Function at 0x14002c290
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
mov qword [rbp - 0x18], rcx
xor r14d, r14d
mov rax, rcx
xor ecx, ecx
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x30], rcx
mov r15, rdx
mov r13d, r14d
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
test rax, rax
je 0x14002c75e
cmp qword [rax + 8], rcx
je 0x14002c75e
test rdx, rdx
je 0x14002c75e
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x14002c75e
mov rcx, qword [r15 + 0x50]
test rcx, rcx
je 0x14002c75e
cmp qword [r15 + 0x80], r14
je 0x14002c75e
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rcx + rax], r13b
jne 0x14002c333
mov rcx, rdi
nop
inc rcx
cmp byte [rdx + rcx], r13b
jne 0x14002c340
inc rax
add rax, rcx
cmp rax, 0x7fff
ja 0x14002c75e
mov rcx, rdx
mov qword [rsp + 0x140], r12
call fcn.14002c9a0
mov r12, rax
test rax, rax
jne 0x14002c37d
lea eax, [r12 + 6]
jmp 0x14002c593
mov rcx, qword [r15 + 0x50]
mov qword [rsp + 0x190], rsi
call fcn.14002c9a0
mov qword [rsp + 0x60], rax
mov rsi, rax
test rax, rax
jne 0x14002c3a3
lea ebx, [rax + 6]
jmp 0x14002c70a
mov rsi, r14
lea r14, str.HKEY_LOCAL_MACHINE
nop dword [rax]
mov rcx, qword [r14]
mov rbx, rdi
inc rbx
cmp word [rcx + rbx*2], r13w
jne 0x14002c3b6
mov r8, rbx
mov rdx, r12
call fcn.14021f144
test eax, eax
je 0x14002c3f7
inc rsi
add r14, 0x10
mov rax, rsi
cmp rsi, 0xa
jb 0x14002c3b0
cmp rax, 0xa
jne 0x14002c3f7
mov rsi, qword [rsp + 0x60]
mov ebx, 1
xor r14d, r14d
jmp 0x14002c70a
movzx ecx, word [r12 + rbx*2]
lea rax, [r12 + rbx*2]
cmp cx, 0x5c
je 0x14002c411
test cx, cx
jne 0x14002c3e5
cmp cx, 0x5c
jne 0x14002c41f
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x14002c411
add rsi, rsi
xor r14d, r14d
test cx, cx
mov edx, r14d
lea rcx, str.HKEY_LOCAL_MACHINE
mov r9d, 0x2001f
cmovne rdx, rax
lea rax, [rsp + 0x70]
mov rcx, qword [rcx + rsi*8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rsi, qword [rsp + 0x60]
test eax, eax
je 0x14002c466
lea ebx, [r14 + 0xd]
jmp 0x14002c70a
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c550
xorps xmm0, xmm0
mov qword [rbp - 0x10], 3
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm0
mov r9d, 0x20019
movdqa xmmword [rbp + 0x20], xmm1
lea r8, [rbp - 0x10]
mov qword [rbp + 8], r14
mov rdx, rsi
mov qword [rbp - 8], r12
mov rcx, r12
mov qword [rbp], rsi
call fcn.14002b560
mov ebx, eax
test eax, eax
jne 0x14002c737
cmp byte [rbp + 8], r13b
jne 0x14002c4df
lea ebx, [rax + 3]
jmp 0x14002c737
mov rcx, qword [r15 + 0x80]
lea rdx, [rsp + 0x78]
mov r8d, 0xa
call fcn.140219690
mov rcx, qword [r15 + 0x80]
mov esi, eax
nop
inc rdi
cmp byte [rcx + rdi], r13b
jne 0x14002c500
add rdi, rcx
cmp qword [rsp + 0x78], rdi
je 0x14002c522
mov rsi, qword [rsp + 0x60]
mov ebx, 3
jmp 0x14002c737
lea rcx, [r15 + 0xb0]
mov r8d, 0x20
lea rdx, [rbp + 9]
call fcn.14020d820
test eax, eax
jne 0x14002c541
cmp esi, dword [rbp + 0x2c]
je 0x14002c546
mov ebx, 0x14
mov rsi, qword [rsp + 0x60]
jmp 0x14002c737
mov rcx, qword [r15 + 0x80]
lea rdx, [rbp - 0x20]
mov r8d, 0xa
call fcn.140219690
mov rcx, qword [r15 + 0x80]
mov dword [rsp + 0x68], eax
mov rax, rdi
inc rax
cmp byte [rcx + rax], r13b
jne 0x14002c574
add rax, rcx
cmp qword [rbp - 0x20], rax
je 0x14002c5b8
mov eax, 3
mov rsi, qword [rsp + 0x190]
mov r12, qword [rsp + 0x140]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x148
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x70]
lea rax, [0x140029da0]
mov qword [rbp - 0x78], rax
lea rax, [0x140029d30]
mov qword [rbp - 0x70], rax
lea rax, [0x140029db0]
mov qword [rbp - 0x68], rax
lea rax, [0x140029e20]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x58], rax
lea r13, [rbp - 0x80]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rsi
test rcx, rcx
je 0x14002c705
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], r14
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14002c705
mov edi, dword [rsp + 0x78]
cmp edi, 4
jae 0x14002c65b
lea edi, [rax + 4]
jmp 0x14002c65e
add edi, 2
mov ecx, edi
mov edx, 1
call fcn.1402122f4
mov rbx, rax
test rax, rax
je 0x14002c705
mov rdx, qword [rbp - 0x48]
lea r9, [rsp + 0x60]
mov rcx, qword [rbp - 0x50]
xor r8d, r8d
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x38], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 2
jbe 0x14002c6b2
mov rcx, rbx
call fcn.1402122e0
jmp 0x14002c705
mov eax, dword [rbp - 0x38]
lea rdx, [rbp - 0x80]
test ecx, ecx
mov dword [rbp - 0x34], r14d
mov rcx, qword [rbp - 0x18]
mov r8, r15
cmovne eax, r14d
xor r9d, r9d
mov dword [rbp - 0x38], eax
call fcn.140028440
mov ebx, eax
test eax, eax
jne 0x14002c70a
mov eax, dword [rbp - 0x38]
xor r8d, r8d
mov r9d, dword [rsp + 0x68]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14002c722
mov ebx, 3
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002c71d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r13, r13
je 0x14002c737
mov rcx, qword [r13 + 0x40]
call fcn.1402122e0
mov qword [r13 + 0x48], 0
mov qword [r13 + 0x40], r14
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002c747
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call fcn.1402122e0
mov rcx, rsi
call fcn.1402122e0
mov eax, ebx
jmp 0x14002c58b
mov eax, 1
jmp 0x14002c59b