Function at 0x140006a70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov rax, qword [0x140019060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
lea rcx, [0x140003058]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x140006ae9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
lea rdx, [0x140003080]
movzx ebx, ax
lea rcx, [0x1400030e0]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000bc08
jmp 0x140006b52
lea rdx, [0x140003108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x80070000
mov rbx, rax
test rax, rax
jne 0x140006b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003080]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
jmp 0x140006b3d
mov rcx, rax
call qword [fcn.1400049d0]
call rbx
mov ebx, eax
test eax, eax
jns 0x140006b49
mov r8d, eax
lea rdx, [0x140003120]
lea rcx, [0x1400030e0]
call fcn.14000bc08
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
js 0x140006e8c
lea rdx, [rsp + 0x60]
lea rcx, [0x140002b08]
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x140006b8e
lea rdx, [0x140003190]
lea rcx, [0x1400031e0]
call fcn.14000bc08
mov ebx, 0x80004005
test ebx, ebx
js 0x140006e8c
mov esi, 0x104
lea r8, [0x1400038c8]
lea rcx, [rbp - 0x50]
mov edx, esi
call fcn.140005408
mov ebx, eax
test eax, eax
js 0x140006e71
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140005360
mov ebx, eax
test eax, eax
js 0x140006e71
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006cac
mov rcx, qword [rsp + 0x50]
lea rax, str.Internet_Explorer_ETW_Collector_Service
lea rdx, [0x1400038c0]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x50
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006c82
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, [0x140002850]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x4e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140006c9f
lea rcx, [0x140003200]
jmp 0x140006c89
lea rcx, [0x140003280]
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000bc08
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006cc9
movzx ebx, ax
lea rdx, [rbp - 0x50]
lea rcx, [0x140003300]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000bc08
test ebx, ebx
js 0x140006e71
lea r8, [0x140003370]
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140005408
mov ebx, eax
test eax, eax
js 0x140006e71
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140005360
mov ebx, eax
test eax, eax
js 0x140006e71
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006e50
mov rcx, qword [rsp + 0x50]
lea rax, str.IEEtwCollectorService
lea rdx, [0x140003380]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x2c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e47
mov rcx, qword [rsp + 0x50]
lea rax, [0x14001a490]
mov esi, 0x90
lea rdx, [0x1400033a0]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e3e
mov rcx, qword [rsp + 0x50]
lea rax, [0x14001a400]
lea rdx, [0x1400033c8]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e35
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x28], r9d
lea rdx, [0x1400033f0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140006e27
lea rcx, [0x140003420]
jmp 0x140006e57
lea rcx, [0x1400034c0]
call fcn.14000bc08
jmp 0x140006e6d
lea rcx, [0x140003530]
jmp 0x140006e57
lea rcx, [0x1400035d0]
jmp 0x140006e57
lea rcx, [0x140003670]
jmp 0x140006e57
lea rcx, [0x140003300]
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000bc08
test ebx, ebx
jns 0x140006e8c
lea rdx, [0x140003700]
lea rcx, [0x1400030e0]
mov r8d, ebx
call fcn.14000bc08
call fcn.140006ebc
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000b710
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret