Function at 0x1401e83df
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, reloc.WS2_32.dll_recv
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1401e83fd
sub rsp, 0x28
call fcn.140014500
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400145c0
add rsp, 0x10
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400145c0
add rsp, 0x10
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.1400145c0
add rsp, 0x10
mov qword [rsp + 0x48], 0x20006
cmp qword [rsp + 0xe8], 0
je 0x1401e848a
mov r15, qword [rsp + 0x48]
or r15, 0x200
mov qword [rsp + 0x48], r15
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140012aa0
add rsp, 0x28
call fcn.1400147e0
movabs rcx, 0x14018c2cc
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014800
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.140014830
or rax, rax
je 0x1401e855a
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012b40
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.1400133f0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140014430
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.1400133f0
add rsp, 0x28
call fcn.1400147e0
movabs rcx, 0x14018c2cc
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014800
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.140014830
or rax, rax
je 0x1401e862a
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012b40
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140012aa0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140014430
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e86e2
movsxd r15, dword [rsp + 0xe0]
cmp r15, 3
je 0x1401e866f
movabs rax, 0x14018e9a8
mov r8, rax
movabs rdx, gethostname
mov rcx, qword [rsp + 0xf0]
call fcn.140013a80
jmp 0x1401e86e2
mov rbp, qword [rsp + 0xf0]
mov dword [rbp], 0
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 8], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x14018c028
lea rcx, [rbp + 0xc]
call fcn.140014630
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 0x14], 0
mov rbp, qword [rsp + 0xf0]
mov qword [rbp + 0x18], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x14018c028
lea rcx, [rbp + 0x28]
call fcn.140014630
sub rsp, 8
lea rax, [rsp + 0x78]
push rax
lea rax, [rsp + 0x60]
push rax
push 0
push qword [rsp + 0x68]
push 0
xor rax, rax
mov r9, rax
movabs r8, 0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCreateKeyExW
add rsp, 0x50
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1401e87b2
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e8798
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400147a0
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x50]
sub rsp, 0x20
call fcn.1401ea357
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.140014430
cmp qword [rsp + 0x50], 0
je 0x1401e87aa
mov rcx, qword [rsp + 0x50]
call sub.ADVAPI32.dll_RegCloseKey
xor rax, rax
jmp 0x1401e8e02
movsxd rax, dword [rsp + 0xe0]
push rax
mov r15, 3
cmp r15d, dword [rsp]
jne 0x1401e892d
mov r15, qword [rsp + 0xf8]
and r15, r15
jne 0x1401e883a
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e8818
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffd
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.140014630
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e8e02
mov rbp, qword [rsp + 0xf8]
movsxd rax, dword [rbp + 4]
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0xf8]
push qword [rbp + 0x20]
pop rax
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x60]
and r15, r15
jne 0x1401e88c7
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e88a5
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffe
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_No_Pointer_to_BINARY_defined_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.140014630
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e8e02
mov r15, qword [rsp + 0x68]
and r15, r15
jne 0x1401e88ec
sub rsp, 8
mov rcx, qword [rsp + 0x68]
sub rsp, 0x20
call fcn.140013b50
add rsp, 0x28
mov qword [rsp + 0x68], rax
sub rsp, 8
push qword [rsp + 0x70]
push qword [rsp + 0x70]
movabs r9, 3
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e8d7f
mov r15, 4
cmp r15d, dword [rsp]
jne 0x1401e899e
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140013900
add rsp, 0x28
mov dword [rsp + 0x98], eax
sub rsp, 8
push 4
lea rax, [rsp + 0xa8]
push rax
movabs r9, 4
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e8d7f
mov r15, ntohl
cmp r15d, dword [rsp]
jne 0x1401e8a10
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140013900
add rsp, 0x28
mov qword [rsp + 0xa0], rax
sub rsp, 8
push 8
lea rax, [rsp + 0xb0]
push rax
movabs r9, ntohl
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e8d7f
mov r15, 2
cmp r15d, dword [rsp]
je 0x1401e8a2a
mov r15, 1
cmp r15d, dword [rsp]
jne 0x1401e8a81
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140013550
add rsp, 0x20
add rax, 2
push rax
mov rax, qword [rsp + 0x50]
push rax
movsxd rax, dword [rsp + 0x100]
mov r9, rax
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e8d7f
mov r15, 7
cmp r15d, dword [rsp]
jne 0x1401e8d7f
sub rsp, 8
movabs rax, reloc.WS2_32.dll_ioctlsocket
mov rdx, rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.1400126a0
add rsp, 0x28
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
jmp 0x1401e8ac8
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x1401e8b85
push rcx
sub rsp, 0x20
call fcn.1400147a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
mov rdx, rax
mov rcx, qword [rsp + 0x58]
pop r8
pop r9
sub rsp, 0x20
call fcn.1400135f0
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.140014430
add rsp, 0x28
mov r15, qword [rsp + 0x68]
sub rsp, 8
movabs rdx, 0x19
mov rcx, qword [rsp + 0x90]
sub rsp, 0x20
call fcn.140013580
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x68], r15
inc qword [rsp + 0x80]
jno 0x1401e8ac8
cmp qword [rsp + 0x68], 0
je 0x1401e8d7f
sub rsp, 8
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call fcn.140013a30
add rsp, 0x28
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1401e8d1e
mov qword [rsp + 0x80], 0
jmp 0x1401e8bc6
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x1401e8cc6
push rcx
sub rsp, 0x20
call fcn.1400147a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
mov rdx, rax
mov rcx, qword [rsp + 0x58]
pop r8
pop r9
sub rsp, 0x20
call fcn.1400135f0
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.140014430
add rsp, 0x28
sub rsp, 8
push 0x19
push 0xffffffffffffffff
push qword [rsp + 0xa0]
mov r15, qword [rsp + 0x80]
add r15, qword [rsp + 0xb0]
mov rax, r15
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140013e00
add rsp, 0x28
mov r15, qword [rsp + 0x90]
sub rsp, 8
movabs rdx, 0x19
mov rcx, qword [rsp + 0x90]
sub rsp, 0x20
call fcn.140013580
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x90], r15
inc qword [rsp + 0x80]
jno 0x1401e8bc6
sub rsp, 8
mov rax, qword [rsp + 0x70]
push rax
push qword [rsp + 0x70]
movsxd rax, dword [rsp + 0x100]
push rax
xor rax, rax
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
pop r9
sub rsp, 0x20
call qword [0x1401d3658]
add rsp, 0x30
add rsp, 8
mov qword [rsp + 0x48], rax
sub rsp, 8
mov rcx, qword [rsp + 0x68]
sub rsp, 0x20
call fcn.140013b00
add rsp, 0x28
jmp 0x1401e8d7f
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e8d5d
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xffffffff
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Cant_allocate_memory
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.140014630
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e8e02
pop rax
mov rcx, qword [rsp + 0x50]
call sub.ADVAPI32.dll_RegCloseKey
cmp qword [rsp + 0x40], 0
je 0x1401e8df8
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e8df3
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400147a0
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x50]
sub rsp, 0x20
call fcn.1401ea357
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.140014430
xor rax, rax
jmp 0x1401e8e02
mov rax, qword [rsp + 0x70]
jmp 0x1401e8e02
push rax
mov rcx, qword [rsp + 0x88]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
pop rax
add rsp, 0xa8
pop r15
pop rbp
ret