Function at 0x14000db20
Capabilities:
Set registry value

Disassembly:
push r12
push r15
sub rsp, 0x58
mov r12, rcx
lea rcx, [0x140072ab0]
call fcn.14001e310
mov qword [rsp + 0x78], rax
mov r15, rax
test rax, rax
jne 0x14000db4d
add rsp, 0x58
pop r15
pop r12
ret
mov qword [rsp + 0x30], r14
call fcn.140009460
mov qword [rsp + 0x80], rax
mov r14, rax
test rax, rax
jne 0x14000db80
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x30]
xor al, al
add rsp, 0x58
pop r15
pop r12
ret
mov qword [rsp + 0x70], rbx
lea rcx, [0x140072ab0]
mov qword [rsp + 0x50], rbp
mov rdx, rax
mov qword [rsp + 0x48], rsi
mov sil, 1
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
call fcn.14001ee10
mov r13, qword [r12 + 8]
mov qword [rsp + 0x88], rax
xor eax, eax
mov ebp, eax
test r13, r13
je 0x14000dd4f
xor r14d, r14d
nop dword [rax + rax]
test sil, sil
je 0x14000dd47
mov rax, qword [r12]
mov r15, qword [rax + rbp*8]
call fcn.140009460
mov rbx, rax
test rax, rax
je 0x14000dd33
lea ecx, [rbp + 1]
call fcn.14001d140
mov rdi, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x14000dc04
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x14000dc15
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.140038534
mov rsi, rax
test rax, rax
jne 0x14000dc3f
mov rcx, rbx
jmp 0x14000dd2e
mov word [rax], r14w
lea rcx, [rax - 2]
nop word [rax + rax]
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x14000dc50
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000dc60
lea rdx, [rsi - 2]
cmp word [rdx + 2], r14w
lea rdx, [rdx + 2]
jne 0x14000dc75
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi + r8*2]
mov word [rdx + r8*2], ax
lea r8, [r8 + 1]
test ax, ax
jne 0x14000dc90
mov rcx, rbx
call fcn.140038520
mov rcx, rdi
call fcn.140038520
mov r8d, dword [0x140071050]
mov rcx, r15
mov rdx, qword [0x140071058]
call fcn.14000f300
mov rbx, rax
test rax, rax
je 0x14000dd2b
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rax + rcx*2 + 2], r14w
lea rcx, [rcx + 1]
jne 0x14000dce0
mov r15, qword [rsp + 0x78]
lea eax, [rcx*2 + 2]
mov dword [rsp + 0x28], eax
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.140038520
mov rcx, rsi
call fcn.140038520
mov sil, 1
jmp 0x14000dd3b
mov rcx, rsi
call fcn.140038520
mov r15, qword [rsp + 0x78]
xor sil, sil
inc rbp
cmp rbp, r13
jb 0x14000dbd0
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
lea rbp, [r13 + 1]
mov r13, qword [rsp + 0x38]
cmp rbp, r12
ja 0x14000de3b
nop dword [rax]
mov ecx, ebp
call fcn.14001d140
mov rbx, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14000dd81
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x14000dd92
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.140038534
mov rdi, rax
test rax, rax
je 0x14000de72
xor eax, eax
lea rcx, [rdi - 2]
mov word [rdi], ax
cmp word [rcx + 2], ax
lea rcx, [rcx + 2]
jne 0x14000ddc2
xor edx, edx
nop
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000ddd0
lea rax, [rdi - 2]
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x14000ddf0
xor edx, edx
nop dword [rax]
movzx ecx, word [rbx + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x14000de00
mov rcx, rbx
call fcn.140038520
mov rdx, rdi
mov rcx, r15
call fcn.14001e470
mov rcx, rdi
and sil, al
call fcn.140038520
inc rbp
cmp rbp, r12
jbe 0x14000dd70
mov rcx, r14
call fcn.140038520
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x30]
add rsp, 0x58
pop r15
pop r12
ret
mov rcx, r14
call fcn.140038520
xor al, al
jmp 0x14000de50