Function at 0x14000a340
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
mov eax, 0x1438
call fcn.140064fb0
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x13c0], 0xfffffffffffffffe
mov rax, qword [0x140116948]
xor rax, rbp
mov qword [rbp + 0x13f8], rax
xor eax, eax
mov word [rbp + 8], ax
mov dword [rbp + 4], 0
mov dword [rbp], 0
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp + 0x1420]
call fcn.1400080e0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jge 0x14000a3b9
mov eax, dword [rbp + 0xc]
jmp 0x14000ac9a
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x20]
call fcn.14000ada0
test eax, eax
jne 0x14000a3d4
mov eax, 0x80020009
jmp 0x14000ac9a
mov rax, qword [rbp + 0x1420]
mov rax, qword [rax]
movzx edx, byte [rax]
mov rcx, qword [rbp + 0x1420]
call fcn.14000af60
test eax, eax
je 0x14000a410
mov rcx, qword [rbp + 0x1420]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_CharNextA]
mov r11, rax
mov rax, qword [rbp + 0x1420]
mov qword [rax], r11
jmp 0x14000a3d4
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp + 0x1420]
call fcn.1400080e0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jge 0x14000a431
mov eax, dword [rbp + 0xc]
jmp 0x14000ac9a
movzx eax, word [rbp + 8]
mov dword [rbp + 0x13c8], eax
cmp dword [rbp + 0x13c8], 8
je 0x14000a473
cmp dword [rbp + 0x13c8], 0x11
je 0x14000aaa0
cmp dword [rbp + 0x13c8], 0x13
je 0x14000a72b
cmp dword [rbp + 0x13c8], 0x4008
je 0x14000a516
jmp 0x14000ac60
lea rax, [rbp + 0x20]
mov qword [rbp + 0x1320], rax
xor eax, eax
test eax, eax
jne 0x14000a47e
xor eax, eax
test eax, eax
jne 0x14000a47e
cmp qword [rbp + 0x1320], 0
je 0x14000a4a0
mov dword [rbp + 0x13cc], 1
jmp 0x14000a4aa
mov dword [rbp + 0x13cc], 0
mov eax, dword [rbp + 0x13cc]
mov dword [rbp + 0x131c], eax
cmp dword [rbp + 0x131c], 0
jne 0x14000a4c8
mov dword [rbp + 4], 0xd
jmp 0x14000a511
xor eax, eax
test eax, eax
jne 0x14000a48a
mov rcx, qword [rbp + 0x1320]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x1320]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x1430]
mov rcx, qword [rbp + 0x1428]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 4], eax
jmp 0x14000ac60
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov dword [rbp + 0x1130], eax
mov qword [rbp + 0x1020], 0
movsxd rcx, dword [rbp + 0x1130]
mov edx, 1
call fcn.14000c780
mov qword [rbp + 0x13d0], rax
mov rdx, qword [rbp + 0x13d0]
lea rcx, [rbp + 0x1020]
call fcn.14000c530
nop
cmp qword [rbp + 0x1020], 0
je 0x14000a703
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1138], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x1140], rax
mov dword [rbp + 0x1130], 0
mov rax, qword [rbp + 0x1140]
movsx eax, byte [rax]
test eax, eax
je 0x14000a6b0
mov rcx, qword [rbp + 0x1140]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rbp + 0x1148], rax
mov rax, qword [rbp + 0x1140]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x14000a60a
mov rax, qword [rbp + 0x1148]
movsx eax, byte [rax]
cmp eax, 0x30
jne 0x14000a60a
mov rax, qword [rbp + 0x1138]
mov byte [rax], 0
mov rax, qword [rbp + 0x1138]
add rax, 1
mov qword [rbp + 0x1138], rax
mov rcx, qword [rbp + 0x1148]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rbp + 0x1140], rax
jmp 0x14000a69c
mov rcx, qword [rbp + 0x1138]
mov rax, qword [rbp + 0x1140]
movzx eax, byte [rax]
mov byte [rcx], al
mov rax, qword [rbp + 0x1140]
movzx ecx, byte [rax]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x14000a678
mov rax, qword [rbp + 0x1138]
add rax, 1
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1140]
add rax, 1
mov qword [rbp + 0x1140], rax
mov rax, qword [rbp + 0x1140]
movsx eax, byte [rax]
test eax, eax
jne 0x14000a665
jmp 0x14000a6b0
mov rcx, qword [rbp + 0x1138]
mov rax, qword [rbp + 0x1140]
movzx eax, byte [rax]
mov byte [rcx], al
mov rax, qword [rbp + 0x1138]
add rax, 1
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1140]
add rax, 1
mov qword [rbp + 0x1140], rax
mov eax, dword [rbp + 0x1130]
add eax, 1
mov dword [rbp + 0x1130], eax
jmp 0x14000a591
mov rax, qword [rbp + 0x1138]
mov byte [rax], 0
mov rax, qword [rbp + 0x1138]
add rax, 1
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1138]
mov byte [rax], 0
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1328], rax
mov r8, qword [rbp + 0x1328]
mov rdx, qword [rbp + 0x1430]
mov rcx, qword [rbp + 0x1428]
call fcn.14000acc0
mov dword [rbp + 4], eax
jmp 0x14000a70a
mov dword [rbp + 4], 0xe
lea rax, [rbp + 0x1028]
cmp qword [rbp + 0x1020], rax
je 0x14000a726
lea rcx, [rbp + 0x1020]
call fcn.14000c580
jmp 0x14000ac60
mov dword [rbp + 0x1168], 3
mov qword [rbp + 0x1170], 0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x1158], rax
cmp qword [rbp + 0x1158], 0
jne 0x14000a765
mov qword [rbp + 0x13d8], 0
jmp 0x14000a996
mov rcx, qword [rbp + 0x1158]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rbp + 0x116c], eax
mov eax, dword [rbp + 0x116c]
mov dword [rbp + 0x1350], eax
mov ecx, 2
movsxd rax, dword [rbp + 0x1350]
imul rax, rcx
mov qword [rbp + 0x1348], rax
cmp qword [rbp + 0x1348], 0x7fffffff
jg 0x14000a7b8
cmp qword [rbp + 0x1348], 0xffffffff80000000
jge 0x14000a7c4
mov dword [rbp + 0x1354], 0x80070057
jmp 0x14000a7da
mov eax, dword [rbp + 0x1348]
mov dword [rbp + 0x116c], eax
mov dword [rbp + 0x1354], 0
cmp dword [rbp + 0x1354], 0
jge 0x14000a7f3
mov qword [rbp + 0x13e0], 0
jmp 0x14000a988
cmp dword [rbp + 0x116c], 0x400
jg 0x14000a84c
movsxd rcx, dword [rbp + 0x116c]
call fcn.140006470
movzx eax, al
test eax, eax
je 0x14000a84c
movsxd rcx, dword [rbp + 0x116c]
mov rax, rcx
add rax, 0xf
cmp rax, rcx
ja 0x14000a82f
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140064fb0
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 0x1380], rax
jmp 0x14000a8db
movsxd rax, dword [rbp + 0x116c]
mov qword [rbp + 0x1368], rax
mov rax, qword [rbp + 0x1370]
mov qword [rbp + 0x1380], rax
mov edx, 0x10
mov rcx, qword [rbp + 0x1368]
call fcn.14000c720
mov qword [rbp + 0x1360], rax
mov rcx, qword [rbp + 0x1360]
call fcn.14004c9e8
mov qword [rbp + 0x1358], rax
cmp qword [rbp + 0x1358], 0
jne 0x14000a8aa
mov qword [rbp + 0x1380], 0
jmp 0x14000a8db
mov rcx, qword [rbp + 0x1358]
mov rax, qword [rbp + 0x1170]
mov qword [rcx], rax
mov rax, qword [rbp + 0x1358]
mov qword [rbp + 0x1170], rax
mov rax, qword [rbp + 0x1358]
add rax, 0x10
mov qword [rbp + 0x1380], rax
movsxd rax, dword [rbp + 0x116c]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rbp + 0x1388], eax
mov rax, qword [rbp + 0x1390]
mov qword [rbp + 0x13e0], rax
cmp qword [rbp + 0x1380], 0
je 0x14000a914
cmp qword [rbp + 0x1158], 0
jne 0x14000a921
mov qword [rbp + 0x13e0], 0
jmp 0x14000a988
xor ecx, ecx
mov rax, qword [rbp + 0x1380]
mov word [rax], cx
mov eax, dword [rbp + 0x1388]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x1380]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x1158]
xor edx, edx
mov ecx, dword [rbp + 0x1168]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x1378], eax
cmp dword [rbp + 0x1378], 0
jne 0x14000a97a
mov qword [rbp + 0x13e0], 0
jmp 0x14000a988
mov rax, qword [rbp + 0x1380]
mov qword [rbp + 0x13e0], rax
mov rax, qword [rbp + 0x13e0]
mov qword [rbp + 0x13d8], rax
mov rax, qword [rbp + 0x13d8]
mov qword [rbp + 0x1160], rax
cmp qword [rbp + 0x1160], 0
jne 0x14000a9fa
mov dword [rbp + 0x12a4], 0x8007000e
cmp qword [rbp + 0x1170], 0
je 0x14000a9ef
mov rax, qword [rbp + 0x1170]
mov qword [rbp + 0x1398], rax
mov rax, qword [rbp + 0x1170]
mov rax, qword [rax]
mov qword [rbp + 0x1170], rax
mov rcx, qword [rbp + 0x1398]
call fcn.14004c3c4
jmp 0x14000a9b8
mov eax, dword [rbp + 0x12a4]
jmp 0x14000ac9a
lea r9, [rbp + 0x1178]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1160]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r11d, dword [rbp + 0x1178]
mov dword [rbp + 0x13a0], r11d
xor eax, eax
test eax, eax
jne 0x14000aa21
xor eax, eax
test eax, eax
jne 0x14000aa21
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x13a0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0x1430]
mov rcx, qword [rbp + 0x1428]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 4], eax
cmp qword [rbp + 0x1170], 0
je 0x14000aa9b
mov rax, qword [rbp + 0x1170]
mov qword [rbp + 0x13a8], rax
mov rax, qword [rbp + 0x1170]
mov rax, qword [rax]
mov qword [rbp + 0x1170], rax
mov rcx, qword [rbp + 0x13a8]
call fcn.14004c3c4
jmp 0x14000aa64
jmp 0x14000ac60
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rbp + 0x1180], eax
mov eax, dword [rbp + 0x1180]
and eax, 1
test eax, eax
je 0x14000aac7
mov eax, 0x80004005
jmp 0x14000ac9a
mov eax, dword [rbp + 0x1180]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x117c], eax
mov qword [rbp + 0x1190], 0
movsxd rcx, dword [rbp + 0x117c]
mov edx, 1
call fcn.14000c780
mov qword [rbp + 0x13e8], rax
mov rdx, qword [rbp + 0x13e8]
lea rcx, [rbp + 0x1190]
call fcn.14000c5b0
nop
cmp qword [rbp + 0x1190], 0
jne 0x14000ab4a
mov dword [rbp + 0x12a8], 0x80004005
lea rax, [rbp + 0x1198]
cmp qword [rbp + 0x1190], rax
je 0x14000ab3f
lea rcx, [rbp + 0x1190]
call fcn.14000c600
mov eax, dword [rbp + 0x12a8]
jmp 0x14000ac9a
movsxd r8, dword [rbp + 0x117c]
xor edx, edx
mov rcx, qword [rbp + 0x1190]
call fcn.14004c670
mov dword [rbp + 0x12a0], 0
jmp 0x14000ab7a
mov eax, dword [rbp + 0x12a0]
add eax, 1
mov dword [rbp + 0x12a0], eax
mov eax, dword [rbp + 0x1180]
cmp dword [rbp + 0x12a0], eax
jge 0x14000abef
mov eax, dword [rbp + 0x12a0]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, qword [rbp + 0x1190]
add rax, rcx
mov qword [rbp + 0x13f0], rax
mov eax, dword [rbp + 0x12a0]
and eax, 1
mov ebx, 1
sub ebx, eax
shl ebx, 2
movsxd rax, dword [rbp + 0x12a0]
movzx ecx, byte [rbp + rax + 0x20]
call fcn.14000aeb0
movzx edx, al
mov eax, ebx
movzx ecx, al
shl edx, cl
mov rax, qword [rbp + 0x13f0]
movzx ecx, byte [rax]
or ecx, edx
mov rax, qword [rbp + 0x13f0]
mov byte [rax], cl
jmp 0x14000ab6b
mov rax, qword [rbp + 0x1190]
mov qword [rbp + 0x13b0], rax
mov rax, qword [rbp + 0x1428]
mov rax, qword [rax]
mov qword [rbp + 0x13b8], rax
mov eax, dword [rbp + 0x117c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x13b0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x1430]
mov rcx, qword [rbp + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 4], eax
lea rax, [rbp + 0x1198]
cmp qword [rbp + 0x1190], rax
je 0x14000ac60
lea rcx, [rbp + 0x1190]
call fcn.14000c600
cmp dword [rbp + 4], 0
je 0x14000ac77
mov dword [rbp], 0x204
mov ecx, dword [rbp + 4]
call fcn.140009da0
jmp 0x14000ac9a
mov rdx, qword [rbp + 0x1438]
mov rcx, qword [rbp + 0x1420]
call fcn.1400080e0
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], 0
jge 0x14000ac98
mov eax, dword [rbp + 0xc]
jmp 0x14000ac9a
xor eax, eax
mov rcx, qword [rbp + 0x13f8]
xor rcx, rbp
call fcn.14004b2c0
lea rsp, [rbp + 0x1408]
pop rbx
pop rbp
ret