Function at 0x1400c1850
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_336], rax
mov rcx, qword [rcx + reloc.MFC80U.DLL_Ordinal_1112]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
mov rsi, rax
mov rdx, qword [rax]
call qword [rdx + 0x18]
test rax, rax
je 0x1400c18e3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x78]
mov rcx, rax
mov rbx, rax
mov rdx, qword [rax]
call qword [rdx + 0x30]
test rax, rax
mov rdi, rax
je 0x1400c18d5
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0xc8]
test eax, eax
jne 0x1400c1927
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
test rax, rax
mov rdi, rax
jne 0x1400c18b4
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x20]
test rax, rax
jne 0x1400c1897
call fcn.140049470
lea rsi, [0x140434340]
xor edx, edx
mov rcx, rsi
mov r8d, 0x80
mov rbp, rax
call sub.ntdll.dll_memset
lea rcx, str...opthelp.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400c1bc6
xor ebx, ebx
jmp 0x1400c1c43
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x50]
mov rdx, qword [rdi]
mov rcx, rdi
mov esi, eax
call qword [rdx + 0x38]
cmp esi, 0xffffffff
mov rbx, rax
je 0x1400c18e3
cmp rax, 0xffffffffffffffff
je 0x1400c18e3
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x50], 0
call sub.ntdll.dll_memset
call fcn.140049400
mov rdi, qword [rax]
lea rdx, [rsp + 0x50]
mov r9d, esi
mov r8d, 0x80
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [rdi + 0x38]
test eax, eax
jne 0x1400c1a6f
call fcn.140049470
lea rsi, [0x140434340]
xor edx, edx
mov rcx, rsi
mov r8d, 0x80
mov rbp, rax
call sub.ntdll.dll_memset
lea rcx, str...opthelp.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400c19db
xor ebx, ebx
lea rdx, str._s:_Failed_to_IVol.GetVolumeDevice.
jmp 0x1400c1c4a
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x38]
mov r8d, 0x8fb
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400c1a20
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x38]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400c1a50
mov rbx, rsi
lea rdx, str._s:_Failed_to_IVol.GetVolumeDevice.
jmp 0x1400c1c4a
lea rax, [rsp + 0x30]
lea rdx, str.SystemSetup
xor ebx, ebx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400c1b6f
call fcn.140049470
lea rsi, [0x140434340]
xor edx, edx
mov rcx, rsi
mov r8d, 0x80
mov rbp, rax
call sub.ntdll.dll_memset
lea edx, [rbx + 0x5c]
lea rcx, str...opthelp.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400c1b63
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x38]
mov r8d, 0x903
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x39], rax
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400c1b20
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x38]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400c1b50
mov rbx, rsi
lea rdx, [0x1402e22a0]
jmp 0x1400c1c4a
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x50]
lea rdx, str.SystemPartition
not rcx
mov r9d, 1
xor r8d, r8d
sub rcx, 1
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400c1c59
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x38]
mov r8d, reloc.MFC80U.DLL_Ordinal_2289
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400c1c00
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x38]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400c1c30
mov rbx, rsi
lea rdx, str._s:_DiskIndex_or_PartStartSector_is_invalid
mov rax, qword [rbp]
mov r8, rbx
mov rcx, rbp
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_336]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret