Function at 0x140061ab0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x2a8], esi
cmp byte [0x1400cac11], sil
je 0x140062096
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test eax, eax
je 0x140061bd0
lea rcx, [0x1400a1850]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], sil
mov byte [rsp + 0x220], sil
or rbx, 0xffffffffffffffff
mov r9d, ebx
lea r8, str.copyTo_query_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.140006c70
lea r11, [0x1400a2698]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], sil
mov r9d, ebx
lea r8, str.System
lea edx, [rsi + 0x20]
lea rcx, [rsp + 0x220]
call fcn.140006c70
mov edx, edi
lea rcx, [rsp + 0x118]
call fcn.14001bad0
lea rdx, [0x1400c83b8]
lea rcx, [rsp + 0x118]
call fcn.1400649f0
int3
mov eax, dword [rsp + 0x68]
add eax, 1
mov r8, 0xffffffffffffffff
je 0x140061c01
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.140063af0
mov rdi, rax
mov qword [rsp + 0x70], rax
jmp 0x140061c09
mov rdi, rsi
mov qword [rsp + 0x70], rsi
xor ecx, ecx
call fcn.140064550
mov qword [rsp + 0x110], rdi
movsxd rax, dword [rsp + 0x60]
test eax, eax
je 0x140061c33
mov rcx, rax
call fcn.140063af0
mov rbp, rax
mov qword [rsp + 0x78], rax
jmp 0x140061c3b
mov rbp, rsi
mov qword [rsp + 0x78], rsi
xor ecx, ecx
call fcn.140064550
mov qword [rsp + 0xf0], rbp
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2a8], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8, rdi
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp eax, 0x103
je 0x140061e70
test ebx, ebx
jne 0x140061ddd
mov eax, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, dword [rsp + 0x6c]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rsp + 0x298]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140061d4a
add esi, 1
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2a8], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8, rdi
mov edx, esi
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp eax, 0x103
jne 0x140061ca5
jmp 0x140061e70
lea rcx, [0x1400a1850]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], 0
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.copyTo_set_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.140006c70
lea r11, [0x1400a2698]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x220]
call fcn.140006c70
mov edx, ebx
lea rcx, [rsp + 0x118]
call fcn.14001bad0
lea rdx, [0x1400c83b8]
lea rcx, [rsp + 0x118]
call fcn.1400649f0
int3
lea rcx, [0x1400a1850]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], 0
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.copyTo_enum_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.140006c70
lea r11, [0x1400a2698]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x220]
call fcn.140006c70
mov edx, ebx
lea rcx, [rsp + 0x118]
call fcn.14001bad0
lea rdx, [0x1400c83b8]
lea rcx, [rsp + 0x118]
call fcn.1400649f0
int3
cmp byte [rsp + 0x2a0], 0
je 0x140062083
xor esi, esi
mov r8b, 1
xor edx, edx
mov rbx, qword [rsp + 0x290]
mov rcx, rbx
call fcn.14005fc30
test rax, rax
je 0x140062083
mov rdi, rax
mov rbp, qword [rsp + 0x298]
nop
nop
xor ecx, ecx
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x88], 0xf003f
mov qword [rsp + 0x90], rcx
movzx eax, byte [rbx + 0x18]
mov byte [rsp + 0x98], al
mov r9d, dword [rbx + 8]
and r9d, 0xfff2ffd9
or r9d, 0x20019
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rdx, qword [rbx]
lea rcx, [rsp + 0x80]
call fcn.140060270
xor eax, eax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xf003f
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], al
mov byte [rsp + 0x2a8], 1
lea rcx, [rsp + 0xc0]
call fcn.14005ced0
nop
mov dword [rsp + 0xf8], 0x18
xor ecx, ecx
mov dword [rsp + 0x108], ecx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rax
mov r9d, dword [rbp + 8]
or r9d, 0xf003f
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rdx, qword [rbp]
lea rcx, [rsp + 0xa0]
call fcn.140060270
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov qword [rsp + 0xe0], rdi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xd8], rdi
mov rcx, qword [rsp + 0xd0]
call fcn.140064550
mov rcx, qword [rsp + 0xc8]
call fcn.140064550
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx r8d, byte [rsp + 0x2a0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.140061ab0
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140062027
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rdi
mov rcx, qword [rsp + 0xb0]
call fcn.140064550
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140062050
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x80], rdi
mov rcx, qword [rsp + 0x90]
call fcn.140064550
add esi, 1
mov r8b, 1
mov edx, esi
mov rcx, rbx
call fcn.14005fc30
mov rdi, rax
test rax, rax
jne 0x140061eb0
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140064550
nop
mov rcx, rdi
call fcn.140064550
jmp 0x1400620c0
mov r9d, 0x129
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x118]
call fcn.14001b760
mov rcx, rax
call fcn.14001b660
int3
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret