Function at 0x140026500
Capabilities:
Set registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], r12
mov rax, qword [0x14004d2c0]
xor rax, rbp
mov qword [rbp + 0x30], rax
mov r14, r9
mov rbx, r8
mov rcx, rdx
call fcn.14002fb20
test rax, rax
jne 0x14002654d
mov eax, 0x80004005
jmp 0x140026781
mov rcx, rbx
call fcn.14002ad60
mov r15, rax
lea rcx, [rbp + 0x10]
call fcn.14002fef0
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.140030d30
test al, al
jne 0x14002657e
mov eax, 1
jmp 0x140026774
mov rsi, qword [rbp + 0x88]
test rsi, rsi
jne 0x140026592
lea eax, [rsi + 0x57]
jmp 0x140026774
cmp word [rsi], 1
jne 0x14002676f
cmp dword [rsi + 4], 1
jne 0x14002676f
cmp dword [rsi + 0x1c], 0
jne 0x14002676f
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x140026774
movabs r12, 0xffffffffffffff0
test r14, r14
jne 0x1400265dd
xor ebx, ebx
mov edi, ebx
jmp 0x140026666
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400265e4
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x140026600
xor ebx, ebx
mov edi, ebx
jmp 0x140026666
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140026616
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039e40
sub rsp, rcx
lea rdi, [rsp + 0x50]
xor ebx, ebx
test rdi, rdi
je 0x140026663
mov byte [rdi], bl
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9d, [rbx - 1]
mov r8, r14
xor edx, edx
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
jmp 0x140026666
mov rdi, rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140026764
mov r14d, dword [rsi + 0x18]
mov r15, qword [rbp + 8]
mov r8, qword [rbp + 0x80]
test r8, r8
jne 0x1400266bb
mov rdi, rbx
jmp 0x14002673a
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x1400266c2
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400266b3
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400266ee
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039e40
sub rsp, rcx
lea rdi, [rsp + 0x50]
test rdi, rdi
je 0x140026737
mov byte [rdi], 0
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
xor edx, edx
lea ecx, [rdx + 3]
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
jmp 0x14002673a
mov rdi, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 3
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x140026776
mov eax, 0x80004005
mov ebx, eax
lea rcx, [rbp + 0x10]
call fcn.1400300f0
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rbp
call fcn.140039850
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
mov r12, qword [rbp + 0x78]
lea rsp, [rbp + 0x40]
pop r15
pop r14
pop rbp
ret