Function at 0x140038ad8
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor r12d, r12d
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
mov edi, r9d
lea rax, [rbp + 7]
mov qword [rbp - 1], r12
mov qword [rsp + 0x38], rax
lea r9, [rbp - 9]
lea rax, [rbp + 0x67]
mov qword [rbp - 0x11], r12
mov qword [rsp + 0x30], rax
mov r14, r8
lea rax, [rbp + 0x17]
mov qword [rbp - 9], r12
mov qword [rsp + 0x28], rax
lea r8, [rbp - 1]
lea rax, [rbp + 0xf]
mov qword [rbp + 0xf], r12
mov rcx, rdx
mov qword [rsp + 0x20], rax
mov ebx, r12d
mov qword [rbp + 0x17], r12
mov dword [rbp + 0x67], r12d
mov dword [rbp - 0x19], r12d
mov qword [rbp + 7], r12
call fcn.140039158
mov r13, qword [rbp + 0xf]
mov rsi, qword [rbp + 0x17]
cmp qword [rbp - 1], r12
je 0x140038cf6
cmp qword [rbp - 9], r12
je 0x140038cf6
mov rdx, qword [rbp - 9]
lea rax, [rbp - 0x11]
mov rcx, qword [rbp - 1]
lea r15d, [r12 + 3]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140038cf6
test edi, edi
je 0x140038fa1
mov rdi, qword [rbp + 7]
test rsi, rsi
jne 0x140038c18
test rdi, rdi
jne 0x140038c18
mov rcx, qword [rbp - 0x11]
lea rax, [0x1400486c8]
mov dword [rsp + 0x28], 2
lea r9d, [r12 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140038ce3
mov r14d, dword [rbp + 0x67]
test r14b, 2
je 0x140038c4d
mov rcx, qword [rbp - 0x11]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140038cdf
mov eax, r14d
sub eax, 1
je 0x140038f84
sub eax, 2
je 0x140038f84
sub eax, 5
je 0x140038d8c
sub eax, 0xfff9
je 0x140038d5c
sub eax, 2
je 0x140038d5c
sub eax, 0xfffd
je 0x140038d3e
sub eax, 2
je 0x140038d3e
cmp eax, 0x20006
je 0x140038d8c
test rsi, rsi
je 0x140038cdf
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x140038ca7
mov r9d, 1
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r14, qword [rbp + 0x77]
mov edi, dword [rbp + 0x7f]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x140038d1d
test r13, r13
jne 0x140038d1d
test rsi, rsi
jne 0x140038d1d
cmp qword [rbp - 9], r12
je 0x140038d1d
cmp qword [rbp - 1], r12
je 0x140038d1d
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call fcn.14001ca78
test ebx, ebx
je 0x140038fec
test edi, edi
jne 0x140038fc4
cmp ebx, 2
jne 0x140038fc4
mov ebx, r12d
jmp 0x140038fec
test rsi, rsi
je 0x140038cdf
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x140038d47
mov r9d, 2
jmp 0x140038cb7
test rsi, rsi
je 0x140038cdf
mov rcx, rsi
call fcn.14001e4e8
mov dword [rbp + 0x67], eax
mov r9d, 4
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x140038cc7
test rsi, rsi
je 0x140038cdf
or rdi, 0xffffffffffffffff
mov dword [rbp + 0x67], r12d
mov dword [rbp - 0x19], 7
bt r14d, 0x12
jae 0x140038efc
mov rcx, qword [rbp - 0x11]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140038efc
cmp dword [rbp - 0x19], 7
jne 0x140038efc
mov rcx, rdi
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x140038dec
mov r15d, dword [rbp + 0x67]
mov eax, 2
shr r15, 1
add r15, 3
add r15, rcx
mul r15
cmovo rax, rdi
mov rcx, rax
call fcn.1400014a0
mov r14, rax
test rax, rax
jne 0x140038e28
lea ebx, [rax + 0xe]
jmp 0x140038efc
mov rcx, qword [rbp - 0x11]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140038ef4
xor r11d, r11d
mov r12, r14
cmp r11w, word [r14]
je 0x140038e99
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
je 0x140038ec4
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r11w
jne 0x140038e80
lea r12, [r12 + rax*2]
add r12, 2
cmp r11w, word [r12]
jne 0x140038e64
lea rdx, [r15 - 1]
mov r8, rsi
mov rcx, r12
call fcn.140010dd0
test eax, eax
js 0x140038edf
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r11w
jne 0x140038eaf
mov word [r12 + rax*2 + 2], r11w
xor r12d, r12d
jmp 0x140038eed
mov rcx, rdi
xor r12d, r12d
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x140038eca
mov rax, rdi
sub rax, rcx
add r15, rax
jmp 0x140038eed
mov rcx, r14
call fcn.140001454
xor r12d, r12d
mov r14d, r12d
test r14, r14
jne 0x140038f4c
jmp 0x140038efc
mov rcx, r14
call fcn.140001454
mov r15, rdi
inc r15
cmp word [rsi + r15*2], r12w
jne 0x140038eff
add r15, 2
mov eax, 2
mul r15
cmovo rax, rdi
mov rcx, rax
call fcn.1400014a0
mov r14, rax
test rax, rax
je 0x140038cdf
lea rdx, [r15 - 1]
mov r8, rsi
mov rcx, rax
call fcn.140010dd0
inc rdi
cmp word [r14 + rdi*2], r12w
jne 0x140038f3c
mov word [r14 + rdi*2 + 2], r12w
mov rcx, qword [rbp - 0x11]
lea eax, [r15 + r15]
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, r14
mov ebx, eax
call fcn.140001454
jmp 0x140038cdf
test rdi, rdi
je 0x140038cdf
mov eax, dword [rbp - 0x19]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
jmp 0x140038cc7
test r13, r13
je 0x140038ce6
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140038ce6
mov r8d, ebx
lea rdx, str.ERROR:_Registry_key_change_failed:_lRes__0x_x._r_n
mov ecx, 2
call fcn.140019b1c
mov r8, r14
lea rdx, str.ERROR:_Registry_transaction_failure_for:__S._r_n
mov ecx, 2
call fcn.140019b1c
lea rax, str.DELREG
mov dword [rsp + 0x20], ebx
test edi, edi
lea r8, str.ADDREG
mov r9, r14
lea rdx, str._Processed__S_line:__S__result_0x_x._r_n
cmove r8, rax
mov ecx, 4
call fcn.140019b1c
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14003902b
mov edx, 1
call fcn.140001818
cmp qword [rbp - 9], r12
je 0x14003903a
mov rcx, qword [rbp - 9]
call fcn.140001454
test r13, r13
je 0x140039047
mov rcx, r13
call fcn.140001454
test rsi, rsi
je 0x140039054
mov rcx, rsi
call fcn.140001454
test ebx, ebx
jle 0x140039061
movzx ebx, bx
or ebx, 0x80070000
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret