Function at 0x1402d1c78
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov r13, rdx
mov r12, rcx
lea rdx, str.CLSID645FF040_5081_101B_9F08_00AA002F954EShell
lea rcx, [rbp - 0x30]
call fcn.14000cb18
nop
lea r8, [0x140352420]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x28]
call fcn.14001c3e0
nop
mov r8, r13
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140004278
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or r14d, 0xffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1cfd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, 0x2001f
call fcn.140223ed8
mov edi, eax
xor ebx, ebx
mov r9d, eax
mov r8, qword [rbp + 0x48]
test esi, esi
mov rsi, 0xffffffff80000000
mov rdx, rsi
je 0x1402d1e97
add r12, 8
mov rcx, r12
call fcn.1400114d4
test eax, eax
je 0x1402d1d50
mov r9d, edi
mov r8, qword [rbp + 0x48]
mov rdx, rsi
mov rcx, r12
call fcn.140010dd0
mov ebx, eax
test eax, eax
jne 0x1402d1ee7
mov dword [rbp + 0x40], 2
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CCRBType
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1402d1ee7
lea r8, [0x140366628]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14001c3e0
mov r9d, edi
mov r8, qword [rax]
mov rdx, rsi
mov rcx, r12
call fcn.1400114d4
mov ebx, eax
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x1402d1dd1
mov rcx, qword [rdx]
mov r9, qword [rcx]
call qword [r9 + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x1402d1e24
lea r8, [0x140366628]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.14001c3e0
mov r9d, edi
mov r8, qword [rax]
mov rdx, rsi
mov rcx, r12
call fcn.140010dd0
mov ebx, eax
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1e1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x1402d1ee7
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.1402d1758
mov rbx, qword [rax]
xor eax, eax
test rbx, rbx
setne al
test eax, eax
jne 0x1402d1e43
lea ebx, [rax + 0xd]
jmp 0x1402d1e75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140330de8]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1ee7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1402d1ee7
lea rcx, [r12 + 8]
call fcn.1400114d4
test eax, eax
jne 0x1402d1ee7
mov r8d, edi
lea rdx, str.command
mov rcx, qword [r12 + 8]
call fcn.140223e38
test eax, eax
jne 0x1402d1ee7
mov r9d, edi
mov r8, qword [rbp - 0x30]
mov rdx, rsi
lea rcx, [r12 + 8]
call fcn.1400114d4
test eax, eax
jne 0x1402d1ee7
mov r8d, edi
mov rdx, qword [r13]
mov rcx, qword [r12 + 8]
call fcn.140223e38
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1f08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1f28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret