Function at 0x140002c10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140013008]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r12d, r12d
mov rbx, rcx
lea rcx, [rbp - 0x2e]
lea r8d, [r12 + 0x7e]
xor edx, edx
mov word [rbp - 0x30], r12w
call fcn.140004080
lea rax, [rbp - 0x30]
lea r8d, [r12 + 0x34]
lea rcx, [rbp - 0x6c]
xor edx, edx
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], r12d
mov dword [rbp - 0x70], 0x40
call fcn.140004080
mov rcx, qword [0x14001b010]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14001b010]
lea r9, [rbp - 0x30]
mov edx, 0x148
mov r8, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp word [rbp - 0x30], 0x55
lea rcx, [rbp - 0x28]
mov esi, r12d
sete sil
call fcn.140003388
mov rcx, qword [0x14001afe0]
lea r9d, [r12 + 2]
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov dword [rsp + 0x50], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14001afe0]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x74], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x40], r12
lea rax, str.SOFTWAREQStar_Technologies__Inc.QStar_SoftwareSecurityFsi_Passwd
lea rdi, str.SOFTWAREQStar_Technologies__Inc.QStar_SoftwareSecurityFsi_Group
test esi, esi
lea r9, [0x140010fbc]
cmovne rdi, rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov rdx, rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20119
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140002d7f
lea r8, str.Registry_node_not_accessible
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140002f43
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [0x140010ee4]
lea rdx, [rbp - 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140002dd8
lea r8, str.Registry_node_not_accessible
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140002f30
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
test esi, esi
je 0x140002eef
lea rdx, [0x140011100]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x140011104]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.DIR_UMASK
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.FILE_UMASK
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8d, 0x80
call fcn.140004080
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x30]
lea rdx, str.Passwd_W9x
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], InitCommonControls
lea rdx, str.Passwd_NT
jmp 0x140002f08
lea rdx, [0x140011104]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], r12d
lea rdx, str.UIDS
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x30]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140001dd0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400030f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret