Function at 0x140098c60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0x128], rbx
mov r15, r8
mov rdi, rdx
mov r13, rcx
mov rbx, qword [rcx + 0xc8]
cmp dword [rbx + 8], 0
je 0x1400992ab
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x1400992ab
cmp byte [rbx + 0x28], 0
jne 0x1400992ab
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x1400992ab
mov rax, qword [rdi]
mov qword [rbp + 7], rax
lock inc dword [rax]
lea rdx, [rbp + 7]
lea rcx, [rsp + 0x38]
call fcn.140097980
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 9]
call fcn.140097700
mov rdi, rax
mov rbx, qword [r13 + 0xc8]
xor r12d, r12d
cmp dword [rbx + 8], r12d
je 0x140098d2d
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x140098d2d
cmp byte [rbx + 0x28], r12b
jne 0x140098d2d
lea rcx, [rbx + 0x10]
call fcn.140097670
jmp 0x140098d30
mov rax, r12
mov r8, rdi
mov edx, 0x2001f
mov rcx, rax
call fcn.140097530
mov r14, rax
mov qword [rbp + 0x17], rax
mov rdx, qword [rbp - 9]
lock dec dword [rdx]
jne 0x140098d59
mov rcx, qword [rbp - 9]
call fcn.14000ade0
test r14, r14
jne 0x140098d88
lea edx, [r14 + 1]
mov rcx, r13
call fcn.14005a4c0
nop
mov rax, qword [rsp + 0x38]
lock dec dword [rax]
jne 0x1400992b8
mov rcx, qword [rsp + 0x38]
call fcn.14000ade0
jmp 0x1400992b8
lea rax, [0x140dd8068]
mov qword [rsp + 0x30], rax
lock inc dword [0x140dd8068]
mov rcx, r15
call fcn.140050170
add eax, 0xfffffffe
cmp eax, 9
ja case.0x140098dc2.6
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x992d4]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x7f], 7
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.140055040
nop
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.14005f660
nop
mov rax, qword [rbp - 0x49]
lock dec dword [rax]
jne 0x140098e41
mov r14, qword [rbp - 0x49]
movsxd rax, dword [r14 + 0xc]
lea rbx, [r14 + rax*8 + 0x18]
movsxd rax, dword [r14 + 8]
lea r13, [r14 + rax*8 + 0x18]
cmp r13, rbx
je 0x140098e31
nop dword [rax]
sub rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
je 0x140098e2c
mov rcx, rdi
call fcn.140050130
mov rcx, rdi
call fcn.1400abea0
cmp rbx, r13
jne 0x140098e10
mov rcx, r14
call fcn.140004d80
mov r13, qword [rbp + 0x67]
mov r14, qword [rbp + 0x17]
mov rax, qword [rbp - 0x69]
movsxd rcx, dword [rax + 8]
lea rbx, [rax + rcx*8 + 0x18]
mov rcx, rbx
movsxd rdx, dword [rax + 0xc]
lea rdx, [rax + rdx*8 + 0x18]
cmp rbx, rdx
je 0x140098f68
mov rax, qword [rcx]
mov r9d, dword [rax + 8]
test r9d, r9d
je 0x140098e95
mov r8d, r12d
jle 0x140098e8a
mov rax, qword [rax + 0x10]
cmp word [rax], 0
je 0x140098e95
inc r8d
add rax, 2
cmp r8d, r9d
jl 0x140098e78
add rcx, 8
cmp rcx, rdx
je 0x140098f06
jmp 0x140098e63
mov dword [rbp + 0x7f], 3
mov rdx, r15
lea rcx, [rbp - 0x71]
call fcn.14005d0e0
nop
mov rax, qword [rbp - 0x71]
mov ecx, dword [rax + 8]
lea ebx, [rcx + rcx]
lea rcx, [rbp - 0x71]
call fcn.14000b320
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 1]
call fcn.140005240
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 1]
lock dec dword [rax]
jne 0x140098eee
mov rcx, qword [rbp - 1]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x71]
lock dec dword [rax]
jne 0x140098f81
mov rcx, qword [rbp - 0x71]
call fcn.14000ade0
jmp 0x140098f81
cmp rbx, rdx
je 0x140098f68
nop dword [rax + rax]
mov rax, qword [rbx]
mov ecx, dword [rax + 8]
lea edi, [rcx + rcx + 2]
mov rcx, rbx
call fcn.14000b320
mov rdx, rax
mov r8d, edi
lea rcx, [rbp - 0x39]
call fcn.140005240
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400056c0
nop
mov rax, qword [rbp - 0x39]
lock dec dword [rax]
jne 0x140098f52
mov rcx, qword [rbp - 0x39]
call fcn.140004d80
add rbx, 8
mov rax, qword [rbp - 0x69]
movsxd rcx, dword [rax + 0xc]
lea rax, [rax + rcx*8 + 0x18]
cmp rbx, rax
jne 0x140098f10
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400059b0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400059b0
nop
mov rax, qword [rbp - 0x69]
lock dec dword [rax]
jne 0x14009914b
mov r12, qword [rbp - 0x69]
movsxd rax, dword [r12 + 0xc]
lea rbx, [r12 + rax*8 + 0x18]
movsxd rax, dword [r12 + 8]
lea rdi, [r12 + rax*8 + 0x18]
cmp rdi, rbx
je 0x140098fc9
nop dword [rax + rax]
sub rbx, 8
mov rdx, qword [rbx]
lock dec dword [rdx]
jne 0x140098fc4
mov rcx, qword [rbx]
call fcn.14000ade0
cmp rbx, rdi
jne 0x140098fb0
mov rcx, r12
call fcn.140004d80
jmp 0x14009914b
mov ebx, 4
mov dword [rbp + 0x7f], ebx
xor edx, edx
mov rcx, r15
call fcn.140051ec0
mov dword [rbp - 0x61], eax
mov r8d, ebx
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x59]
call fcn.140005240
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x59]
lock dec dword [rax]
jne 0x14009914b
mov rcx, qword [rbp - 0x59]
call fcn.140004d80
jmp 0x14009914b
mov dword [rbp + 0x7f], 0xb
xor edx, edx
mov rcx, r15
call fcn.140051f80
mov qword [rbp + 0xf], rax
mov r8d, 8
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x29]
call fcn.140005240
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x29]
lock dec dword [rax]
jne 0x14009914b
mov rcx, qword [rbp - 0x29]
call fcn.140004d80
jmp 0x14009914b
mov rdx, r15
lea rcx, [rbp - 0x79]
call fcn.14005d0e0
nop
mov rax, qword [rbp - 0x79]
mov ebx, dword [rax + 8]
test ebx, ebx
jle 0x1400990ad
mov rcx, qword [rax + 0x10]
cmp word [rcx], 0
je 0x1400990a9
inc r12d
add rcx, 2
cmp r12d, ebx
jl 0x140099095
jmp 0x1400990ad
mov cl, 1
jmp 0x1400990af
xor cl, cl
mov eax, 1
mov edx, 3
test cl, cl
cmovne eax, edx
mov dword [rbp + 0x7f], eax
lea rcx, [rbp - 0x79]
cmp eax, edx
jne 0x1400990fe
add ebx, ebx
call fcn.14000b320
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x11]
call fcn.140005240
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x11]
lock dec dword [rax]
jne 0x140099139
mov rcx, qword [rbp - 0x11]
jmp 0x140099133
lea ebx, [rbx + rbx + 2]
call fcn.14000b320
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x19]
call fcn.140005240
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x19]
lock dec dword [rax]
jne 0x140099139
mov rcx, qword [rbp - 0x19]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x79]
lock dec dword [rax]
jne 0x14009914b
mov rcx, qword [rbp - 0x79]
call fcn.14000ade0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x51]
call fcn.140097ee0
nop
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rcx, rax
call fcn.14000b320
mov rdx, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x7f]
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x51]
lock dec dword [rcx]
jne 0x14009919e
mov rcx, qword [rbp - 0x51]
call fcn.14000ade0
test ebx, ebx
jne 0x1400991ae
mov byte [r13 + 0xd0], bl
jmp 0x140099287
mov edx, ebx
lea rcx, [rbp - 0x21]
call fcn.140097780
nop
lea rdx, [rbp - 0x31]
mov rcx, rax
call fcn.140009fd0
mov rdi, rax
lea rdx, [rbp - 0x41]
lea rcx, [rsp + 0x38]
call fcn.140009fd0
mov rbx, rax
mov rcx, qword [rdi]
mov edx, dword [rcx]
cmp edx, 1
jne 0x1400991f1
mov rdx, qword [rdi]
lea rcx, [rdx + 0x18]
cmp qword [rdx + 0x10], rcx
je 0x1400991ff
mov rcx, qword [rdi]
mov edx, dword [rcx + 8]
mov rcx, rdi
call fcn.140005410
mov rax, qword [rdi]
mov rdi, qword [rax + 0x10]
mov rax, qword [rbx]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x14009921d
mov rcx, qword [rbx]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x14009922b
mov rax, qword [rbx]
mov edx, dword [rax + 8]
mov rcx, rbx
call fcn.140005410
mov rax, qword [rbx]
mov r8, rdi
mov rdx, qword [rax + 0x10]
lea rcx, [0x140d9a480]
call fcn.140015780
nop
mov rax, qword [rbp - 0x41]
lock dec dword [rax]
jne 0x140099255
mov rcx, qword [rbp - 0x41]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x31]
lock dec dword [rax]
jne 0x140099268
mov rcx, qword [rbp - 0x31]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x21]
lock dec dword [rax]
jne 0x14009927a
mov rcx, qword [rbp - 0x21]
call fcn.14000ade0
mov edx, 1
mov rcx, r13
call fcn.14005a4c0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x1400992a6
mov rcx, qword [rsp + 0x30]
call fcn.140004d80
nop
jmp 0x140098d6b
mov edx, 1
mov rcx, r13
call fcn.14005a4c0
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret