Function at 0x140001e70
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x320
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x14007b960]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rsp + 0x68], r14
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x200]
call fcn.1400421c0
xor edx, edx
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], rdx
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov r8d, r12d
lea rdx, [0x1400664c4]
lea rcx, [rsp + 0xc8]
call fcn.140002a20
mov r13d, dword [rsp + 0x380]
mov r8d, r13d
lea rdx, [0x1400664c4]
lea rcx, [rsp + 0xa8]
call fcn.140002a20
xor r9d, r9d
lea r8, [rsp + 0x200]
lea edx, [r14 + 0x10]
lea rcx, [0x140082050]
call fcn.140008b00
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x200]
call fcn.140001b30
lea r8, str.NetUtl.dat
mov edx, 0x104
lea rcx, [rsp + 0x200]
call fcn.14003efe0
lea r8, [0x140066464]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14003dd60
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140002058
mov rdx, rbx
call fcn.14003f0a0
lea rdx, reloc.OLEAUT32.dll_VariantCopyInd
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, reloc.OLEAUT32.dll_VariantCopyInd
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, reloc.OLEAUT32.dll_VariantCopyInd
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, reloc.OLEAUT32.dll_VariantCopyInd
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
lea rdx, reloc.OLEAUT32.dll_VariantCopyInd
mov rcx, qword [rsp + 0x68]
call fcn.14003f0a0
mov rcx, qword [rsp + 0x68]
call fcn.14003e100
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
lea edx, [rax + 1]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea r8, [rsp + 0x78]
mov edx, 4
lea rcx, [rsp + 0x200]
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xf0]
call fcn.1400421c0
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea edx, [r9 + 4]
lea rcx, [0x140082050]
call fcn.140008b00
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x70], rax
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002109
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x14000215e
test rbx, 0xffffffffffff0000
jne 0x14000214a
movzx edi, bx
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x140002172
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002df0
jmp 0x140002172
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
jmp 0x140002161
mov ecx, r14d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003010
nop
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002192
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.IPAddress
test rdx, 0xffffffffffff0000
jne 0x1400021d5
movzx edi, dx
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x1400021f2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002df0
jmp 0x1400021f2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.140003010
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call fcn.140001460
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002244
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rsi, rsi
je 0x140002299
test rsi, 0xffffffffffff0000
jne 0x140002285
movzx edi, si
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x1400022ad
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002df0
jmp 0x1400022ad
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
jmp 0x14000229c
mov ecx, r14d
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140003010
nop
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400022cd
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.MACAddr
test rdx, 0xffffffffffff0000
jne 0x140002310
movzx edi, dx
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x14000232d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002df0
jmp 0x14000232d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.140003010
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call fcn.140001460
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000237f
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rbp, rbp
je 0x1400023d4
test rbp, 0xffffffffffff0000
jne 0x1400023c0
movzx edi, bp
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x1400023e8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002df0
jmp 0x1400023e8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
jmp 0x1400023d7
mov ecx, r14d
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140003010
nop
call fcn.1400147f0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002408
mov ecx, 0x80004005
call fcn.140002a50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.AdapName
test rdx, 0xffffffffffff0000
jne 0x14000244b
movzx edi, dx
mov ecx, edi
call fcn.1400147dc
test rax, rax
je 0x140002468
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002df0
jmp 0x140002468
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.140003010
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call fcn.140001460
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140002536
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
lea r9, str.option
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140002574
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002574
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140002574
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProtocolType
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140002624
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
lea r9, str.option
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140002662
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002662
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140002662
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.IPDirectInput
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140002715
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
lea r9, str.option
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140002753
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002753
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140002753
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.IPDlgRet
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14003dbe0
add rsp, 0x320
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret