Function at 0x14002f050
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 7
mov word [rsp + 0xa8], 0
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0xa8]
cmp rax, 7
ja 0x14002f0d8
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0xa8], 0
jmp 0x14002f0e3
mov rdx, rsi
mov r9, rbp
call fcn.14005b880
movzx eax, word [rsp + 0xa8]
mov rcx, qword [rsp + 0xaa]
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x9e], rcx
movups xmm0, xmmword [rsp + 0xb8]
mov word [rsp + 0x78], ax
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x9e]
mov qword [rsp + 0x7a], rax
mov qword [rsp + 0x80], rcx
movups xmmword [rsp + 0x88], xmm0
lea rbp, [rsp + 0x58]
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 7
mov word [rbp], 0
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rbp
call fcn.14005b880
test rbx, rbx
je 0x14002f206
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14002f4f6
lea rdx, [rax + 1]
mov qword [rsp + 0x68], rdx
cmp rcx, 8
jb 0x14002f19c
mov rbp, qword [rsp + 0x58]
mov word [rbp + rax*2], 0x5c
mov word [rbp + rax*2 + 2], 0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rdx, rbp
sub rdx, rcx
cmp rdx, rax
jb 0x14002f51a
lea rsi, [rcx + rax]
mov qword [rsp + 0x68], rsi
cmp rbp, 8
jb 0x14002f1e1
mov rbp, qword [rsp + 0x58]
jmp 0x14002f1e6
lea rbp, [rsp + 0x58]
lea rcx, [rcx*2]
add rcx, rbp
add rax, rax
mov rdx, rbx
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rsi*2], 0
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14002f2ff
mov ebp, eax
cdqe
add rax, rax
mov rsi, 0xffffffffffffffff
cmovae rsi, rax
mov rcx, rsi
call fcn.140057a8c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
cmp ebp, 0xffffffff
je 0x14002f59d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14002f339
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 7
mov word [rsp + 0xa8], 0
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0xa8]
cmp rax, 7
ja 0x14002f373
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0xa8], 0
jmp 0x14002f37e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.Utf8ToUtf16
mov edx, edi
mov r9d, 0x29
call fcn.14002d220
xor ebp, ebp
xor r12d, r12d
xor esi, esi
xor ebx, ebx
jmp 0x14002f3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.Utf8ToUtf16
mov edx, edi
mov r9d, 0x32
call fcn.14002d220
xor ebp, ebp
xor r12d, r12d
xor esi, esi
xor ebx, ebx
jmp 0x14002f3a0
mov rdx, rsi
mov r9, r15
call fcn.14005b880
mov rbp, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
xor edi, edi
mov rcx, r15
call fcn.140057960
test edi, edi
jne 0x14002f44d
lea rax, [rsp + 0x38]
mov qword [rax], rbp
mov qword [rax + 8], r12
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov rcx, qword [rsp + 0x70]
cmp rbx, 8
cmovae rax, rbp
cmp qword [rsp + 0x90], 8
jb 0x14002f3e3
mov r8, qword [rsp + 0x78]
jmp 0x14002f3e8
lea r8, [rsp + 0x78]
lea ebp, [rsi + rsi]
add ebp, 2
cmp rcx, 8
jb 0x14002f3fb
mov rdx, qword [rsp + 0x58]
jmp 0x14002f400
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14002f44b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.RegistrySetValueString
mov edx, edi
mov r9d, 0x79
call fcn.14002d220
jmp 0x14002f44d
xor edi, edi
mov dword [r14], edi
mov rax, qword [rsp + 0x50]
cmp rax, 8
jb 0x14002f47a
mov rcx, qword [rsp + 0x38]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002f534
call fcn.140057960
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x14002f4a4
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002f557
call fcn.140057960
mov rax, qword [rsp + 0x90]
cmp rax, 8
jb 0x14002f4d1
mov rcx, qword [rsp + 0x78]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002f57a
call fcn.140057960
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140058a80
mov rax, r14
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x20], 1
lea r9, [0x1400a2e50]
lea rcx, [rsp + 0x58]
mov edx, 1
call fcn.14005b730
jmp 0x14002f1aa
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x58]
mov rdx, rax
mov r9, rbx
call fcn.14005b730
jmp 0x14002f206
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14002f5a8
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14002f475
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14002f5a8
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14002f49f
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14002f5a8
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14002f4cc
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3