Function at 0x140002444
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, rdx
mov rbx, rcx
lea rax, [r11 + 0x18]
mov rdx, rcx
mov rcx, qword [r12]
mov qword [r11 - 0x50], rax
xor r13d, r13d
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x58], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r14d, [r13 + 2]
mov edi, eax
cmp eax, r13d
je 0x140002585
cmp eax, r14d
je 0x1400024b3
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000287e
xor eax, eax
or rbp, 0xffffffffffffffff
lea r15, str.diskpt
mov rdi, r15
mov rcx, rbp
repne scasw ax, word [rdi]
mov rax, r14
not rcx
dec rcx
add rcx, r14
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.140008620
mov rcx, rbp
mov rdi, r15
mov rbx, rax
xor eax, eax
xor edx, edx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx + 2]
mov rcx, rbx
call fcn.14001da40
xor eax, eax
mov rcx, rbp
mov rdi, r15
mov r8, r15
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
add rdx, r14
call fcn.14001d538
mov rdx, qword [rsp + 0x80]
xor eax, eax
mov rcx, rbp
mov rdi, rbx
lea r9d, [rbp + 8]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea rax, [rbx + rcx*2]
mov rcx, qword [r12]
mov word [rax], r13w
sub rax, rbx
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x90], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
mov edi, eax
cmp eax, r13d
je 0x14000286a
call fcn.140008628
jmp 0x14000249a
xor eax, eax
or rbp, 0xffffffffffffffff
lea r15, str.diskpt
mov rdi, r15
mov rcx, rbp
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x90]
shr rax, 1
not rcx
lea rdx, [rcx + rax + 1]
mov rax, r14
mul rdx
cmovo rax, rbp
mov rcx, rax
call fcn.140008620
mov edx, dword [rsp + 0x90]
mov rcx, rbp
mov r13, rax
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8, [rdx + rcx*2 + 2]
xor edx, edx
mov rcx, r13
call fcn.14001da40
mov rcx, qword [r12]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x28], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
cmp eax, ecx
je 0x140002628
mov rcx, r13
call fcn.140008628
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400024ac
mov rbx, r13
cmp word [r13], cx
je 0x1400026a4
mov rdx, r15
mov rcx, rbx
call fcn.14001d1ac
xor r8d, r8d
cmp eax, r8d
jne 0x14000268c
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea rcx, [rbx + rcx*2]
movzx eax, word [rcx]
mov word [rdx], ax
cmp word [rcx], r8w
jne 0x14000266d
cmp word [rcx - 2], r8w
je 0x140002675
add rdx, r14
add rcx, r14
jmp 0x14000265a
movzx eax, word [rcx]
mov word [rdx], ax
sub rdx, r13
sar rdx, 1
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x90], eax
xor eax, eax
mov rdi, rbx
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], r8w
jne 0x140002632
xor eax, eax
mov rcx, rbp
mov rdi, r15
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x90]
shr rax, 1
not rcx
lea rcx, [rcx + rax + 1]
mov rax, r14
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.140008620
mov edx, dword [rsp + 0x90]
mov rcx, rbp
mov rbx, rax
mov qword [rsp + 0x30], rax
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8, [rdx + rcx*2 + 2]
xor edx, edx
mov rcx, rbx
call fcn.14001da40
xor edi, edi
mov dword [rsp + 0x98], edi
cmp word [r13], di
je 0x1400027c8
mov r12, r13
lea rdx, [0x14004376c]
mov rcx, r12
call fcn.14001d1ac
cmp eax, edi
jne 0x140002766
xor eax, eax
mov rcx, rbp
mov rdi, r15
repne scasw ax, word [rdi]
mov r8, r15
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
add rdx, r14
call fcn.14001d538
mov rdi, rbx
xor eax, eax
mov rcx, rbp
mov dword [rsp + 0x98], 1
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
xor eax, eax
mov rcx, rbp
mov rdi, r12
repne scasw ax, word [rdi]
mov r8, r12
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
add rdx, r14
call fcn.14001d538
xor eax, eax
mov rdi, r12
mov rcx, rbp
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea r12, [r12 + rcx*2]
mov rcx, rbp
repne scasw ax, word [rdi]
xor edi, edi
not rcx
lea rbx, [rbx + rcx*2]
cmp word [r12], di
jne 0x140002716
mov edx, dword [rsp + 0x98]
mov r12, qword [rsp + 0x88]
cmp edx, edi
jne 0x1400027fc
xor eax, eax
mov rcx, rbp
mov rdi, r15
repne scasw ax, word [rdi]
mov r8, r15
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
add rdx, r14
call fcn.14001d538
xor eax, eax
mov rdi, rbx
mov rcx, rbp
repne scasw ax, word [rdi]
xor edi, edi
not rcx
lea rbx, [rbx + rcx*2]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [r12]
mov word [rbx], di
mov rdi, qword [rsp + 0x30]
mov r9d, 7
xor r8d, r8d
sub rbx, rdi
sar rbx, 1
lea eax, [rbx + rbx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x90], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
cmp eax, ecx
mov rcx, rdi
mov ebx, eax
je 0x140002862
call fcn.140008628
mov rcx, r13
call fcn.140008628
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
jmp 0x1400024a6
call fcn.140008628
mov rcx, r13
call fcn.140008628
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret