Function at 0x7ff4b41a1a4
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
cmp dword [0x7ff4b426e6c], 0
mov rdi, rcx
movabs rsi, 0x4000000000000000
je 0x7ff4b41a205
mov al, byte [0x7ff4b426e70]
cmp al, 4
jae 0x7ff4b41a1d7
test al, al
jne 0x7ff4b41a205
test qword [0x7ff4b426e58], rsi
je 0x7ff4b41a205
mov rcx, qword [0x7ff4b426e60]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x7ff4b41a205
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405ca0]
call fcn.7ff4b4123dc
cmp qword [rdi + 0x40], 0
jne 0x7ff4b41a213
xor ebx, ebx
jmp 0x7ff4b41a514
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
js 0x7ff4b41a514
mov rdx, qword [rdi + 0x40]
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r13d, [r9 + 2]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r8d, r13d
xor ecx, ecx
call sub.wevtapi.dll_EvtRender
test eax, eax
je 0x7ff4b41a272
mov ebx, 0x8000ffff
jmp 0x7ff4b41a514
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x7ff4b41a290
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x7ff4b41a514
mov ecx, dword [rsp + 0x90]
mov esi, ecx
and esi, 0xf
je 0x7ff4b41a2ae
mov eax, 0x10
sub eax, esi
add ecx, eax
mov dword [rsp + 0x90], ecx
xor ebp, ebp
cmp ebp, dword [rsp + 0xa0]
jae 0x7ff4b41a32c
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x98]
mov edx, ebp
call fcn.7ff4b41ca64
mov ebx, eax
test eax, eax
js 0x7ff4b41a31f
mov r8, qword [rsp + 0x98]
mov ecx, 0x10
cmp qword [r8 + 0x60], 0
je 0x7ff4b41a304
mov rax, qword [r8 + 0x60]
mov ecx, dword [rax + 4]
lea ecx, [rcx + rcx + 8]
mov edx, ecx
and edx, 0xf
je 0x7ff4b41a301
mov eax, 0x10
sub eax, edx
add ecx, eax
add ecx, 0x10
mov eax, dword [rsp + 0x90]
lea edx, [rax + rcx + 0x10]
mov rcx, r8
mov dword [rsp + 0x90], edx
mov rax, qword [r8]
call qword [rax + 0x10]
mov ecx, dword [rsp + 0x90]
inc ebp
test ebx, ebx
jns 0x7ff4b41a2b0
test ebx, ebx
js 0x7ff4b41a50a
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbp, rax
test rax, rax
jne 0x7ff4b41a34b
mov ebx, 0x8007000e
jmp 0x7ff4b41a50a
mov r9d, dword [rsp + 0x90]
mov rdx, qword [rdi + 0x40]
and dword [rsp + 0x98], 0
lea rax, [rsp + 0xa8]
mov r8d, r13d
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call sub.wevtapi.dll_EvtRender
test eax, eax
jne 0x7ff4b41a3af
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x7ff4b41a502
mov ecx, dword [rsp + 0x98]
test esi, esi
je 0x7ff4b41a3ca
mov eax, 0x10
sub eax, esi
add ecx, eax
mov dword [rsp + 0x98], ecx
mov r12d, dword [rsp + 0x90]
mov r14d, ecx
sub r12d, ecx
add r14, rbp
xor esi, esi
cmp esi, dword [rsp + 0xa0]
jae 0x7ff4b41a4a2
cmp r12d, 0x10
jae 0x7ff4b41a3fa
mov ebx, 0x8007007a
jmp 0x7ff4b41a498
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x40]
mov edx, esi
call fcn.7ff4b41ca64
mov ebx, eax
test eax, eax
js 0x7ff4b41a498
mov r13, qword [rsp + 0x40]
mov ecx, 0x10
cmp qword [r13 + 0x60], 0
je 0x7ff4b41a443
mov rax, qword [r13 + 0x60]
mov ecx, dword [rax + 4]
lea ecx, [rcx + rcx + 8]
mov edx, ecx
and edx, 0xf
je 0x7ff4b41a440
mov eax, 0x10
sub eax, edx
add ecx, eax
add ecx, 0x10
mov dword [r14], ecx
mov rax, qword [r13 + 0x30]
add r12d, 0xfffffff0
mov edx, dword [rax + 8]
add r14, 0x10
lea r9, [rsp + 0x98]
mov dword [r14 - 0xc], edx
mov rax, qword [r13 + 0x30]
mov r8, r14
mov dl, byte [rax + 0xc]
mov rcx, r13
mov byte [r14 - 8], dl
mov edx, r12d
call fcn.7ff4b41d918
mov rcx, r13
mov ebx, eax
mov rax, qword [r13]
call qword [rax + 0x10]
mov eax, dword [rsp + 0x98]
add r14, rax
sub r12d, dword [rsp + 0x98]
inc esi
test ebx, ebx
jns 0x7ff4b41a3dd
test ebx, ebx
js 0x7ff4b41a502
mov esi, dword [rsp + 0x90]
lea r8, [rsp + 0x40]
mov edx, 2
mov rcx, rdi
call fcn.7ff4b419cb4
mov ebx, eax
test eax, eax
js 0x7ff4b41a502
mov rcx, qword [rsp + 0x40]
lea rdx, [0x7ff4b40f480]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movabs rsi, 0x4000000000000000
cmp dword [0x7ff4b426e6c], 0
je 0x7ff4b41a5b6
mov al, byte [0x7ff4b426e70]
cmp al, 4
jae 0x7ff4b41a52f
test al, al
jne 0x7ff4b41a55d
test qword [0x7ff4b426e58], rsi
je 0x7ff4b41a55d
mov rcx, qword [0x7ff4b426e60]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x7ff4b41a55d
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405cb0]
call fcn.7ff4b4123dc
cmp dword [0x7ff4b426e6c], 0
je 0x7ff4b41a5b6
mov al, byte [0x7ff4b426e70]
cmp al, 4
jae 0x7ff4b41a574
test al, al
jne 0x7ff4b41a5b6
movabs rdx, 0x8000000000000000
test qword [0x7ff4b426e58], rdx
je 0x7ff4b41a5b6
mov rcx, qword [0x7ff4b426e60]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x7ff4b41a5b6
mov r8, qword [rdi + 0x10]
mov rcx, qword [0x7ff4b426e40]
lea rdx, [0x7ff4b405ba0]
mov r8, qword [r8]
mov r9d, ebx
call fcn.7ff4b410520
mov eax, ebx
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret