Function at 0x140071e50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rdi
push r12
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
xor r12d, r12d
mov qword [rbp - 0x49], r12
mov rdi, rdx
mov r15, rcx
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
test rcx, rcx
je 0x14007213a
cmp qword [rcx + 8], r12
je 0x14007213a
test rdx, rdx
je 0x14007213a
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x14007213a
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x14007213a
cmp qword [rdi + 0x80], r12
je 0x14007213a
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r12b
jne 0x140071ee0
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], r12b
jne 0x140071ef0
inc rax
add rax, rcx
cmp rax, 0x7fff
ja 0x14007213a
mov qword [rsp + 0xf0], rbx
mov rcx, rdx
mov qword [rsp + 0xb0], r14
call fcn.14006b870
mov r14, rax
test rax, rax
jne 0x140071f59
lea eax, [r14 + 6]
mov rbx, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0xb8
pop r15
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rdi + 0x50]
mov qword [rsp + 0xf8], rsi
call fcn.14006b870
mov rsi, rax
test rax, rax
jne 0x140071f7a
lea ebx, [rax + 6]
jmp 0x14007210c
mov r9, rsi
lea rdx, str.Restoring_registry_value_in_parentKey:___s___with_valueName:___s_
mov r8, r14
mov ecx, 1
call fcn.14006e290
lea r9, [rbp - 0x49]
mov qword [rsp + 0x20], r12
mov r8d, 0x2001f
mov rcx, r14
call fcn.140070d90
mov ebx, eax
test eax, eax
jne 0x14007210c
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 0x39]
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140071ffe
mov r9, rsi
lea rdx, str.The_registry_value_to_be_restored_already_exists__parentKey:___s___valueName:___s__
mov r8, r14
lea ecx, [rbx + 2]
call fcn.14006e290
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.140071780
mov ebx, eax
jmp 0x14007210c
mov rcx, qword [rdi + 0x80]
lea rdx, [rbp - 0x41]
mov r8d, 0xa
call fcn.1403062f0
mov rcx, qword [rdi + 0x80]
mov dword [rbp - 0x39], eax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r12b
jne 0x140072025
add rax, rcx
cmp qword [rbp - 0x41], rax
je 0x140072041
mov ebx, 3
jmp 0x14007210c
lea rax, [0x14006cf40]
mov qword [rbp - 1], 0xffffffffffffffff
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x29]
lea rax, [0x14006ced0]
mov qword [rbp + 7], r12
mov qword [rbp - 0x19], rax
lea rax, [0x14006cf50]
mov qword [rbp - 0x11], rax
lea rax, [0x14006cfc0]
mov qword [rbp - 9], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x1f], rsi
call fcn.140070c50
test al, al
jne 0x14007209d
mov ebx, 3
jmp 0x1400720fb
xor r9d, r9d
lea rdx, [rbp - 0x29]
mov r8, rdi
mov rcx, r15
call fcn.14006c380
mov ebx, eax
test eax, eax
jne 0x1400720fb
mov eax, dword [rbp + 0xf]
xor r8d, r8d
mov r9d, dword [rbp - 0x39]
mov rdx, qword [rbp + 0x1f]
mov rcx, qword [rbp + 0x17]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400720fb
mov ebx, 3
mov dword [rsp + 0x20], eax
mov ecx, ebx
lea rdx, str.Unable_to_set_registry_value__parentKey:___s___valueName:___s___winError:__d_
mov r9, rsi
mov r8, r14
call fcn.14006e290
mov rcx, qword [rbp + 7]
call fcn.1402ff780
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14007211b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.1402ff780
mov rcx, rsi
call fcn.1402ff780
mov rsi, qword [rsp + 0xf8]
mov eax, ebx
jmp 0x140071f2f
mov eax, 1
jmp 0x140071f3f