Function at 0x1400a0380
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
xor r12d, r12d
mov ebp, r8d
lea r13, [0x140104c70]
mov r14, r9
mov rbx, rdx
mov r15, rcx
test rdx, rdx
je 0x1400a05b0
test r8d, r8d
jne 0x1400a03d5
xor r8d, r8d
mov edx, 1
call fcn.140011fe0
jmp 0x1400a0880
mov ecx, dword [rdx + 0x10]
cmp ebp, 4
je 0x1400a052f
test ecx, ecx
je 0x1400a0508
sub ecx, 1
je 0x1400a04f0
sub ecx, 1
je 0x1400a047d
cmp ecx, 2
je 0x1400a0408
mov rsi, r13
jmp 0x1400a0519
mov rsi, qword [rdx]
cmp byte [rsi + 0x23], r12b
jne 0x1400a0424
mov rcx, qword [rsi + 0x10]
mov edx, 1
call fcn.1400079d4
mov rsi, rax
jmp 0x1400a044e
test byte [rsi + 0x21], 1
je 0x1400a0432
mov rcx, rsi
call fcn.140007840
cmp byte [rsi + 0x23], 3
jb 0x1400a044a
cmp byte [rsi + 0x21], r12b
jl 0x1400a044a
mov rcx, rsi
call fcn.1400a84d0
and byte [rsi + 0x21], 0x7f
mov rsi, qword [rsi + 8]
mov rbx, qword [rbx]
cmp byte [rbx + 0x23], r12b
jne 0x1400a0463
mov rcx, qword [rbx + 0x10]
call fcn.1400056d0
mov rbx, rax
test byte [rbx + 0x21], 1
je 0x1400a0471
mov rcx, rbx
call fcn.140007840
mov rbx, qword [rbx + 0x10]
shr rbx, 1
jmp 0x1400a05c0
movsd xmm3, qword [rdx]
lea r8, str._.17g
movq r9, xmm3
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.1400a4cd0
lea rdx, [0x140113ed4]
movsxd rbx, eax
lea rcx, [rsp + 0x60]
call fcn.1400d6dbc
cmp rax, rbx
jne 0x1400a04e3
lea ecx, [rbx + 3]
cmp ecx, 0x100
jg 0x1400a04e3
movzx eax, word [rsp + rbx*2 + 0x5e]
sub ax, 0x30
cmp ax, 9
ja 0x1400a04e3
mov dword [rsp + rbx*2 + 0x60], 0x30002e
add ebx, 2
movsxd rax, ebx
mov word [rsp + rax*2 + 0x60], r12w
movsxd rbx, ebx
lea rsi, [rsp + 0x60]
jmp 0x1400a05c0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x60]
mov r8d, 0xa
call fcn.1400cd540
mov rsi, rax
jmp 0x1400a0519
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
cmp rbx, 0xffffffffffffffff
jne 0x1400a05c0
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r12w
jne 0x1400a0520
jmp 0x1400a05c0
mov edx, ecx
test ecx, ecx
je 0x1400a0552
sub edx, 1
je 0x1400a0568
sub edx, 1
je 0x1400a0568
cmp edx, 2
jne 0x1400a062d
mov rcx, qword [rbx]
call fcn.140064b80
jmp 0x1400a0566
mov rcx, qword [rbx]
mov r9d, 1
mov edx, r9d
xor r8d, r8d
call fcn.1400a4a80
mov ecx, eax
test ecx, ecx
je 0x1400a062d
mov ecx, dword [rbx + 0x10]
test ecx, ecx
je 0x1400a05a1
sub ecx, 1
je 0x1400a059c
sub ecx, 1
je 0x1400a0595
cmp ecx, 2
je 0x1400a058b
mov rax, r12
jmp 0x1400a05a9
mov rcx, qword [rbx]
call fcn.140064c40
jmp 0x1400a05a9
cvttsd2si rax, qword [rbx]
jmp 0x1400a05a9
mov rax, qword [rbx]
jmp 0x1400a05a9
mov rcx, qword [rbx]
call fcn.1400a5590
mov dword [rsp + 0x298], eax
mov rbx, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x298]
mov rax, qword [0x140129398]
mov r9, r13
mov rdx, qword [rsp + 0x2b0]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov ecx, dword [rax + 0xb0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
or ecx, 0x20006
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ecx
mov rcx, r14
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400a085b
cmp ebp, 7
ja case.0x1400a062b.5
lea rax, [0x140000000]
mov edx, dword [rax + rbp*4 + 0xa08a4]
add rdx, rax
jmp rdx
lea r9, str.Number
mov r8, rbx
xor edx, edx
mov rcx, r15
call fcn.140012030
jmp 0x1400a0880
mov r9d, 1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, qword [rsp + 0x2b8]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp case.0x1400a062b.0
mov r9d, 2
jmp 0x1400a064c
lea rcx, [rbx*2 + 4]
call fcn.1400c83d4
mov r14, rax
test rax, rax
jne 0x1400a06a0
mov edi, recv
jmp case.0x1400a062b.0
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400d6d74
mov dword [r14 + rbx*2], r12d
test rbx, rbx
je 0x1400a06c8
cmp word [r14 + rbx*2 - 2], 0xa
jne 0x1400a06c8
dec rbx
mov word [r14 + rbx*2], r12w
movzx ecx, word [r14]
mov rax, r14
test cx, cx
je 0x1400a06eb
cmp cx, 0xa
jne 0x1400a06de
mov word [rax], r12w
movzx ecx, word [rax + 2]
add rax, 2
test cx, cx
jne 0x1400a06d4
lea rax, [rbx + 2]
test rbx, rbx
jne 0x1400a06f7
mov rax, r12
mov rdx, qword [rsp + 0x2b8]
add eax, eax
mov rcx, qword [rsp + 0x50]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r14
mov edi, eax
call fcn.1400c83c0
jmp case.0x1400a062b.0
lea rax, [rsp + 0x298]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
jmp 0x1400a065c
test bl, 1
jne case.0x1400a062b.5
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd rdi, eax
mov rcx, rdi
call fcn.1400c83d4
mov rbp, rax
test rax, rax
jne 0x1400a077a
mov edi, recv
jmp case.0x1400a062b.0
mov r11d, r12d
test ebx, ebx
jle 0x1400a07eb
movsxd rbx, ebx
mov r9, r12
mov r10, r12
nop word [rax + rax]
cmp r10, rdi
jge 0x1400a07eb
mov edx, r12d
mov r8d, reloc.WSOCK32.dll_recv
nop
movzx ecx, word [rsi + r9*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1400a07b3
lea eax, [rcx - 0x30]
jmp 0x1400a07cd
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x1400a07c1
lea eax, [rcx - 0x37]
jmp 0x1400a07cd
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x1400a081d
lea eax, [rcx - 0x57]
imul eax, r8d
inc r9
add edx, eax
sub r8d, 0xf
jns 0x1400a07a0
mov byte [r10 + rbp], dl
inc r11d
inc r10
cmp r9, rbx
jl 0x1400a0790
mov rdx, qword [rsp + 0x2b8]
mov r9d, 3
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbp
mov edi, eax
call fcn.1400c83c0
jmp case.0x1400a062b.0
mov rcx, rbp
call fcn.1400c83c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x140129398]
mov edi, 0x57
mov edx, edi
mov rcx, r15
mov dword [rax + 0x64], edi
call fcn.1400118f0
jmp 0x1400a0880
mov edi, 0x57
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x140129398]
mov dword [rax + 0x64], edi
test edi, edi
je 0x1400a0875
mov edx, edi
mov rcx, r15
call fcn.1400118f0
jmp 0x1400a0880
mov dword [r15 + 0x10], r12d
mov qword [r15], r13
mov qword [r15 + 8], r12
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret