Function at 0x100015ad4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x50
and qword [r11 + 8], 0
xor r13d, r13d
mov r10, r9
mov rax, r8
mov r14d, edx
mov r12, rcx
test rcx, rcx
je 0x100015d7c
test rax, rax
je 0x100015d7c
test r9, r9
je 0x100015b96
and qword [r11 - 0x28], r13
lea rcx, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x30], rcx
and qword [r11 - 0x38], r13
xor r8d, r8d
mov rcx, rax
mov rdx, r10
mov dword [rsp + 0x28], 2
and dword [r11 - 0x48], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100015b57
cmp qword [rsp + 0x70], r13
je 0x100015b57
lea r13d, [rax + 1]
jmp 0x100015b9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015ccc
test byte [rcx + 0x1c], 1
je 0x100015ccc
mov edx, 0x15
jmp 0x100015d3c
mov qword [rsp + 0x70], rax
xor ebp, ebp
test r14d, r14d
je 0x100015cca
lea rsi, [r12 + 0x21c]
mov edx, 0xffffffff
cmp dword [rsi + 8], 0
je 0x100015cb8
mov eax, dword [rsi - 0x21c]
sub eax, 1
je 0x100015c40
cmp eax, 3
jne 0x100015cb8
mov ecx, ebp
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
imul rcx, rcx, 0x228
lea rax, [rcx + r12 + 0x220]
lea rdx, [rcx + r12 + 4]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100015cb3
mov ebx, 0x80004005
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015ccc
test byte [rcx + 0x1c], 1
je 0x100015ccc
mov edx, 0x16
jmp 0x100015d0c
mov eax, dword [rsi]
test eax, eax
je 0x100015cb8
lea ecx, [rax + 1]
cmp ecx, eax
jb 0x100015c51
xor ebx, ebx
jmp 0x100015c58
mov ecx, edx
mov ebx, 0x80070216
test ebx, ebx
js 0x100015d54
mov r8d, ecx
add r8, r8
cmp r8, rdx
ja 0x100015c6f
xor ebx, ebx
jmp 0x100015c77
mov r8d, edx
mov ebx, 0x80070216
test ebx, ebx
js 0x100015d1e
mov rcx, qword [rsi - 0xc]
mov dword [rsp + 0x28], r8d
mov eax, ebp
imul rax, rax, 0x228
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + r12 + 4]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100015ce9
mov edx, 0xffffffff
inc ebp
add rsi, 0x228
cmp ebp, r14d
jb 0x100015bb3
xor ebx, ebx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100015ce2
cmp r13d, 1
jne 0x100015ce2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x100015daf
mov ebx, 0x80004005
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015ccc
test byte [rcx + 0x1c], 1
je 0x100015ccc
mov edx, 0x19
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018e0]
call fcn.100004898
jmp 0x100015ccc
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015ccc
test byte [rcx + 0x1c], 1
je 0x100015ccc
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018e0]
mov r9d, ebx
call fcn.1000048bc
jmp 0x100015ccc
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015ccc
test byte [rcx + 0x1c], 1
je 0x100015ccc
mov edx, 0x17
jmp 0x100015d3c
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100015daa
test byte [rcx + 0x1c], 1
je 0x100015daa
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000018e0]
mov edx, 0x14
call fcn.100004898
mov eax, 0x80070057
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret