Function at 0x1400435d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
test rdx, rdx
je 0x14004387f
test r9, r9
je 0x14004387f
xor edx, edx
mov qword [rsp + 0x270], rbx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.1400514f0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x140043835
mov rcx, qword [rsp + 0x48]
mov r9d, 0xffff
mov dword [rsp + 0x40], eax
mov r8, rbp
lea rax, [rsp + 0x278]
mov dword [rsp + 0x278], 0x200
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ebx, eax
test eax, eax
je 0x1400436ba
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400436ba
mov r9, rbp
mov dword [rsp + 0x20], eax
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, ebx
test ebx, ebx
jne 0x14004382c
lea rax, [rsp + 0x278]
mov qword [rsp + 0x278], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x1400437c8
mov rsi, qword [rsp + 0x290]
test rsi, rsi
je 0x1400437a6
lea rax, [rsp + 0x50]
lea ebx, [rdi + 1]
cmp byte [rax], 0
lea rcx, [rax + 1]
mov rax, rcx
jne 0x140043731
cmp byte [rcx], 0
je 0x14004373d
cmp ebx, 0x200
jae 0x14004373d
inc ebx
jmp 0x140043720
inc ebx
cmp ebx, 0x200
jae 0x14004379f
mov rcx, qword [rsp + 0x278]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test eax, eax
je 0x1400437ab
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400437ab
mov dword [rsp + 0x28], eax
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s_and_multiSzLen___d_with_error_code_0x_08x.
mov r9, rsi
mov dword [rsp + 0x20], ebx
mov edx, 8
call fcn.140040530
jmp 0x1400437ab
mov edi, 0x7a
jmp 0x1400437ab
mov edi, 0x57
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edi
test edi, edi
je 0x14004380e
mov rcx, qword [0x1400da5d8]
jmp 0x1400437f5
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400437f3
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov rcx, qword [0x1400da5d8]
mov ebx, edi
test rcx, rcx
je 0x14004380e
mov r9d, edi
lea r8, str.CopyMultiSzRegValue:_SetMultiSzRegValue_failed_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov eax, ebx
mov rbx, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [0x1400da5d8]
jmp 0x140043862
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043860
mov r9, rdi
mov dword [rsp + 0x20], ebx
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov rcx, qword [0x1400da5d8]
mov edi, ebx
test rcx, rcx
je 0x14004387b
mov r9d, ebx
lea r8, str.CopyMultiSzRegValue:_GetMultiSzRegValue_failed_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov eax, edi
jmp 0x140043810
mov eax, 0x57
jmp 0x140043818