Function at 0x140026340
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x14003c150]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov dword [rsp + 0x70], 1
call fcn.140001540
mov rcx, rax
test rax, rax
je 0x140026667
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
mov dword [rsp + 0x70], 1
xor r15d, r15d
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x68], 0x400
lea rax, [rbp - 0x80]
mov qword [rbp - 0x70], rax
call fcn.140001540
mov rcx, rax
test rax, rax
je 0x140026672
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rdx, str.CRLog
lea rcx, [rbp - 0x80]
cmp rdx, 0x10000
jae 0x1400263fc
movzx edx, dx
call fcn.14000acd0
jmp 0x140026402
call fcn.14000a8c0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x78]
call fcn.140026690
test al, al
jne 0x140026420
mov rcx, r14
call fcn.14000a120
jmp 0x14002662d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.GUID
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002648c
lea r8, [rbp - 0x40]
lea rdx, [0x140030894]
mov rcx, r14
call fcn.14000b540
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.14000adf0
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
call fcn.140026850
test al, al
je 0x14002648c
mov rcx, rbx
jmp 0x140026626
call fcn.140001540
mov rcx, rax
test rax, rax
je 0x14002667d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [0x140030068]
lea rcx, [rsp + 0x78]
cmp rdx, 0x10000
jae 0x1400264cb
movzx edx, dx
call fcn.14000acd0
jmp 0x1400264d1
call fcn.14000a8c0
nop
mov dword [rsp + 0x70], 3
lea rcx, [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x14002654f
movzx eax, byte [rbp - 0x49]
movzx ecx, byte [rbp - 0x4a]
movzx edx, byte [rbp - 0x4b]
movzx r8d, byte [rbp - 0x4c]
movzx r10d, byte [rbp - 0x4d]
movzx r11d, byte [rbp - 0x4e]
movzx ebx, byte [rbp - 0x4f]
movzx edi, byte [rbp - 0x50]
movzx esi, word [rbp - 0x52]
movzx r9d, word [rbp - 0x54]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r8d, dword [rbp - 0x58]
lea rdx, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
lea rcx, [rsp + 0x78]
call fcn.14000b540
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140009f30
mov dword [rsp + 0x70], 1
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026587
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [r14]
mov edx, dword [rax - 0x10]
lea edi, [rdx*2 + 1]
cmp dword [rax - 8], 1
jle 0x1400265a2
mov rcx, r14
call fcn.14000b120
mov rax, qword [r14]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.GUID
mov rdi, qword [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140026623
mov rcx, qword [r14]
lea rdx, [rcx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140026623
mov eax, dword [rdx + 0x10]
shr eax, 0x1f
test al, al
je 0x1400265fc
cmp dword [rcx - 0xc], 0
jl 0x14002665c
mov dword [rcx - 0x10], r15d
mov rax, qword [r14]
mov word [rax], r15w
jmp 0x140026623
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002660f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
mov rdi, qword [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, r14
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1400286a0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001300
nop
mov ecx, 0x80004005
call fcn.140001300
nop
mov ecx, 0x80004005
call fcn.140001300
nop
mov ecx, 0x80004005
call fcn.140001300
int3