Function at 0x140021df0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_280], rax
mov r14, r8
mov r13, rdx
mov rbx, rcx
mov qword [r11 - 0x50], rdx
lea rcx, [r11 - 0xa0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov rdx, r13
lea rcx, [rsp + 0xb8]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
lea rdx, str.Objects
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov r8, rax
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.140023c50
test al, al
jne 0x140021eb0
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, r13
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14002254c
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140023f30
test al, al
jne 0x140021f73
cmp byte [rbx + 0x1010], al
je 0x140021efc
lea r8, [rbx + 0x10]
lea edx, [r15 + 4]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140021efc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140021f12
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140021f45
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x140021f3d
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add rbx, 0x28
cmp rbx, rdi
jne 0x140021f26
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, r13
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14002254c
cmp byte [rbx + 0x1010], 0
je 0x140021f9a
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140021f9a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140021faf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12d, r15d
movabs rax, 0x6666666666666667
nop
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140021fd4
mov rdx, r15
jmp 0x140021feb
mov rcx, rsi
sub rcx, rdi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov ebp, r12d
cmp rbp, rdx
jae 0x1400224fa
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
lea rdx, [0x1403b5bbc]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x140022068
mov rcx, qword [rsp + 0x40]
sub rcx, r8
movabs rsi, 0x6666666666666667
mov rax, rsi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbp, rdx
jb 0x14002207d
jmp 0x140022072
movabs rsi, 0x6666666666666667
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r8, qword [rsp + 0x38]
lea rax, [rbp + rbp*4]
lea rdx, [r8 + rax*8]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
lea rdx, str.Description
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov r8, rax
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.140023c50
test al, al
jne 0x1400220e5
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400223fe
mov dword [rsp + 0x54], r15d
lea rdx, str.Type
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rdi, rax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x58], 4
cmp qword [rax + 0x20], 8
jb 0x140022119
mov rdx, qword [rax + 8]
jmp 0x14002211d
lea rdx, [rax + 8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002215a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x14002216a
cmp dword [rsp + 0x50], 4
je 0x1400221ba
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
cmp byte [rbx + 0x1010], 0
je 0x140022191
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140022191
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400221a7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400223fe
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
cmp byte [rbx + 0x1010], 0
je 0x1400221ea
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x1400221ea
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400221ff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rsp + 0x54], 0x10200003
je 0x14002221c
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400223fe
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
lea rdx, [0x1403b5bbc]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x140022272
mov rcx, qword [rsp + 0x40]
sub rcx, r8
mov rax, rsi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbp, rdx
jb 0x14002227d
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r8, qword [rsp + 0x38]
lea rax, [rbp + rbp*4]
lea rdx, [r8 + rax*8]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
lea rdx, str.Elements12000002
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov r8, rax
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.140023c50
test al, al
jne 0x1400222e5
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400223fe
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, str.Element
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
lea r8, [rsp + 0xe0]
mov rdx, rax
mov rcx, rbx
call fcn.140024200
test al, al
jne 0x14002237b
cmp byte [rbx + 0x1010], al
je 0x140022343
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140022343
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140022359
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400223fe
cmp byte [rbx + 0x1010], 0
je 0x1400223a2
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x1400223a2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400223b7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0xe0]
call fcn.14017d4f0
xor r8d, r8d
lea rdx, str.windows_system32winload
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_unsigned_long_long_unsigned___int64____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const____ptr64__unsigned_long_long_unsigned___int64__const___ptr64]
test rax, rax
je 0x140022411
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add r12d, 1
movabs rax, 0x6666666666666667
jmp 0x140021fc0
lea rdx, [rsp + 0xb8]
mov rcx, r14
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
lea rdx, [0x1403b5bbc]
mov rcx, r14
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov ebx, r12d
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x140022460
mov rcx, qword [rsp + 0x40]
sub rcx, r8
mov rax, rsi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jb 0x14002246b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r8, qword [rsp + 0x38]
lea rax, [rbx + rbx*4]
lea rdx, [r8 + rax*8]
mov rcx, r14
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400224cf
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x1400224c7
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add rbx, 0x28
cmp rbx, rdi
jne 0x1400224b0
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, r13
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
jmp 0x14002254c
test rdi, rdi
je 0x140022523
cmp rdi, rsi
je 0x14002251b
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add rdi, 0x28
cmp rdi, rsi
jne 0x140022504
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, r13
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_280]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + reloc.MFC80U.DLL_Ordinal_376]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret