Function at 0x1400162b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140031020]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, rcx
mov ecx, 4
mov r12d, 0x80070000
xor r15d, r15d
cmp byte [rbx + 0x1a], r15b
je 0x140016339
movzx eax, word [rbx + 0x18]
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
lea rdx, str.StaticEndpoint
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x1400164c5
lea rcx, [rbx + 0x20]
mov esi, 0xd
or r14, 0xffffffffffffffff
cmp byte [rcx + 0x20], r15b
je 0x1400163a8
cmp qword [rcx + 0x18], 8
jb 0x140016356
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001635f
mov eax, esi
jmp 0x140016395
mov rax, r14
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140016362
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.TestFolder
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140016512
lea rcx, [rbx + 0x48]
cmp byte [rcx + 0x20], r15b
je 0x14001640a
cmp qword [rcx + 0x18], 8
jb 0x1400163bc
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400163f7
inc r14
cmp word [rcx + r14*2], r15w
jne 0x1400163c1
lea eax, [r14*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalEndpoint
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
movzx edi, si
or edi, r12d
test esi, esi
cmovle edi, esi
test edi, edi
js 0x14001655f
cmp byte [rbx + 0x71], r15b
je 0x140016453
mov eax, r15d
cmp byte [rbx + 0x70], r15b
setne al
mov dword [rbp], eax
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.LocalOnly
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001647b
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140018430
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lfence
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
lea rcx, [rbp - 0x68]
call fcn.1400015a4
nop
lea r9, str.LocalOnly
lea r8, str.Failed_to_persist_the__s_setting_to_the_registry.
lea rdx, [rbp - 0x18]
mov rcx, rax
call fcn.140001cc0
mov rdx, rax
mov r9d, 0xc8
lea r8, str.E:BA163_s_srcWex.ServicesTeServiceSettings.cpp
mov ecx, ebx
call fcn.140001a0c
nop
lfence
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x38]
call fcn.1400015a4
nop
lea r9, str.StaticEndpoint
lea r8, str.Failed_to_persist_the__s_setting_to_the_registry.
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.140001cc0
mov rdx, rax
mov r9d, 0xb2
lea r8, str.E:BA163_s_srcWex.ServicesTeServiceSettings.cpp
mov ecx, edi
call fcn.140001a0c
nop
lfence
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
lea rcx, [rsp + 0x58]
call fcn.1400015a4
nop
lea r9, str.TestFolder
lea r8, str.Failed_to_persist_the__s_setting_to_the_registry.
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.140001cc0
mov rdx, rax
mov r9d, 0xbe
lea r8, str.E:BA163_s_srcWex.ServicesTeServiceSettings.cpp
mov ecx, edi
call fcn.140001a0c
nop
lfence
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
lea rcx, [rsp + 0x78]
call fcn.1400015a4
nop
lea r9, str.LocalEndpoint
lea r8, str.Failed_to_persist_the__s_setting_to_the_registry.
lea rdx, [rbp - 0x28]
mov rcx, rax
call fcn.140001cc0
mov rdx, rax
mov r9d, 0xc3
lea r8, str.E:BA163_s_srcWex.ServicesTeServiceSettings.cpp
mov ecx, edi
call fcn.140001a0c
int3