Function at 0x140116000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x298]
sub rsp, 0x398
mov r13, rdx
lea rcx, [rbp - 0x48]
lea rdx, [0x14015bca0]
xor r12d, r12d
call fcn.14010a000
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, qword [rbp - 0x48]
mov ebx, eax
add rdx, 0xffffffffffffffe8
or r15, 0xffffffffffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
lea rdi, vtable.ATL::CAtlStringMgr.0
sub ecx, 1
jg 0x14011608f
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
cmp rcx, rdi
jne 0x1401165eb
mov rcx, qword [r8 + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x1401160fc
lea rdx, [0x14015bca0]
lea rcx, [rbp - 0x40]
call fcn.14010a000
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov rdx, qword [rbp - 0x40]
test eax, eax
mov eax, r15d
sete bl
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401160f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x1401165f5
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
je 0x140116107
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x40], 1
mov r8d, 0x104
mov dword [rsp + 0x68], 0x104
lea rcx, [rbp + 0x180]
call fcn.14009c0b0
lea rdx, [0x14015bca0]
lea rcx, [rbp - 0x38]
call fcn.14010a000
lea rcx, [rsp + 0x68]
mov r8, r13
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x40]
lea rcx, [rbp + 0x180]
mov rdx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rdx, qword [rbp - 0x38]
mov ecx, r15d
add rdx, 0xffffffffffffffe8
mov ebx, eax
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401161a6
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
cmp rcx, rdi
jne 0x1401165fd
mov rcx, qword [r8 + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x3d8], rsi
mov qword [rsp + 0x390], r14
cmp ebx, 2
jne 0x140116345
xor ecx, ecx
call fcn.1400a8d70
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
xor eax, eax
mov byte [rsp + 0x78], r12b
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x79], rax
mov qword [rbp - 0x7f], rax
mov qword [rbp - 0x77], rax
mov dword [rbp - 0x6f], eax
mov word [rbp - 0x6b], ax
mov byte [rbp - 0x69], al
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x50]
mov edi, r15d
lea rcx, [rbp + 0x10]
cmove edi, dword [rbp - 0x14]
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x50]
mov esi, r15d
lea rcx, [rbp + 0x38]
cmove esi, dword [rbp + 0x18]
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x50]
mov r14d, r12d
lea rcx, [rbp + 0x60]
cmove r14d, dword [rbp + 0x44]
call fcn.1400a9d14
test eax, eax
jne 0x140116248
mov ebx, dword [rbp + 0x70]
inc ebx
jmp 0x14011624b
mov ebx, r12d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x88]
call fcn.1400a9d14
test eax, eax
jne 0x14011626e
mov r12d, dword [rbp + 0x9c]
add r12d, 0x76c
mov dword [rsp + 0x38], edi
lea r8, str._4.4d_2.2d_2.2d_2.2d_2.2d
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x28], r14d
mov r9d, r12d
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x20], ebx
call fcn.140021870
lea rdx, [0x14015bca0]
mov dword [rsp + 0x40], 1
lea rcx, [rbp - 0x30]
call fcn.14010a000
lea r8, [rsp + 0x78]
mov rdx, r15
nop dword [rax + rax]
inc rdx
cmp byte [r8 + rdx], 0
jne 0x1401162c0
mov r9d, dword [rsp + 0x40]
mov r8, r13
mov dword [rsp + 0x28], edx
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14011633b
mov rcx, qword [rdx]
lea r9, vtable.ATL::CAtlStringMgr.0
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r9
jne 0x140116607
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x1401165ca
mov eax, 1
jmp 0x1401165ca
test ebx, ebx
jne 0x1401165c7
lea rcx, [rbp + 0x180]
mov rax, r15
inc rax
cmp byte [rcx + rax], r12b
jne 0x140116357
cmp rax, 0xc
jb 0x1401165c7
xor eax, eax
lea rcx, [rbp + 0x2e0]
mov dword [rsp + 0x61], eax
mov eax, dword [rbp + 0x180]
mov dword [rsp + 0x60], eax
xor eax, eax
mov word [rsp + 0x49], ax
movzx eax, word [rbp + 0x184]
mov word [rsp + 0x48], ax
xor eax, eax
mov word [rsp + 0x45], ax
movzx eax, word [rbp + 0x186]
mov word [rsp + 0x44], ax
xor eax, eax
mov word [rbp + 0x2e9], ax
movzx eax, word [rbp + 0x188]
mov word [rbp + 0x2e8], ax
xor eax, eax
mov word [rbp + 0x2e1], ax
movzx eax, word [rbp + 0x18a]
mov word [rbp + 0x2e0], ax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rbp + 0x2e8]
mov r14d, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x44]
mov esi, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x48]
mov edi, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x28]
mov edx, eax
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8d, ebx
call fcn.1400208e0
xor ecx, ecx
call fcn.1400a8d70
movsxd rcx, dword [rbp + 0x2d0]
imul rdx, rcx, 0x3c
mov qword [rsp + 0x58], rax
sub rax, rdx
cmp rax, qword [rbp - 0x28]
jle 0x1401165c7
xor eax, eax
mov byte [rbp - 0x68], r12b
lea rdx, [rsp + 0x58]
mov qword [rbp - 0x67], rax
lea rcx, [rbp + 0xb0]
mov qword [rbp - 0x5f], rax
mov qword [rbp - 0x57], rax
mov dword [rbp - 0x4f], eax
mov word [rbp - 0x4b], ax
mov byte [rbp - 0x49], al
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x58]
mov edi, r15d
lea rcx, [rbp + 0xd8]
cmove edi, dword [rbp + 0xb4]
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x58]
mov esi, r15d
lea rcx, [rbp + 0x100]
cmove esi, dword [rbp + 0xe0]
call fcn.1400a9d14
test eax, eax
lea rdx, [rsp + 0x58]
mov r14d, r12d
lea rcx, [rbp + 0x128]
cmove r14d, dword [rbp + 0x10c]
call fcn.1400a9d14
test eax, eax
jne 0x1401164e3
mov ebx, dword [rbp + 0x138]
inc ebx
jmp 0x1401164e6
mov ebx, r12d
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x150]
call fcn.1400a9d14
test eax, eax
jne 0x140116509
mov r12d, dword [rbp + 0x164]
add r12d, 0x76c
mov dword [rsp + 0x38], edi
lea r8, str._4.4d_2.2d_2.2d_2.2d_2.2d
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], r14d
mov r9d, r12d
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x20], ebx
call fcn.140021870
lea rdx, [0x14015bca0]
mov dword [rsp + 0x40], 1
lea rcx, [rbp - 0x20]
call fcn.14010a000
lea rdx, [rbp - 0x68]
mov rcx, r15
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140116551
mov r9d, dword [rsp + 0x40]
mov r8, r13
mov rdx, qword [rax]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14011633b
mov rcx, qword [rdx]
lea r9, vtable.ATL::CAtlStringMgr.0
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r9
jne 0x140116607
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x1401165ca
mov eax, r12d
mov r14, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x3d8]
add rsp, 0x398
pop r15
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov rcx, r8
call rax
jmp 0x14011608f
call r8
jmp 0x1401160f8
mov rcx, r8
call rax
jmp 0x1401161a6
call r8
jmp 0x14011633b