Function at 0x10006b8d4
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x288
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
xor r15d, r15d
cmp byte [rcx + 0x20], r15b
jne 0x10006b91f
mov edi, 0x80004001
jmp 0x10006bbc9
add rcx, 0x50
mov rdx, r8
call fcn.10000b56c
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.10000b56c
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.10000b56c
mov edx, dword [rsp + 0x2f0]
mov dword [rbp + 0x58], edx
mov edi, r15d
lea r9, [rbp + 0x70]
lea r8, [0x1000b1864]
lea rcx, [rbp + 0x98]
call fcn.100004700
mov esi, 0x80004005
cmp eax, r15d
jl 0x10006b996
mov rcx, qword [rbp + 0x70]
cmp rcx, r15
je 0x10006b996
cmp word [rcx], r15w
je 0x10006b996
lea rdx, [rbp + 0x5c]
call qword [sym.imp.SHLWAPI.dll_GUIDFromStringW]
cmp eax, r15d
jne 0x10006b9ed
mov edi, esi
jmp 0x10006b9ed
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov edi, eax
cmp eax, r15d
jl 0x10006b9ed
mov r8d, 0x104
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, r15d
jg 0x10006b9c5
mov edi, esi
jmp 0x10006b9ed
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x70]
call fcn.100007e60
mov r9, qword [rbp + 0x70]
lea r8, [0x1000b1864]
mov edx, dword [rbp + 0x58]
lea rcx, [rbp + 0x98]
call fcn.10000f8c0
cmp edi, r15d
jl 0x10006bbc9
mov qword [rsp + 0x50], r15
lea rdx, [0x1000b16d4]
lea rcx, [rsp + 0x50]
call fcn.100007e60
mov edi, eax
cmp eax, r15d
jl 0x10006bb9b
mov rdx, qword [rbp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.100049328
mov edi, eax
cmp eax, r15d
jl 0x10006bb9b
mov rax, qword [rbp + 0x78]
cmp rax, r15
je 0x10006ba3f
cmp word [rax], r15w
jne 0x10006ba56
mov rdx, qword [rbp + 0x48]
mov rcx, rbp
call fcn.10006be6c
mov edi, eax
cmp eax, r15d
jl 0x10006bb9b
mov rcx, qword [rbp + 0x80]
mov r13, 0xffffffff80000001
mov rbx, qword [rsp + 0x50]
cmp rcx, r15
je 0x10006baa3
cmp word [rcx], r15w
je 0x10006baa3
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x80]
lea r8, [0x1000b1744]
mov rdx, rbx
mov rcx, r13
call fcn.10003d930
cmp al, r15b
jne 0x10006baa3
mov edi, esi
jmp 0x10006bba0
mov word [rsp + 0x60], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
lea rcx, [0x1000b8f90]
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, r15d
jg 0x10006badf
mov edi, esi
jmp 0x10006bba0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12d, [rax + rax + 4]
mov esi, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
cmp eax, r15d
je 0x10006bb40
movzx esi, ax
or esi, 0x80070000
cmp eax, r15d
cmovle esi, eax
jmp 0x10006bb7e
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.Endpoints
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10006bb7e
movzx esi, ax
or esi, 0x80070000
cmp eax, r15d
cmovle esi, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x10006bb8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, r15d
mov eax, 0x80004005
cmovl edi, eax
jmp 0x10006bba0
mov rbx, qword [rsp + 0x50]
cmp rbx, r15
je 0x10006bbae
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp edi, r15d
jl 0x10006bbc9
mov rcx, rbp
call fcn.10006bbf8
mov edi, eax
cmp eax, r15d
jl 0x10006bbc9
call fcn.10006bdec
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x288
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret