Function at 0x140084110
Capabilities:
Set registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], r12
mov rax, qword [0x14036aa00]
xor rax, rbp
mov qword [rbp + 0x30], rax
mov r14, r9
mov rbx, r8
mov rcx, rdx
call fcn.14008d6e0
test rax, rax
jne 0x14008415d
mov eax, 0x80004005
jmp 0x140084391
mov rcx, rbx
call fcn.140088990
mov r15, rax
lea rcx, [rbp + 0x10]
call fcn.14008d8d0
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.14008e710
test al, al
jne 0x14008418e
mov eax, 1
jmp 0x140084384
mov rsi, qword [rbp + 0x88]
test rsi, rsi
jne 0x1400841a2
lea eax, [rsi + 0x57]
jmp 0x140084384
cmp word [rsi], 1
jne 0x14008437f
cmp dword [rsi + 4], 1
jne 0x14008437f
cmp dword [rsi + 0x1c], 0
jne 0x14008437f
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x140084384
movabs r12, 0xffffffffffffff0
test r14, r14
jne 0x1400841ed
xor ebx, ebx
mov edi, ebx
jmp 0x140084276
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400841f4
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x140084210
xor ebx, ebx
mov edi, ebx
jmp 0x140084276
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140084226
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1402b4ee0
sub rsp, rcx
lea rdi, [rsp + 0x50]
xor ebx, ebx
test rdi, rdi
je 0x140084273
mov byte [rdi], bl
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9d, [rbx - 1]
mov r8, r14
xor edx, edx
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
jmp 0x140084276
mov rdi, rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140084374
mov r14d, dword [rsi + 0x18]
mov r15, qword [rbp + 8]
mov r8, qword [rbp + 0x80]
test r8, r8
jne 0x1400842cb
mov rdi, rbx
jmp 0x14008434a
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x1400842d2
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400842c3
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400842fe
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1402b4ee0
sub rsp, rcx
lea rdi, [rsp + 0x50]
test rdi, rdi
je 0x140084347
mov byte [rdi], 0
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
xor edx, edx
lea ecx, [rdx + 3]
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
jmp 0x14008434a
mov rdi, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 3
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x140084386
mov eax, 0x80004005
mov ebx, eax
lea rcx, [rbp + 0x10]
call fcn.14008dad0
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rbp
call fcn.1402b48e0
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
mov r12, qword [rbp + 0x78]
lea rsp, [rbp + 0x40]
pop r15
pop r14
pop rbp
ret