax], 0x2d
je 0x4019d5
cmp ebx, 0xffffffff
je 0x401a1d
mov ecx, 4
mov edi, 4
call qword [sym.imp.ucrtbase.dll_malloc]
mov dword [rax], ebx
mov r13, rax
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], edi
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r13
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.ucrtbase.dll_free]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test r12d, r12d
jne 0x40159e
mov ecx, 0x6c
call sym.output_message
jmp 0x4010ec
mov ecx, 0x6b
mov r12d, 1
call sym.output_message
jmp 0x4010ec
cmp qword [rsp + 0x60], 0
jne 0x4018cf
cmp esi, 0xb
ja case.0x4015d4.6
lea rdx, [0x00409070]
mov eax, esi
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea rax, [0x004090d0]
mov ecx, 2
mov edi, 2
mov qword [rsp + 0x60], rax
call qword [sym.imp.ucrtbase.dll_malloc]
mov rcx, qword [rsp + 0x60]
mov r13, rax
xor eax, eax
movzx edx, word [rcx + rax]
mov word [r13 + rax], dx
add rax, 2
test dx, dx
jne 0x4015fc
jmp 0x40154e
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x60]
mov edx, esi
mov ecx, 0xcb
xor r13d, r13d
xor edi, edi
call sym.output_message
jmp 0x40154e
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
jmp case.0x4018e8.4
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx ebp, word [rax]
test bp, bp
je 0x4019e1
add rax, 2
cmp word [rax], 0
jne 0x401669
sub rax, qword [rsp + 0x60]
sar rax, 1
mov rsi, rax
test eax, eax
je 0x4019e1
mov ecx, 2
cdq
idiv ecx
lea eax, [rdx + rsi]
cdq
idiv ecx
mov ecx, eax
mov rdi, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test sil, 1
je 0x4016db
lea eax, [rbp - 0x30]
cmp ax, 9
jbe 0x401a66
lea eax, [rbp - 0x61]
cmp ax, 5
jbe 0x401a5e
lea eax, [rbp - 0x41]
cmp ax, 5
ja 0x4019b1
sub ebp, 0x37
mov byte [r13], bpl
mov ebx, 1
cmp ebx, 1
sbb eax, eax
add eax, 2
cmp eax, esi
jge 0x401a13
lea edx, [rsi - 2]
lea eax, [rbx + 1]
movsxd rcx, ebx
mov r11d, 0xffffffff
sub edx, ebx
imul r9, rcx, 0xfffffffffffffffe
cdqe
add r9, qword [rsp + 0x60]
shr edx, 1
add rdx, rax
jmp 0x401784
lea r8d, [rax - 0x61]
cmp r8w, 5
jbe 0x40194b
lea r8d, [rax - 0x41]
sub eax, 0x37
cmp r8w, 6
cmovae eax, r11d
movzx r8d, word [r9 + rcx*4 + 2]
lea r10d, [r8 - 0x30]
cmp r10w, 9
jbe 0x401924
lea r10d, [r8 - 0x61]
cmp r10w, 5
jbe 0x401953
lea r10d, [r8 - 0x41]
cmp r10w, 5
ja 0x4019b1
sub r8d, 0x37
cmp al, 0xff
je 0x4019b1
shl eax, 4
or eax, r8d
mov byte [r13 + rcx], al
add rcx, 1
cmp rdx, rcx
je 0x401a13
movzx eax, word [r9 + rcx*4]
lea r8d, [rax - 0x30]
cmp r8w, 9
ja 0x40170e
sub eax, 0x30
jmp 0x40172d
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x60]
movzx ecx, word [rsi + 2]
call qword [sym.imp.ucrtbase.dll_towlower]
mov r8d, 0x10
lea rdx, [rsp + 0xa8]
mov rcx, rsi
cmp ax, 0x78
mov eax, 0xa
cmovne r8d, eax
call qword [sym.imp.ucrtbase.dll__wcstoui64]
mov rbx, rax
mov rax, qword [rsp + 0xa8]
cmp word [rax], 0
jne 0x4019d5
cmp rbx, 0xffffffffffffffff
je 0x4019c6
mov ecx, 8
mov esi, 0xb
mov edi, 8
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rax], rbx
mov r13, rax
jmp 0x40154e
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx edi, word [rax]
test di, di
je 0x401a81
add rax, 2
cmp word [rax], 0
jne 0x401838
mov r14, qword [rsp + 0x60]
sub rax, r14
sar rax, 1
lea ecx, [rax + 2]
mov rsi, rax
mov ebp, eax
movsxd rcx, ecx
add rcx, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test esi, esi
jle 0x401a8f
movzx r8d, word [rsp + 0x7a]
xor edx, edx
mov r9, r14
jmp 0x4018b6
mov word [rax], di
test edx, edx
je 0x40189a
cmp word [rax - 2], 0
jne 0x40189a
cmp word [rax], 0
je 0x401985
cmp edx, 1
je 0x401985
add ebx, 1
lea ecx, [rdx + 1]
add rax, 2
cmp ebp, ebx
jle 0x401a2e
movsxd rdx, ebx
movzx edi, word [r9 + rdx*2]
mov edx, ecx
test r8w, r8w
jne 0x4018c2
cmp di, 0x5c
je 0x40192d
cmp di, r8w
jne 0x401879
xor ecx, ecx
mov word [rax], cx
jmp 0x40187c
cmp esi, 0xb
ja case.0x4018e8.6
lea rdx, [0x004090a0]
mov eax, esi
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp qword [rsp + 0x60], 0
mov esi, 1
je 0x401965
mov rax, qword [rsp + 0x60]
cmp word [rax], 0
je 0x401a9a
add rax, 2
cmp word [rax], 0
jne 0x401906
sub rax, qword [rsp + 0x60]
sar rax, 1
lea ecx, [rax + rax + 2]
mov rdi, rcx
jmp 0x4015ec
sub r8d, 0x30
jmp 0x401764
lea ecx, [rbx + 1]
movsxd r10, ecx
cmp word [r9 + r10*2], 0x30
jne 0x401879
mov word [rax], 0
mov ebx, ecx
jmp 0x40187c
sub eax, 0x57
jmp 0x40172d
sub r8d, 0x57
jmp 0x401764
mov qword [rsp + 0x68], 0
mov ecx, 2
mov edi, 2
mov esi, 1
lea rax, [0x004090d0]
mov qword [rsp + 0x60], rax
jmp 0x4015ec
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
mov ecx, 0xca
call sym.output_message
mov rcx, qword [rsp + 0xa0]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x4010ec
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
mov ecx, 0xc9
call sym.output_message
jmp 0x401998
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 0x22
jne 0x4017fb
mov ecx, 0xc8
call sym.output_message
jmp 0x401998
mov esi, 3
xor r13d, r13d
xor edi, edi
jmp 0x40154e
mov rcx, qword [rsp + 0xa0]
mov r12d, 1
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, 0xce
call sym.output_message
jmp 0x4010ec
mov esi, 3
jmp 0x40154e
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 0x22
jne 0x401539
jmp 0x4019d5
movsxd rax, ecx
cmp word [r13 + rax*2 - 2], 0
mov word [r13 + rax*2], 0
je 0x401a50
lea ecx, [rdx + 2]
movsxd rax, ecx
mov word [r13 + rax*2], 0
lea edi, [rcx + rcx + 2]
mov esi, 7
jmp 0x40154e
sub ebp, 0x57
jmp 0x4016d2
sub ebp, 0x30
jmp 0x4016d2
cmp dword [rsp + 0x8c], 2
jne 0x40119f
jmp 0x401441
mov ecx, 4
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
mov word [r13], 0
xor ecx, ecx
jmp 0x401a50
mov ecx, 2
mov edi, 2
jmp 0x4015ec