Function at 0x180012f88
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1800240b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r12d, r12d
mov rsi, rdx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x34], r12d
mov edi, r12d
mov r14d, r12d
test rcx, rcx
je 0x1800131a4
test rdx, rdx
je 0x1800131a4
lea rdx, [rsp + 0x50]
call fcn.18001e7dc
mov ebx, eax
test eax, eax
jne 0x1800131d7
lea rcx, [rbp - 0x60]
mov r8, rsi
mov edx, 0x104
call fcn.1800035e0
test eax, eax
js 0x18001302e
lea rcx, [rbp - 0x60]
call fcn.18001a6d0
test eax, eax
je 0x18001302e
lea rcx, [rbp - 0x60]
call fcn.18001a410
mov r15, rax
test rax, rax
jne 0x180013038
mov ebx, 0x57
jmp 0x1800131b7
lea rax, [rsp + 0x40]
lea rdx, [0x180020d30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1800131b7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea r9d, [rbx + 3]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1800131b7
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r15 + rsi*2], r12w
jne 0x180013098
inc esi
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [0x180020dc0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1800130e7
cmp dword [rsp + 0x34], 7
jne 0x18001314b
test rdi, rdi
jne 0x18001315d
lea ebx, [rdi + 0x7a]
cmp ebx, 0x7a
jne 0x180013125
mov eax, dword [rsp + 0x30]
lea r14d, [rax + rsi*2]
mov dword [rsp + 0x30], r14d
test rdi, rdi
je 0x18001310c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14d, dword [rsp + 0x30]
mov edx, r14d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1800130a4
lea ebx, [rax + 0xe]
cmp ebx, 2
jne 0x180013159
lea r14d, [rsi*2 + 2]
lea ecx, [rbx + 0x3e]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x180013152
lea ebx, [rax + 0xe]
jmp 0x1800131b7
mov ebx, 0xd
jmp 0x1800131a9
mov word [rax], r12w
mov ebx, r12d
test ebx, ebx
jne 0x1800131a9
mov r8, r15
mov edx, r14d
mov rcx, rdi
call fcn.18001e370
mov ebx, eax
cmp eax, 0xb7
jne 0x180013179
mov ebx, r12d
jmp 0x1800131a9
test eax, eax
jne 0x1800131a9
mov rcx, qword [rsp + 0x38]
lea r9d, [rax + 7]
lea rdx, [0x180020dc0]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x1800131a9
mov ebx, 0x57
test rdi, rdi
je 0x1800131b7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800131c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800131d7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180001ac0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret