Function at 0x140007320
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xe0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140024050]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rdx
mov rbp, rcx
xor r12d, r12d
mov rbx, r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWordcraft_International_LtdUMP3_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400073bc
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400073bc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWordcraft_International_LtdUMP3_DevicesPorts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140007430
mov eax, r12d
test rbx, rbx
je 0x140007416
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x140007430
test rbx, rbx
je 0x140007430
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREWordcraft_International_LtdUMP3_DevicesPorts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400075eb
mov eax, r12d
test rbx, rbx
je 0x140007475
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rbx
test eax, eax
jne 0x1400075eb
mov rdi, r12
mov qword [rsp + 0x58], r12
mov rdx, rbp
mov rcx, rbx
call fcn.140007140
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400074c9
mov rdi, qword [rsp + 0x50]
jmp 0x140007513
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400075cb
mov rdi, qword [rsp + 0x58]
mov dword [rsp + 0x58], 0x60
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Port
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, word [rsp + 0x70]
test eax, eax
cmovne cx, r12w
mov word [rsp + 0x70], cx
mov rax, rbp
lea r9, [rsp + 0x70]
sub r9, rbp
nop
nop
movzx r8d, word [rax]
movzx ecx, word [rax + r9]
sub r8d, ecx
jne 0x140007586
add rax, 2
test ecx, ecx
jne 0x140007570
test r8d, r8d
je 0x1400075ba
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.Port
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x1400075cb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
test rbx, rbx
je 0x1400075dc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
test rdi, rdi
je 0x1400075eb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rbx, rbx
je 0x1400075fe
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x140007601
or eax, 0xffffffff
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140009b60
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret