Function at 0x140007950
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
call fcn.1400021cc
test rax, rax
je 0x140007b04
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x14002bc4c]
lea rcx, [rsp + 0x58]
call fcn.140001318
test al, al
jne 0x1400079b7
mov r8d, 2
lea rdx, [0x14002bc4c]
lea rcx, [rsp + 0x58]
call fcn.1400014c0
nop
mov rsi, qword [rbp + 0x28]
mov r10, qword [rsi + 8]
mov r8, r10
mov rdi, rsi
mov rbx, qword [rsp + 0x58]
cmp byte [r10 + 0x19], 0
jne 0x140007a4a
test rbx, rbx
je 0x140007b04
mov r9, qword [r8 + 0x20]
mov rax, r9
mov r11, rbx
sub r11, r9
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r11]
sub edx, ecx
jne 0x140007a04
add rax, 2
test ecx, ecx
jne 0x1400079f0
test edx, edx
jns 0x140007a0e
mov r8, qword [r8 + 0x10]
jmp 0x140007a43
cmp byte [rdi + 0x19], 0
je 0x140007a3d
test r9, r9
je 0x140007b04
mov rax, rbx
sub r9, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x140007a37
add rax, 2
test ecx, ecx
jne 0x140007a23
test edx, edx
cmovs rdi, r8
mov rsi, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x1400079d1
cmp byte [rdi + 0x19], 0
jne 0x140007a53
mov r10, qword [rdi]
cmp byte [r10 + 0x19], 0
jne 0x140007a9e
nop word [rax + rax]
mov r8, qword [r10 + 0x20]
test r8, r8
je 0x140007b04
mov rax, rbx
sub r8, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140007a87
add rax, 2
test ecx, ecx
jne 0x140007a73
test edx, edx
jns 0x140007a93
mov rdi, r10
mov r10, qword [r10]
jmp 0x140007a97
mov r10, qword [r10 + 0x10]
cmp byte [r10 + 0x19], 0
je 0x140007a60
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.1400080a0
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007add
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8d, 1
lea rdx, [0x14002bc4c]
mov rcx, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp 0x140007cc0
mov ecx, 0x80004005
call fcn.140001fa4
int3
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140031040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rcx + 8]
mov rsi, rcx
mov rdi, rdx
mov dword [rsp + 0x60], r8d
xor edx, edx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
or eax, 2
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov rcx, qword [rsi]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
xor bl, bl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
mov rdx, qword [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140007d63
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rdx, rdi
mov rcx, rsi
call fcn.1400072b0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009320
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret