Function at 0x140009938
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140012aa8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r14d, ecx
call fcn.14000af50
xor r12d, r12d
mov dword [rbp - 0x60], 0xc8
mov qword [rbp - 0x58], r12
mov ecx, r12d
mov qword [rbp - 0x80], rcx
mov rsi, rax
mov qword [rbp - 0x68], r12
mov r15d, r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
test rax, rax
je 0x140009d7d
lea rax, [rbp - 0x58]
mov ebx, 0x20019
mov rdi, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rcx, rdi
xor r8d, r8d
mov rdx, rsi
call fcn.14000c684
test eax, eax
jne 0x140009d62
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x68]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CurVer
call fcn.14000c684
test eax, eax
jne 0x140009d62
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rax, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14000c6f0
test eax, eax
jne 0x140009d62
lea rax, [rbp - 0x78]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14000c684
test eax, eax
jne 0x140009d62
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.shellopen
call fcn.14000c684
test eax, eax
jne 0x140009d62
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.shell_new
call fcn.14000c684
test eax, eax
mov edi, r12d
mov ebx, r12d
setne dil
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
test ebx, ebx
je 0x140009abf
cmp r14d, 4
je 0x140009ceb
mov r9d, 1
lea rdx, [rsp + 0x70]
mov r8d, ebx
mov rcx, 0xffffffff80000001
call fcn.1400034fc
test eax, eax
je 0x140009cfe
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.Default_Editor
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
call fcn.14000c590
test eax, eax
jne 0x140009cfe
mov rcx, rsi
call fcn.14000b568
mov rcx, qword [rsp + 0x60]
lea rdx, [0x140011d00]
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call sub.ADVAPI32.dll_RegSetValueExW
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.shell
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
call fcn.14000c590
test eax, eax
jne 0x140009cfe
mov rcx, qword [rsp + 0x50]
lea rdx, str.edit
call fcn.140002424
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.edit
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
call fcn.14000c590
test eax, eax
jne 0x140009cfe
test edi, edi
je 0x140009c49
mov rdx, qword [0x1400150e0]
mov rcx, qword [rsp + 0x50]
call fcn.140002424
mov rdx, qword [0x1400150e0]
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
call fcn.14000c590
test eax, eax
mov edi, r12d
sete dil
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rbp - 0x80]
call fcn.140002168
test edi, edi
je 0x140009c6f
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
mov rcx, qword [rbp - 0x70]
call fcn.140002168
mov rdx, qword [rsp + 0x58]
mov r8d, ebx
mov rcx, 0xffffffff80000001
call fcn.1400056a4
mov rcx, qword [rsp + 0x68]
test eax, eax
je 0x140009d03
test rcx, rcx
je 0x140009c97
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], r12
test rcx, rcx
je 0x140009cac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
test rcx, rcx
je 0x140009cc1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
test rcx, rcx
je 0x140009cd6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], r12
test rcx, rcx
je 0x140009ceb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, 1
jle 0x140009a98
mov r15d, 1
jmp 0x140009d62
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140009d0e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], r12
test rcx, rcx
je 0x140009d23
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
test rcx, rcx
je 0x140009d38
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
test rcx, rcx
je 0x140009d4d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], r12
test rcx, rcx
je 0x140009d62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.140001aa8
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140009d79
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x70], r12
test rcx, rcx
je 0x140009d8c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x80], r12
test rcx, rcx
je 0x140009d9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x68]
mov qword [rbp - 0x78], r12
test rcx, rcx
je 0x140009db2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x68], r12
test rcx, rcx
je 0x140009dc5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14000db20
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret