Function at 0x140004dd4
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov rax, qword [0x140013130]
xor rax, rbp
mov qword [rbp + 0x40], rax
mov r15, rcx
mov qword [rbp + 0x38], rcx
xor r14d, r14d
mov ecx, 0x2000
mov qword [rbp + 0x30], r9
mov r12, r8
mov ebx, r14d
mov qword [rbp], r8
mov qword [rbp + 0x18], rdx
call qword [sym.imp.msvcrt.dll_malloc]
mov r13, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140004e4a
mov eax, 0x8007000e
jmp 0x140005417
mov rdx, rax
mov rcx, r15
call fcn.140005964
mov edi, eax
test eax, eax
js 0x14000519a
mov eax, dword [0x140013ec8]
mov ecx, 0x13
lea edx, [rcx - 2]
lea r8d, [rcx - 0xb]
test al, 1
jne 0x140004ebe
or eax, 1
mov word [0x140013ed8], r8w
mov word [0x140013ee8], cx
mov dword [0x140013ec8], eax
lea rax, [0x1400012e4]
mov word [0x140013ef8], dx
mov qword [0x140013ed0], rax
lea rax, [0x1400012e8]
mov qword [0x140013ee0], rax
lea rax, [0x1400012ec]
mov qword [0x140013ef0], rax
mov edi, r14d
lea rsi, [0x140013ed0]
mov rdx, qword [rsi]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x140004eed
inc edi
add rsi, 0x10
cmp edi, 3
jb 0x140004ec8
mov edi, 0x80020009
jmp 0x14000519a
lea rcx, [0x140013ed0]
movsxd rax, edi
add rax, rax
movzx r14d, word [rcx + rax*8 + 8]
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140005195
mov rcx, qword [r15]
movzx eax, word [rcx]
cmp eax, 9
jl 0x140004f3c
cmp eax, 0xa
jle 0x140004f31
cmp eax, 0xd
je 0x140004f31
cmp eax, 0x20
jne 0x140004f3c
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov qword [r15], rax
jmp 0x140004f17
mov rdx, rdi
mov rcx, r15
call fcn.140005964
xor r10d, r10d
mov esi, eax
test eax, eax
jns 0x140004f60
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov edi, esi
jmp 0x14000519a
movzx eax, r14w
cmp eax, 8
je 0x140005136
cmp eax, 0x11
je 0x140004fc4
cmp eax, 0x13
jne 0x1400053c3
lea r9, [rbp + 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r11d, dword [rbp + 0x28]
lea rax, [rbp]
mov dword [rsp + 0x28], 4
mov dword [rbp], r11d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, qword [rbp + 0x18]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
jmp 0x1400053c3
or r14, 0xffffffffffffffff
inc r14
cmp word [rdi + r14*2], r10w
jne 0x140004fc8
test r14b, 1
je 0x140004feb
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov edi, 0x80004005
jmp 0x14000519a
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
cmp r12d, 0x400
ja 0x140005038
mov rcx, r12
mov rsi, r12
call fcn.140005604
xor r10d, r10d
test al, al
je 0x140005038
lea rax, [r12 + 0xf]
cmp rax, r12
ja 0x140005025
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14000f140
sub rsp, rax
lea r15, [rsp + 0x30]
jmp 0x140005062
lea rcx, [r12 + 0x10]
mov rsi, r12
cmp rcx, r12
jae 0x14000504a
mov r15, r10
jmp 0x140005062
call qword [sym.imp.msvcrt.dll_malloc]
xor r10d, r10d
test rax, rax
je 0x140005045
mov qword [rax], r10
mov rbx, rax
lea r15, [rax + 0x10]
test r15, r15
jne 0x140005090
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r13
jmp 0x14000507b
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
jne 0x140005075
mov eax, 0x80004005
jmp 0x140005417
mov r8, rsi
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
xor eax, eax
movsxd r10, r14d
mov r11d, eax
mov r9d, eax
test r14d, r14d
jle 0x14000511d
xor r13d, r13d
movzx r8d, word [rdi + r9*2]
mov eax, r8d
cmp r8d, 0x30
jl 0x1400050e7
cmp eax, 0x39
jle 0x1400050e1
cmp eax, 0x40
jle 0x1400050e7
cmp eax, 0x46
jle 0x1400050db
add eax, 0xffffff9f
cmp eax, 5
ja 0x1400050e7
sub r8b, 0x57
jmp 0x1400050ea
sub r8b, 0x37
jmp 0x1400050ea
sub r8b, 0x30
jmp 0x1400050ea
mov r8b, r13b
mov eax, r11d
mov ecx, r11d
inc r9
cdq
and ecx, 1
inc r11d
sub eax, edx
shl ecx, 2
sar eax, 1
movsxd rdx, eax
mov eax, 4
sub eax, ecx
mov cl, al
shl r8b, cl
or byte [rdx + r15], r8b
cmp r9, r10
jl 0x1400050b0
mov r13, qword [rbp + 8]
mov rdx, qword [rbp]
mov dword [rsp + 0x28], r12d
mov r9d, 3
mov qword [rsp + 0x20], r15
jmp 0x140004faf
or r14, 0xffffffffffffffff
mov rcx, rdi
mov r13, r10
cmp byte [rbp + 0xa0], r10b
je 0x14000537d
mov rax, r14
inc rax
cmp word [rdi + rax*2], r10w
jne 0x140005150
cmp eax, 0xffe
jle 0x140005172
call qword [sym.imp.msvcrt.dll_free]
mov r13, qword [rbp + 8]
mov edi, 0x80004005
jmp 0x14000519a
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
xor r12d, r12d
mov r13, rax
test rax, rax
jne 0x1400051aa
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov r13, qword [rbp + 8]
mov edi, 0x8007000e
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x140005417
mov rsi, qword [r15 + 8]
lea rax, [rsi + 0x10]
mov rcx, rax
mov qword [rbp + 0x20], rax
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov r15d, r12d
cmp dword [rsi + 8], r12d
jle 0x140005203
mov rax, qword [rsi]
lea rdx, [0x140001b50]
mov rcx, qword [r12 + rax]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x1400051f5
inc r15d
add r12, 8
cmp r15d, dword [rsi + 8]
jl 0x1400051c8
xor r12d, r12d
jmp 0x140005203
mov rax, qword [rsi]
movsxd rcx, r15d
mov rcx, qword [rax + rcx*8]
mov r12, qword [rcx + 8]
mov rcx, qword [rbp + 0x20]
mov qword [rbp + 0x10], r12
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
xor r10d, r10d
test r12, r12
je 0x140005376
mov rsi, rdi
cmp word [r12], r10w
je 0x1400052a2
cmp word [rdi], r10w
je 0x14000529f
mov r15, rsi
cmp word [rsi], r10w
je 0x14000527f
cmp word [r12], r10w
je 0x1400052a2
movzx ecx, word [r15]
movzx eax, word [r12]
cmp ecx, eax
jne 0x14000527f
mov rcx, r15
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rcx, r12
mov qword [rbp + 0x20], rax
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rdx, qword [rbp + 0x20]
sub rax, r12
mov rcx, rdx
sub rcx, r15
xor rax, rcx
test rax, 0xfffffffffffffffe
je 0x14000535f
xor r10d, r10d
cmp word [r12], r10w
je 0x1400052a2
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov r12, qword [rbp + 0x10]
xor r10d, r10d
mov rsi, rax
cmp word [rax], r10w
jne 0x14000522d
mov rsi, r10
test rsi, rsi
je 0x140005376
cmp rsi, qword [rbp + 0x30]
je 0x1400052ca
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharPrevW]
xor r10d, r10d
cmp word [rax], 0x22
je 0x140005376
mov r8, rsi
mov rdx, rdi
mov rcx, r13
sub r8, rdi
mov word [r13], r10w
sar r8, 1
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
mov r12d, 0x1000
lea r8, [0x140001b60]
mov edx, r12d
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov r15, qword [rbp + 0x10]
mov edx, r12d
mov r8, r15
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcscat_s]
lea r8, [0x140001b60]
mov edx, r12d
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov rax, r14
xor ecx, ecx
inc rax
cmp word [r15 + rax*2], cx
jne 0x140005328
lea r8, [rsi + rax*2]
mov rdx, r12
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov rcx, r13
xor r10d, r10d
jmp 0x140005379
add r15, 2
add r12, 2
movzx ecx, word [r15]
movzx eax, word [r12]
cmp ecx, eax
je 0x140005364
cmp r15, rdx
jb 0x14000534a
xor r10d, r10d
cmp word [r15], r10w
jne 0x140005236
jmp 0x14000527f
mov rcx, rdi
mov r12, qword [rbp]
inc r14
cmp word [rcx + r14*2], r10w
jne 0x14000537d
lea eax, [r14*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx]
mov rdx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test r13, r13
je 0x1400053bf
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
mov r13, qword [rbp + 8]
mov rdx, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
call fcn.140005964
mov rcx, rdi
mov esi, eax
test eax, eax
jns 0x1400053f9
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r13
jmp 0x1400053ea
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
jne 0x1400053e4
mov eax, esi
jmp 0x140005417
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r13
jmp 0x14000540a
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
jne 0x140005404
xor eax, eax
mov rcx, qword [rbp + 0x40]
xor rcx, rbp
call fcn.14000e510
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret