Function at 0x140001d20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor edi, edi
mov ebx, ecx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], ebx
lea rsi, str.agent_start
mov dword [rsp + 0x40], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x60], eax
mov r8d, 0xd0
lea rax, str._s_pid:_d__dbg:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 4
call fcn.140008ef0
xor eax, eax
mov dword [0x14005e140], ebx
mov qword [0x14006e2b0], rax
lea rbx, [0x14006e2b0]
mov r9, rbx
mov dword [0x14006e2b0], 0x18
lea r8, [0x14006e2b8]
mov qword [0x14006e2b8], rax
lea edx, [rdi + 1]
mov qword [0x14006e2c0], rax
lea rcx, str.D:PAI_A_OICI_KA___SY__A_OICI_KA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140001eb4
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREOpenSSHAgent
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001ef0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ProcessID
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
test eax, eax
jne 0x140001f26
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14006e288], rax
test rax, rax
je 0x140001f59
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14006e2a8], rax
test rax, rax
je 0x140001f95
mov qword [0x14006e2c8], 0xffffffffffffffff
mov dword [0x14006e2c0], edi
call fcn.140001720
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xda
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_convert_sddl_ERROR:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
mov dword [rsp + 0x38], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_create_agent_root_reg_key__ERROR:_d
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, 0xdc
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
mov dword [rsp + 0x38], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_publish_agent_master_process_id_ERROR:_d
mov r8d, 0xde
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xe0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_create_global_stop_event_ERROR:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xe2
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_create_event_ERROR:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3