Function at 0x1400369e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1a0
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov eax, dword [0x1403c0cf0]
or r13, 0xffffffffffffffff
cmp eax, r13d
jne 0x140036a3f
call fcn.14003c154
nop
test eax, eax
jne 0x140037130
call fcn.14003c2dc
test eax, eax
jne 0x140037130
mov dl, 1
mov rcx, rsi
call fcn.140035dc0
test al, al
jne 0x140037130
nop word [rax + rax]
mov rbx, r12
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x58], r12
lea rax, [0x1403d1700]
mov qword [rsp + 0x60], rax
and qword [rsp + 0x68], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rsp + 0x68], eax
test eax, eax
jne 0x140036ac0
cmp dword [rsp + 0x6c], r12d
jne 0x140036c2a
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x48], r12
movzx r9d, word [rsi + 0x18]
shr r9d, 1
and r9d, 0x10
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x58]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x70]
call fcn.140037160
mov ecx, dword [rax]
mov dword [rsp + 0x40], ecx
mov rdi, qword [rax + 8]
mov qword [rax + 8], r12
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140036b10
mov qword [rsp + 0x48], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop dword [rax]
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140036b2b
mov qword [rsp + 0x78], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rsp + 0x40], r12d
jne 0x140036d32
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
test rdi, rdi
cmovne rcx, rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140036bd4
nop
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140036c53
xor edx, edx
call fcn.140070918
mov r12, rax
test rax, rax
je 0x140036c37
nop
test rbx, rbx
je 0x140036b9e
mov rcx, rbx
call fcn.140070920
nop
mov rbx, r12
mov rcx, qword [rsp + 0x48]
test rdi, rdi
cmovne rcx, rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
xor r12d, r12d
cmp eax, 0x3f2
je 0x140036be7
cmp eax, 0x3fa
je 0x140036be7
cmp eax, 6
jne 0x140036c47
mov rax, qword [rsi + 0x10]
movzx ecx, word [rax + 0xa]
and ecx, 0xf
shl rcx, 5
lea rax, [0x140000000]
mov qword [rcx + rax + 0x3c0d00], r12
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140036c1b
mov qword [rsp + 0x48], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x60]
call fcn.1401763b8
jmp 0x140036a82
xor edx, edx
mov ecx, 0x131f4c4
call fcn.1400235f8
nop
mov dword [rsp + 0x40], 8
xor r12d, r12d
jmp 0x140036d32
test eax, eax
jne 0x140036d32
mov ecx, dword [rsp + 0x50]
test rbx, rbx
je 0x140036d32
movzx eax, word [rsi + 0x18]
and eax, 0xf
cmp dword [rsp + 0x54], eax
jne 0x140036db5
dec eax
cmp eax, 1
ja 0x140036d06
mov eax, ecx
shr rax, 1
mov word [rbx + rax*2 - 2], r12w
mov rax, rbx
mov r8, r14
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x140036ca0
add rax, 2
test edx, edx
jne 0x140036c8c
test ecx, ecx
jne 0x140036db5
mov edi, dword [rsp + 0x40]
test edi, edi
je 0x1400370fe
mov ecx, 1
lock xadd dword [0x1403d14f0], ecx
inc ecx
movabs rax, 0x47ae147ae147ae15
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x32
sub rcx, rax
movsxd rax, ecx
add rax, rax
lea rdx, [0x140000000]
mov dword [rdx + rax*8 + 0x3d11d0], edi
lea rcx, str.OrapiWriteFail:_fWriteIt__false
jmp 0x1400370f2
cmp ecx, r15d
jne 0x140036db5
mov r8d, ecx
mov rdx, r14
mov rcx, rbx
call fcn.140210b10
test eax, eax
jne 0x140036db5
mov edi, r12d
mov dword [rsp + 0x40], r12d
jmp 0x1400370fe
mov rcx, qword [rsi + 8]
movabs rax, 0xcccccccccccccccc
cmp rcx, rax
je 0x140036db5
movzx eax, word [rsi + 0x18]
and eax, 0xf
jle 0x140036da8
cmp eax, 2
jle 0x140036d8d
cmp eax, 4
je 0x140036d75
cmp eax, 0xb
jne 0x140036da8
cmp r15d, 8
je 0x140036d70
xor edx, edx
mov ecx, 0x59948f
call fcn.1400235f8
nop
cmp qword [r14], rcx
jmp 0x140036d1f
cmp r15d, 4
je 0x140036d88
xor edx, edx
mov ecx, 0x59948e
call fcn.1400235f8
nop
cmp dword [r14], ecx
jmp 0x140036d1f
cmp r15d, 2
jae 0x140036da0
xor edx, edx
mov ecx, 0x59948d
call fcn.1400235f8
nop
cmp rcx, r14
jmp 0x140036d1f
xor edx, edx
mov ecx, 0x599491
call fcn.1400235f8
nop
movzx r9d, word [rsi + 0x18]
and r9d, 0x20
or r9d, 8
shr r9d, 1
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x58]
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp - 0x80]
call fcn.140037160
mov ecx, dword [rax]
mov dword [rsp + 0x40], ecx
mov rdi, qword [rax + 8]
mov qword [rax + 8], r12
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140036e00
mov qword [rsp + 0x48], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x48], rdi
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140036e1d
mov qword [rbp - 0x78], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x48]
mov r12d, dword [rsp + 0x40]
xor ecx, ecx
test r12d, r12d
jne 0x140036fae
mov rax, qword [rsp + 0x58]
xor r12d, r12d
test rax, rax
cmovne rdi, rax
movzx r9d, word [rsi + 0x18]
and r9d, 0xf
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, 0x3f2
je 0x140036e77
cmp eax, 0x3fa
je 0x140036e77
cmp eax, 6
jne 0x140036e9a
mov rax, qword [rsi + 0x10]
movzx ecx, word [rax + 0xa]
and ecx, 0xf
shl rcx, 5
lea rax, [0x140000000]
mov qword [rcx + rax + 0x3c0d00], r12
jmp 0x140036db5
test edi, edi
je 0x1400370fe
lea rax, [0x1402dbf50]
mov qword [rbp - 0x70], rax
lea rax, str.Win32ErrorCode
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], edi
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x58], rax
lea rax, str.RegistryValueName
mov qword [rbp - 0x50], rax
mov rax, qword [rsi]
mov qword [rbp - 0x48], rax
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x78]
call fcn.140034e40
lea rcx, vtable.Mso::Logging::StructuredObject_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____0_.0
mov qword [rbp + 0x18], rcx
lea rcx, str.KeyPath
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov edi, 7
mov qword [rax + 0x18], rdi
mov word [rax], r12w
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r9, str.Failed_to_write_registry_value.
mov edx, 0x3a7
mov ecx, 0x16928cc
lea r8d, [rdi + 8]
call fcn.1401c97ec
lea rcx, [rbp + 0x28]
call fcn.14000c764
lea rcx, [rbp + 0x78]
call fcn.14000c764
mov r8d, dword [rsp + 0x40]
lea ecx, [rdi - 6]
lock xadd dword [0x1403d14f0], ecx
inc ecx
movabs rax, 0x47ae147ae147ae15
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x32
sub rcx, rax
movsxd rax, ecx
lea rcx, str.OrapiWriteFail:_RegSetValueExW
jmp 0x1400370e0
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax]
mov qword [rbp + 8], rcx
mov edi, 7
mov qword [rbp + 0x10], rdi
mov word [rbp - 8], cx
inc r13
cmp word [rdx + r13*2], cx
jne 0x140036fc6
mov r8, r13
lea rcx, [rbp - 8]
call fcn.140018284
lea rax, [0x1402dbf50]
mov qword [rbp - 0x40], rax
lea rax, str.Win32ErrorCode
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], r12d
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x28], rax
lea rax, str.RegistryValueName
mov qword [rbp - 0x20], rax
mov rax, qword [rsi]
mov qword [rbp - 0x18], rax
lea rcx, vtable.Mso::Logging::StructuredObject_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____0_.0
mov qword [rbp + 0x48], rcx
lea rax, str.KeyName
mov qword [rbp + 0x50], rax
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rbp + 8]
movups xmmword [rbp + 0x68], xmm1
xor r12d, r12d
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], rdi
mov word [rbp - 8], r12w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.Failed_to_open_registry_key.
mov edx, 0x3a7
mov ecx, 0x16928cd
lea r8d, [r12 + 0xf]
call fcn.1401c97ec
lea rcx, [rbp + 0x58]
call fcn.14000c764
lea rcx, [rbp - 8]
call fcn.14000c764
mov r8d, dword [rsp + 0x40]
lea ecx, [r12 + 1]
lock xadd dword [0x1403d14f0], ecx
inc ecx
movabs rax, 0x47ae147ae147ae15
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x32
sub rcx, rax
movsxd rax, ecx
lea rcx, str.OrapiWriteFail:_TryOpenKey_in_WriteValue
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x140000000]
add rax, rax
mov dword [rdx + rax*8 + 0x3d11d0], r8d
mov qword [rdx + rax*8 + 0x3d11d8], rcx
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140037114
mov qword [rsp + 0x48], r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x60]
call fcn.1401763b8
test rbx, rbx
je 0x14003712c
mov rcx, rbx
call fcn.140070920
nop
mov eax, edi
jmp 0x140037132
xor eax, eax
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret