Function at 0x14000e970
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11b8
call fcn.14004f000
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14006c868]
xor rax, rbp
mov qword [rbp + 0x1170], rax
mov r15, r8
mov qword [rbp + 8], r8
mov r13, rdx
mov qword [rbp + 0x18], rdx
mov rsi, rcx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x28], r9
xor r12d, r12d
mov word [rbp], r12w
lea rdx, [rbp + 0x170]
call fcn.1400092d0
test eax, eax
js 0x14000ef90
lea rdx, [rbp]
lea rcx, [rbp + 0x170]
call fcn.140009070
test eax, eax
jne 0x14000ea40
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], 0x36e
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, str._s_Type_not_supported_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rbp + 0x28]
call fcn.140008810
mov eax, 0x80020009
jmp 0x14000ef90
mov rcx, qword [rsi]
mov al, byte [rcx]
cmp al, 9
jl 0x14000ea60
cmp al, 0xa
jle 0x14000ea55
cmp al, 0xd
je 0x14000ea55
cmp al, 0x20
jne 0x14000ea60
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rsi], rax
jmp 0x14000ea40
lea rdx, [rbp + 0x170]
mov rcx, rsi
call fcn.1400092d0
test eax, eax
js 0x14000ef90
movzx eax, word [rbp]
cmp eax, 8
je 0x14000ef06
cmp eax, 0x11
je 0x14000ed8a
cmp eax, 0x13
je 0x14000ec08
cmp eax, 0x4008
jne 0x14000ef7b
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x381
lea rcx, str.default
mov rax, r15
test r15, r15
cmove rax, rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x14006e580]
lea rcx, [rbp + 8]
call fcn.140008810
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov qword [rbp + 0x60], r12
movsxd rcx, eax
test eax, eax
je 0x14000eb41
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x14000eb26
mov ecx, 0x80070057
call fcn.140008870
cmp rcx, 0x100
jbe 0x14000eb41
mov rdx, rcx
lea rcx, [rbp + 0x60]
call fcn.140009970
mov rbx, qword [rbp + 0x60]
jmp 0x14000eb49
lea rbx, [rbp + 0x68]
mov qword [rbp + 0x60], rbx
jmp 0x14000eb5e
test rbx, rbx
je 0x14000ebe8
lea rdi, [rbp + 0x170]
cmp byte [rbp + 0x170], 0
je 0x14000ebca
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
movzx ecx, byte [rdi]
cmp cl, 0x5c
jne 0x14000eba1
cmp byte [rax], 0x30
jne 0x14000eba1
mov byte [rbx], 0
inc rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rdi, rax
jmp 0x14000ebc5
mov byte [rbx], cl
movzx ecx, byte [rdi]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x14000ebbf
inc rbx
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x14000ebca
mov byte [rbx], al
inc rbx
inc rdi
cmp byte [rdi], 0
jne 0x14000eb77
mov byte [rbx], 0
mov byte [rbx + 1], 0
mov r8, qword [rbp + 0x60]
mov rdx, r15
mov rcx, r13
call fcn.140008e70
mov edi, eax
mov rbx, qword [rbp + 0x60]
jmp 0x14000ebed
mov edi, 0xe
lea rax, [rbp + 0x68]
cmp rbx, rax
je 0x14000ef6e
lea rcx, [rbp + 0x60]
call fcn.140009900
jmp 0x14000ef6e
mov rbx, r12
mov qword [rbp + 8], rbx
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r13, eax
add r13, r13
mov eax, 0x80000000
add rax, r13
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000ed61
cmp r13d, 0x400
jg 0x14000ec78
movsxd rdi, r13d
mov rcx, rdi
call fcn.140009a80
test al, al
je 0x14000ec78
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x14000ec65
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004f000
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x14000eca9
movsxd rdi, r13d
or rax, 0xffffffffffffffff
sub rax, rdi
cmp rax, 0x10
jb 0x14000ed56
lea rcx, [rdi + 0x10]
call fcn.1400233a0
test rax, rax
jne 0x14000ec9f
mov rcx, r12
jmp 0x14000eca9
mov qword [rax], r12
mov rbx, rax
lea rcx, [rax + 0x10]
shr rdi, 1
mov r9d, 3
mov r8d, edi
lea rdx, [rbp + 0x170]
call fcn.140008640
test rax, rax
je 0x14000ed61
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r8d, dword [rbp]
mov rdx, r15
mov rcx, qword [rbp + 0x18]
call fcn.140008cf0
mov edi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x3be
lea rcx, str.default
test r15, r15
cmove r15, rcx
mov qword [rsp + 0x28], r15
mov eax, dword [rbp]
mov dword [rsp + 0x20], eax
lea r9, str.Setting_Value__d_at__s_n
mov r8d, 2
mov rdx, qword [0x14006e580]
lea rcx, [rbp + 8]
call fcn.140008810
nop
test rbx, rbx
je 0x14000ef6e
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400233e0
test rbx, rbx
jne 0x14000ed41
jmp 0x14000ef6e
mov ecx, 0x80070057
call fcn.140008870
nop
test rbx, rbx
je 0x14000ed80
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400233e0
test rbx, rbx
jne 0x14000ed70
mov eax, 0x8007000e
jmp 0x14000ef90
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov dword [rbp], eax
test al, 1
je 0x14000edd6
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], 0x3c6
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rbp + 0x28]
call fcn.140008810
mov eax, 0x80004005
jmp 0x14000ef90
cdq
sub eax, edx
sar eax, 1
movsxd r14, eax
mov dword [rbp + 0x20], r14d
mov qword [rbp + 0x60], r12
mov rcx, r14
test eax, eax
je 0x14000ee21
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x14000ee06
mov ecx, 0x80070057
call fcn.140008870
cmp rcx, 0x100
jbe 0x14000ee21
mov rdx, rcx
lea rcx, [rbp + 0x60]
call fcn.140009970
mov rcx, qword [rbp + 0x60]
jmp 0x14000ee29
lea rcx, [rbp + 0x68]
mov qword [rbp + 0x60], rcx
jmp 0x14000ee4d
test rcx, rcx
jne 0x14000ee6e
lea rax, [rbp + 0x68]
test rax, rax
je 0x14000ee64
lea rcx, [rbp + 0x60]
call fcn.140009900
mov eax, 0x80004005
jmp 0x14000ef90
movsxd r8, r14d
xor edx, edx
call fcn.14001f820
mov edi, r12d
mov r13, r12
movsxd r15, ebx
test ebx, ebx
jle 0x14000eec7
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
add rbx, qword [rbp + 0x60]
movzx ecx, byte [rbp + r13 + 0x170]
call fcn.140009170
movzx r11d, al
mov ecx, edi
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
movzx ecx, al
shl r11b, cl
or byte [rbx], r11b
inc edi
inc r13
cmp r13, r15
jl 0x14000ee85
mov dword [rsp + 0x28], r14d
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
lea rax, [rbp + 0x68]
cmp qword [rbp + 0x60], rax
je 0x14000ef6e
lea rcx, [rbp + 0x60]
call fcn.140009900
jmp 0x14000ef6e
mov r9d, 1
lea r8, [rbp + 0x170]
mov rdx, r15
mov rcx, r13
call fcn.140008d70
mov edi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x37c
lea rcx, str.default
test r15, r15
cmove r15, rcx
mov qword [rsp + 0x28], r15
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x14006e580]
lea rcx, [rbp + 8]
call fcn.140008810
test edi, edi
je 0x14000ef7b
mov ecx, edi
call fcn.140008620
jmp 0x14000ef90
mov rdx, qword [rbp + 0x28]
mov rcx, rsi
call fcn.1400092d0
test eax, eax
cmovs r12d, eax
mov eax, r12d
mov rcx, qword [rbp + 0x1170]
xor rcx, rbp
call fcn.14001f7f0
lea rsp, [rbp + 0x1188]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret