Function at 0x1400203e0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rcx + 0xa4]
lea rbx, [rcx + 0xa0]
xor r13d, r13d
test rbx, rbx
je 0x140020418
lea rcx, [rbx - 0xa0]
jmp 0x14002041b
mov rcx, r13
mov edx, 0x402
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsi], eax
lea rbp, [rdi + 0xac]
test rbx, rbx
je 0x140020455
lea rcx, [rbx - 0xa0]
jmp 0x140020458
mov rcx, r13
mov edx, 0x40f
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp], eax
lea r12, [rdi + 0xa8]
test rbx, rbx
je 0x140020493
lea rcx, [rbx - 0xa0]
jmp 0x140020496
mov rcx, r13
mov edx, 0x410
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [r12], eax
mov qword [rsp + 0xc8], r13
mov rax, qword [0x140055018]
mov qword [rsp + 0x50], rax
lea rax, str.Mount
mov qword [rsp + 0x20], rax
lea r9, [0x140044b00]
lea r8, [0x140044b00]
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x50]
call fcn.140011ae0
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
lea rcx, [rbx - 0xc]
or edi, 0xffffffff
cmp rcx, qword [0x140055010]
je 0x140020566
mov eax, edi
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x140020566
call fcn.140024b64
nop
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r12
mov r9d, 4
xor r8d, r8d
lea rdx, str.OpenDrive
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0xc0], r13
mov rax, qword [0x140055018]
mov qword [rsp + 0x58], rax
lea rax, str.MountMenuItems
mov qword [rsp + 0x20], rax
lea r9, [0x140044b00]
lea r8, [0x140044b00]
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x58]
call fcn.140011ae0
lea r11, [rsp + 0xb8]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140055010]
je 0x140020634
lock xadd dword [rcx], edi
dec edi
test edi, edi
jg 0x140020634
call fcn.140024b64
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbp
mov r9d, 4
xor r8d, r8d
lea rdx, str.Casscade
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
mov r9d, 4
xor r8d, r8d
lea rdx, str.IntegrateExplorer
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14002069e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1400206b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400206b7
xor eax, eax
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret