Function at 0x140009e60
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rbp], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.1400094b0
nop
xor r12d, r12d
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov rsi, qword [rbp - 0x70]
lea r14, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x68]
cmp r15, 8
cmovae r14, rdi
lea rbx, [r12 - 1]
cmp rsi, 8
jae 0x140009eed
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
jmp 0x140009f98
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
mov rax, rdi
add rax, 1
cmovb rax, rbx
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x140009f28
mov rdx, rbx
jmp 0x140009f31
cmp rdx, 0x1000
jb 0x140009f5b
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rbx
call fcn.1400d5ff8
mov rcx, rax
test rax, rax
je 0x14000a4bd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140009f6d
test rdx, rdx
je 0x140009f6a
mov rcx, rdx
call fcn.1400d5ff8
jmp 0x140009f6d
mov rax, r12
mov qword [rbp - 0x40], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140268a80
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov r15, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea r11, [rbp - 0x80]
cmp r15, 8
cmovae r11, rdi
cmp rsi, 1
jb 0x14000a161
lea rax, [rsi - 1]
cmp rax, 0xffffffffffffffff
cmovb rbx, rax
lea r10, [r11 + rbx*2]
lea rbx, [0x140368d48]
mov r9, r10
sub r9, rbx
nop dword [rax]
cmp word [r10], 0x5c
jne 0x14000a019
mov ecx, 1
mov rax, rbx
mov edx, 0x5c
mov r8d, edx
cmp dx, r8w
ja 0x14000a019
cmp rcx, 1
je 0x14000a02c
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140009ffb
cmp r10, r11
je 0x14000a161
sub r10, 2
sub r9, 2
jmp 0x140009fe0
sub r10, r11
sar r10, 1
cmp r10, 0xffffffffffffffff
je 0x14000a161
lea rbx, [r10 + 1]
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
cmp rsi, rbx
jb 0x14000a4c3
lea r8, [rsi - 1]
sub rsi, rbx
cmp rsi, r8
cmovb r8, rsi
lea rax, [rbp - 0x80]
cmp r15, 8
cmovae rax, rdi
lea rdx, [rax + rbx*2]
lea rcx, [rsp + 0x50]
call fcn.140003740
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000a0c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4c9
call fcn.140004a20
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
cmp qword [rbp - 0x70], rbx
cmovb rbx, qword [rbp - 0x70]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, rbx
lea rcx, [rsp + 0x50]
call fcn.140003740
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000a14f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a14a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4cf
call fcn.140004a20
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x70], xmm1
lea rsi, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rsi, r8
lea rcx, [rbp - 0x60]
cmovae rcx, r8
mov rax, qword [rbp - 0x50]
lea rax, [rcx + rax*2]
lea rbx, [rbp - 0x60]
cmovae rbx, r8
mov rdi, r12
mov r14, rax
sub r14, rbx
inc r14
shr r14, 1
cmp rbx, rax
cmova r14, r12
test r14, r14
je 0x14000a1c0
sub rsi, rbx
movzx ecx, word [rbx]
call fcn.140280958
mov word [rbx + rsi], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x14000a1a8
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400055f0
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000a210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a20b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4d5
call fcn.140004a20
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
mov r8d, 6
lea rdx, str.Common
lea rcx, [rbp - 0x20]
call fcn.140003740
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rbx, qword [rbp - 0x20]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMacriumCommonSharedFolders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000a2c8
mov eax, dword [rbp - 0x70]
add eax, eax
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rbx, qword [rbp - 0x60]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMacriumCommonSharedFiles
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000a359
mov eax, dword [rbp - 0x30]
add eax, eax
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14000a399
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a394
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4db
call fcn.140004a20
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000a3eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a3e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4e1
call fcn.140004a20
movdqa xmm0, xmmword [0x140369280]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000a43d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4e7
call fcn.140004a20
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000a48a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a485
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4b7
call fcn.140004a20
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140263a60
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14026bb04
nop
call fcn.14026bb04
nop
call fcn.14000ae40
int3
call fcn.14026bb04
int3
call fcn.14026bb04
int3
call fcn.14026bb04
int3
call fcn.14026bb04
nop
call fcn.14026bb04
nop
call fcn.14026bb04
int3