Function at 0x1400cf380
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [0x140376508]
cmp qword [0x140376500], rax
jne 0x1400cf3c9
xor al, al
jmp 0x1400cf9d0
mov ecx, dword [0x140376e10]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x140376538], eax
jg 0x1400cfa03
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 9], rcx
mov eax, 7
mov qword [rbp - 1], rax
mov word [rbp - 0x19], cx
mov r12, qword [0x140376500]
mov r13, qword [0x140376508]
cmp r12, r13
je 0x1400cf975
movabs r14, 0x7ffffffffffffffe
mov rdx, r12
lea rcx, [rbp + 7]
call fcn.1400cec80
nop
lea rax, [0x140376518]
cmp qword [0x140376530], 8
cmovae rax, qword [0x140376518]
mov rcx, qword [r12 + 0x10]
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x1400cf462
mov r9, qword [r12]
cmp rcx, qword [0x140376528]
jne 0x1400cf5b0
test rcx, rcx
je 0x1400cf4b4
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x1400cf5b0
sub r9, rax
cmp dx, r8w
ja 0x1400cf5b0
cmp rcx, 1
je 0x1400cf4b4
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400cf48d
jmp 0x1400cf5b0
mov rsi, qword [rbp + 0x17]
lea r15, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r15, qword [rbp + 7]
mov rdi, qword [rbp - 1]
cmp rsi, rdi
ja 0x1400cf4fa
lea rbx, [rbp - 0x19]
cmp rdi, 8
cmovae rbx, qword [rbp - 0x19]
mov qword [rbp - 9], rsi
lea r8, [rsi + rsi]
mov rdx, r15
mov rcx, rbx
call fcn.1400f9752
xor eax, eax
mov word [rbx + rsi*2], ax
jmp 0x1400cf5b0
cmp rsi, r14
ja 0x1400cf9fd
mov rbx, rsi
or rbx, 7
cmp rbx, r14
jbe 0x1400cf514
mov rbx, r14
jmp 0x1400cf535
mov rcx, rdi
shr rcx, 1
mov rax, r14
sub rax, rcx
cmp rdi, rax
jbe 0x1400cf52a
mov rbx, r14
jmp 0x1400cf535
lea rax, [rdi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x19]
call fcn.1400521e0
mov r14, rax
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + r14], ax
cmp rdi, 8
jb 0x1400cf5a2
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf59d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9b1
call fcn.1400e6a28
mov qword [rbp - 0x19], r14
movabs r14, 0x7ffffffffffffffe
mov r9, qword [rbp + 0x17]
test r9, r9
jne 0x1400cf81e
mov rdi, qword [rbp - 9]
test rdi, rdi
je 0x1400cf81e
lea r15, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r15, qword [rbp - 0x19]
mov rsi, qword [rbp + 0x1f]
cmp rdi, rsi
ja 0x1400cf60e
lea rbx, [rbp + 7]
cmp rsi, 8
cmovae rbx, qword [rbp + 7]
mov qword [rbp + 0x17], rdi
lea r8, [rdi + rdi]
mov rdx, r15
mov rcx, rbx
call fcn.1400f9752
xor eax, eax
mov word [rbx + rdi*2], ax
xor edi, edi
jmp 0x1400cf6ba
cmp rdi, r14
ja 0x1400cf9fd
mov rbx, rdi
or rbx, 7
cmp rbx, r14
jbe 0x1400cf628
mov rbx, r14
jmp 0x1400cf649
mov rcx, rsi
shr rcx, 1
mov rax, r14
sub rax, rcx
cmp rsi, rax
jbe 0x1400cf63e
mov rbx, r14
jmp 0x1400cf649
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 7]
call fcn.1400521e0
mov r14, rax
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov word [rbx + r14], di
cmp rsi, 8
jb 0x1400cf6b6
lea rdx, [rsi*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf6b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9b1
call fcn.1400e6a28
mov qword [rbp + 7], r14
mov rbx, rdi
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareApple_Inc.Internet_ServicesLogging
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400cf708
mov eax, edi
mov rbx, qword [rbp - 0x29]
test eax, eax
jne 0x1400cf80c
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400cf7cf
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 8
setae r11b
mov r10, qword [rbp - 0x19]
cmovae r9, r10
cmp rcx, 4
jne 0x1400cf779
lea rdi, [0x140273368]
mov rax, rdi
movzx edx, word [r9]
movzx r8d, word [0x140273368]
cmp dx, r8w
jb 0x1400cf779
sub r9, rdi
cmp dx, r8w
ja 0x1400cf779
cmp rcx, 1
je 0x1400cf7cf
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400cf75b
lea rcx, [rbp - 0x19]
test r11b, r11b
cmovne rcx, r10
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x1400cf793
mov rdx, qword [r12]
test rcx, rcx
je 0x1400cf7f0
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400cf7a0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400cf7ec
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x1400cf7de
mov rdx, qword [r12]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
je 0x1400cf80c
test eax, eax
je 0x1400cf80c
mov r9d, 0x40040
lea r8, str.iCloud_Logging
lea rdx, str.Unable_to_set_registry_key_to_enable_iCloudDrive_logging.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test rbx, rbx
je 0x1400cf81a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbp + 0x17]
mov rax, qword [str._3_]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400cf830
lea r10, [rbp + 7]
mov rdi, qword [rbp + 0x1f]
cmp rdi, 8
setae bl
mov r11, qword [rbp + 7]
cmovae r10, r11
cmp r9, rcx
jne 0x1400cf894
mov r8, r9
test r9, r9
je 0x1400cf92f
movzx ecx, word [r10]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400cf894
sub r10, rax
cmp cx, dx
ja 0x1400cf894
cmp r8, 1
je 0x1400cf92f
dec r8
add rax, 2
movzx ecx, word [r10 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400cf874
mov rax, qword [0x140348408]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400cf8a2
lea r8, [rbp + 7]
test bl, bl
cmovne r8, r11
cmp r9, rcx
jne 0x1400cf8ef
test r9, r9
je 0x1400cf92f
movzx ecx, word [r8]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400cf8ef
sub r8, rax
nop
cmp cx, dx
ja 0x1400cf8ef
cmp r9, 1
je 0x1400cf92f
dec r9
add rax, 2
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400cf8d0
test bl, bl
je 0x1400cf9c0
lea rdx, [rdi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x1400cf9b8
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cf9b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test bl, bl
je 0x1400cf964
lea rdx, [rdi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x1400cf95c
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf928
mov rcx, r11
call fcn.1400e6a28
add r12, 0x20
cmp r12, r13
jne 0x1400cf420
mov rax, qword [rbp - 1]
mov bl, 1
cmp rax, 8
jb 0x1400cf9cd
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf9c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cf9c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r11
call fcn.1400e6a28
xor bl, bl
mov rax, qword [rbp - 1]
jmp 0x1400cf977
call fcn.1400e6a28
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140052190
nop
lea rcx, [0x140376538]
call fcn.1400e73f8
cmp dword [0x140376538], 0xffffffff
jne 0x1400cf3f2
mov rdx, qword [0x140376500]
lea rcx, [0x140376518]
call fcn.1400591a0
lea rcx, [0x1402680c0]
call fcn.1400e7188
nop
lea rcx, [0x140376538]
call fcn.1400e7398
jmp 0x1400cf3f2