Function at 0x140020960
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rcx + 0xa4]
lea rbx, [rcx + 0xa0]
xor r13d, r13d
test rbx, rbx
je 0x140020998
lea rcx, [rbx - 0xa0]
jmp 0x14002099b
mov rcx, r13
mov edx, 0x402
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsi], eax
lea rbp, [rdi + 0xac]
test rbx, rbx
je 0x1400209d5
lea rcx, [rbx - 0xa0]
jmp 0x1400209d8
mov rcx, r13
mov edx, 0x40f
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp], eax
lea r12, [rdi + 0xa8]
test rbx, rbx
je 0x140020a13
lea rcx, [rbx - 0xa0]
jmp 0x140020a16
mov rcx, r13
mov edx, 0x410
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [r12], eax
mov qword [rsp + 0xc8], r13
mov rax, qword [0x140056018]
mov qword [rsp + 0x50], rax
lea rax, str.Mount
mov qword [rsp + 0x20], rax
lea r9, [0x140045b00]
lea r8, [0x140045b00]
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x50]
call fcn.1400121a0
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
lea rcx, [rbx - 0xc]
or edi, 0xffffffff
cmp rcx, qword [0x140056010]
je 0x140020ae6
mov eax, edi
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x140020ae6
call fcn.140025104
nop
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r12
mov r9d, 4
xor r8d, r8d
lea rdx, str.OpenDrive
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0xc0], r13
mov rax, qword [0x140056018]
mov qword [rsp + 0x58], rax
lea rax, str.MountMenuItems
mov qword [rsp + 0x20], rax
lea r9, [0x140045b00]
lea r8, [0x140045b00]
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x58]
call fcn.1400121a0
lea r11, [rsp + 0xb8]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140056010]
je 0x140020bb4
lock xadd dword [rcx], edi
dec edi
test edi, edi
jg 0x140020bb4
call fcn.140025104
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbp
mov r9d, 4
xor r8d, r8d
lea rdx, str.Casscade
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
mov r9d, 4
xor r8d, r8d
lea rdx, str.IntegrateExplorer
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140020c1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140020c35
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140020c37
xor eax, eax
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret