Function at 0x140004e80
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x21a0
call fcn.140014f60
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x14001f8c0]
xor rax, rsp
mov qword [rsp + 0x2190], rax
mov r15, r8
mov qword [rsp + 0x50], r8
mov r14, rdx
mov qword [rsp + 0x48], rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x68], r9
lea rdx, [rsp + 0x190]
call fcn.1400034d0
test eax, eax
js 0x140005376
mov eax, dword [0x140020a80]
test al, 1
jne 0x140004f5f
or eax, 1
mov dword [0x140020a80], eax
lea rax, [0x140017644]
mov qword [0x140020a40], rax
mov word [0x140020a48], 8
lea rax, [0x140017640]
mov qword [0x140020a50], rax
mov word [0x140020a58], 0x4008
lea rax, [0x14001763c]
mov qword [0x140020a60], rax
mov word [0x140020a68], 0x13
lea rax, str.BDMS
mov qword [0x140020a70], rax
mov word [0x140020a78], 0x11
xor r12d, r12d
mov ebx, r12d
lea r13, [0x140020a40]
mov rdi, r13
nop
mov rdx, qword [rdi]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004f9b
add ebx, 1
add rdi, 0x10
cmp ebx, 4
jb 0x140004f70
mov eax, 0x80020009
jmp 0x140005376
movsxd rax, ebx
add rax, rax
movzx ebx, word [r13 + rax*8 + 8]
nop
nop
nop
mov rcx, qword [rsi]
movzx eax, word [rcx]
cmp eax, 9
jl 0x140004fd5
cmp eax, 0xa
jle 0x140004fca
cmp eax, 0xd
je 0x140004fca
cmp eax, 0x20
jne 0x140004fd5
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsi], rax
jmp 0x140004fb0
lea rdx, [rsp + 0x190]
mov rcx, rsi
call fcn.1400034d0
test eax, eax
js 0x140005376
movzx eax, bx
cmp eax, 8
je 0x140005319
cmp eax, 0x11
je 0x140005179
cmp eax, 0x13
je 0x14000513f
cmp eax, 0x4008
jne 0x140005360
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
or al, 0x21
add dword [rax], eax
call qword [0x14001f830]
mov qword [rsp + 0x48], r12
lea r9, [rsp + 0x30]
xor r8d, r8d
xor eax, eax
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov dword [rsp + 0x40], eax
test al, 1
je 0x14000519b
mov eax, 0x80004005
jmp 0x140005376
cdq
sub eax, edx
sar eax, 1
movsxd r13, eax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x80], r12
mov rcx, r13
test eax, eax
jne 0x1400051bc
mov rcx, r12
jmp 0x1400051d5
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x1400051d5
mov ecx, 0x80070057
call fcn.140003230
cmp rcx, 0x100
jbe 0x1400051f0
mov rdx, rcx
lea rcx, [rsp + 0x80]
call fcn.1400038d0
jmp 0x140005200
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
jmp 0x140005227
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jne 0x14000525d
lea rax, [rsp + 0x88]
cmp qword [rsp + 0x80], rax
je 0x140005253
lea rcx, [rsp + 0x80]
call fcn.1400038c0
mov eax, 0x80004005
jmp 0x140005376
movsxd r8, r13d
xor edx, edx
call fcn.14000b7d0
mov r14d, r12d
mov r15, r12
movsxd rax, ebx
test ebx, ebx
jle 0x1400052c8
mov r13, rax
nop
nop
nop
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax