Function at 0x1400d8f18
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, r9
mov r15, r8
mov rbx, rdx
mov r12, rcx
lea r14, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400d8f8a
test byte [rcx + 0x1c], 1
je 0x1400d8f8a
cmp byte [rcx + 0x19], 5
jb 0x1400d8f8a
mov edx, 0x61
mov qword [rax - 0x60], r9
mov qword [rax - 0x68], r8
mov r9, rbx
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.140033380
xor r13d, r13d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140011450
nop
lea rcx, [rbp - 0x30]
call fcn.140043db4
mov r8, qword [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, r12
call fcn.1400d9714
mov esi, eax
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400d8ff9
test byte [r10 + 0x1c], 2
je 0x1400d8ff9
cmp byte [r10 + 0x19], 4
jb 0x1400d8ff9
lea edx, [r13 + 0x62]
mov r9d, eax
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
mov r10, qword [0x140148ea8]
test esi, esi
jne 0x1400d91b6
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.1400d252c
mov r14d, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400d906e
test byte [rcx + 0x1c], 2
je 0x1400d906e
cmp byte [rcx + 0x19], 4
jb 0x1400d906e
lea edx, [rsi + 0x63]
mov r9d, r14d
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rbx, qword [rbp - 0x28]
test r14d, r14d
jne 0x1400d909c
mov rax, rbx
mov r8, rdi
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400d9094
add rax, 2
test edx, edx
jne 0x1400d9080
test ecx, ecx
je 0x1400d9186
mov eax, r13d
test rdi, rdi
setne al
test eax, eax
jne 0x1400d90b4
mov ecx, 0x80004005
call fcn.1400119f0
int3
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r13w
jne 0x1400d90b8
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400d9121
test byte [rcx + 0x1c], 2
je 0x1400d9121
cmp byte [rcx + 0x19], 4
jb 0x1400d9121
mov edx, 0x64
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test r14d, r14d
jne 0x1400d9186
mov rax, qword [r12]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [fcn.140015690]
mov edx, 0x3ec
mov rcx, r12
call rdi
mov ecx, eax
xor r9d, r9d
mov r8, r15
mov rdx, qword [rbp - 0x30]
call fcn.1400dbde0
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400d9186
test byte [rcx + 0x1c], 2
je 0x1400d9186
cmp byte [rcx + 0x19], 4
jb 0x1400d9186
lea edx, [r14 + 0x65]
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
nop
lea r14, [rbx - 0x18]
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400d91ad
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, r14
mov rcx, rdi
call rbx
lea r14, [0x140148ea8]
jmp 0x1400d91e8
cmp esi, 2
jne 0x1400d91ef
mov esi, 0x490
cmp r10, r14
je 0x1400d9229
test byte [r10 + 0x1c], 2
je 0x1400d91ef
cmp byte [r10 + 0x19], 4
jb 0x1400d91ef
mov edx, 0x66
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fcb0
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400d9229
test byte [r10 + 0x1c], 1
je 0x1400d9229
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400d9229
mov edx, 0x67
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
nop
mov r14, qword [rbp - 0x30]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400d9253
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400d9262
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret