Function at 0x140013b70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r13, rcx
call fcn.140025894
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140013bb3
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x38], rdi
mov rdx, qword [r13 + 0x250]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
or rbx, 0xffffffffffffffff
cmp rcx, rsi
je 0x140013c27
cmp dword [rsi + 0x10], 0
jl 0x140013c14
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140013c14
call fcn.140009350
mov rdi, rax
mov ecx, ebx
lock xadd dword [rsi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x140013c09
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x38], rdi
jmp 0x140013c27
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140009100
mov rdi, qword [rsp + 0x38]
mov rdx, qword [r13 + 0xb8]
lea rcx, [rsp + 0x50]
call fcn.140005d30
nop
mov r8, rax
lea rdx, [0x14005cc80]
lea rcx, [rsp + 0x48]
call fcn.140007ae0
nop
mov r14, qword [rax]
mov edx, dword [r14 - 0x10]
mov dword [rsp + 0xb0], edx
mov r12, r14
sub r12, rdi
sar r12, 1
mov r15d, dword [rdi - 0x10]
lea esi, [r15 + rdx]
mov ebp, 1
mov ecx, ebp
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x140013c98
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140009290
mov rdi, qword [rsp + 0x38]
mov edx, dword [rsp + 0xb0]
cmp r12, r15
ja 0x140013ca1
lea r14, [rdi + r12*2]
movsxd rdx, edx
add rdx, rdx
lea rcx, [rdi + r15*2]
mov r9, rdx
mov r8, r14
call fcn.14003b8f0
test esi, esi
js 0x140013fdf
cmp esi, dword [rdi - 0xc]
jg 0x140013fdf
mov dword [rdi - 0x10], esi
movsxd rax, esi
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013cf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013d14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x38]
mov ecx, ebp
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x140013d31
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140009290
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [r13 + 0x248]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013fbd
call fcn.140025894
mov rdx, rax
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140013d7f
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0xa8], esi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, [0x140060820]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013f95
xor eax, eax
mov rcx, rbx
lea rdi, [0x140063790]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140063790]
lea rcx, [rsp + 0x30]
call fcn.140009100
mov rdi, qword [rsp + 0x30]
mov ecx, ebp
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 4
or eax, ecx
jge 0x140013e1e
mov edx, 4
lea rcx, [rsp + 0x30]
call fcn.140009290
mov rdi, qword [rsp + 0x30]
cmp dword [rdi - 0xc], 4
jl 0x140013f8a
mov dword [rdi - 0x10], 4
mov word [rdi + 8], 0
cmp dword [rdi - 0x10], 1
jg 0x140013e46
mov ecx, 0x80070057
call fcn.140007cd0
int3
movsxd rsi, dword [rdi - 0x10]
cmp dword [rdi - 8], 1
jle 0x140013e62
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400094d0
mov rdi, qword [rsp + 0x30]
mov word [rdi + 2], 0
test esi, esi
js 0x140013f7f
cmp esi, dword [rdi - 0xc]
jg 0x140013f7f
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], 0
cmp dword [rdi - 0x10], 2
jg 0x140013e93
mov ecx, 0x80070057
call fcn.140007cd0
int3
movsxd rsi, dword [rdi - 0x10]
cmp dword [rdi - 8], 1
jle 0x140013eaf
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400094d0
mov rdi, qword [rsp + 0x30]
mov word [rdi + 4], 0
test esi, esi
js 0x140013f74
cmp esi, dword [rdi - 0xc]
jg 0x140013f74
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], 0
cmp dword [rdi - 0x10], 3
jg 0x140013ee0
mov ecx, 0x80070057
call fcn.140007cd0
int3
movsxd rsi, dword [rdi - 0x10]
cmp dword [rdi - 8], 1
jle 0x140013efc
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400094d0
mov rdi, qword [rsp + 0x30]
mov word [rdi + 6], 0
test esi, esi
js 0x140013f69
cmp esi, dword [rdi - 0xc]
jg 0x140013f69
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], 0
mov dword [rsp + 0xa8], 3
mov esi, dword [rdi - 0x10]
sub ebp, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ebp
jge 0x140013f3d
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140009290
mov rdi, qword [rsp + 0x30]
lea eax, [rsi + rsi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0xb8]
xor r8d, r8d
lea rdx, [0x140060820]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140013f95
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013fbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140013fdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140013fea
mov ecx, 0x80070057
call fcn.140007cd0
nop
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret