Function at 0x140023c10
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov r13, rcx
xor edi, edi
mov dword [rbp + 0xd8], edi
lea rax, [0x14004a808]
mov qword [rsp + 0x60], rax
lea rax, [0x14004a810]
mov qword [rsp + 0x70], rax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp], rax
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.140002020
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x78]
call fcn.140002150
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x18], edi
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.Logger.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa0]
mov dword [rsp + rcx + 0x5c], edx
mov dword [rbp - 0x10], 0x64
lea rdx, str.UpdateRegistry__
lea rcx, [rsp + 0x70]
call fcn.140001390
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
lea r12, vtable.std::ios_base.0
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
mov qword [rbp + 0xe0], rdi
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002415c
mov rsi, qword [rbp + 0xe0]
mov r15d, edi
mov qword [rbp + 0xe8], rdi
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea r14, str.11AC3232_E7D7_49CD_ABFE_501700100B3A
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [rdi + 1]
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x140023e2d
mov r15, qword [rbp + 0xe8]
call fcn.140011e50
mov dword [rax + 0x90], 0x64
lea rcx, [rax + 0x10]
lea rdx, str.Registry_is_up_to_date
call fcn.140001390
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
jmp 0x140024138
call fcn.140011e50
mov dword [rax + 0x90], 0xa
lea rcx, [rax + 0x10]
lea rdx, str.Registry_update_needed
call fcn.140001390
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
lea rax, str.APPID
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
lea r9, [rbp + 0x68]
mov edx, 0x65
lea r8d, [rdx - 0x64]
mov rcx, qword [0x14006f0b0]
call fcn.140015af0
test eax, eax
js 0x140024136
test rsi, rsi
je 0x140023ed4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002412f
mov eax, edi
test rsi, rsi
je 0x140023f18
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x50]
test eax, eax
jne 0x14002412f
mov qword [rsp + 0x58], rdi
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140024126
mov r15, qword [rsp + 0x58]
lea rdx, str.LocalService
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140011e50
mov dword [rax + 0x90], 0xa
lea rcx, [rax + 0x10]
lea r14, [r13 + 0x68]
lea rdx, str.LocalService_:
call fcn.140001390
mov rcx, rax
mov rdx, r14
call fcn.14000de10
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
test r14, r14
je 0x140024035
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [r14 + rax*2], 0
jne 0x140024000
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r15
call fcn.140022730
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140011e50
mov dword [rax + 0x90], 0xa
lea rcx, [rax + 0x10]
lea rdx, str.Registering_Server
call fcn.140001390
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r13
call fcn.140021ed0
test eax, eax
js 0x14002413a
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140011e50
mov dword [rax + 0x90], 0x64
lea rcx, [rax + 0x10]
lea rdx, str.UpdateRegistry___done
call fcn.140001390
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140008ac0
movzx edx, ax
mov rcx, rbx
call fcn.1400084a0
mov rcx, rbx
call fcn.140007ec0
lea rcx, [rbp]
call fcn.14000e9d0
nop
mov qword [rbp], r12
lea rcx, [rbp]
call fcn.140025c9c
nop
jmp 0x14002413c
mov ecx, eax
call fcn.140012bd0
jmp 0x14002413a
mov ecx, eax
call fcn.140012bd0
mov edi, eax
mov eax, edi
mov edi, eax
test r15, r15
je 0x14002414a
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140024158
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x140024163
mov dword [r13 + 0x27c], eax
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret