Function at 0x1400b84c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, r9
mov r11, r8
mov edi, edx
mov r14, rcx
test r8, r8
je 0x1400b8830
lea eax, [rdx + 2]
test eax, 0xfffffffd
je 0x1400b8830
mov rax, qword [0x140145a80]
lea r9, [0x14010d28c]
xor r15d, r15d
xor r8d, r8d
mov rdx, rbx
mov rcx, r11
mov r10d, dword [rax + 0x110]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
or r10d, 0x20006
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400b8835
sub edi, 1
je 0x1400b8884
sub edi, 1
je 0x1400b885f
sub edi, 1
je 0x1400b870a
sub edi, 1
je 0x1400b8659
cmp edi, 3
jne 0x1400b872f
mov rsi, qword [rsp + 0xa8]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r15w
jne 0x1400b8591
lea rcx, [rbx*2 + 4]
call fcn.1400e5e30
mov rdi, rax
test rax, rax
jne 0x1400b85c5
mov rcx, qword [rsp + 0x58]
mov ebx, SafeArrayGetUBound
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8835
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400eadcc
mov dword [rdi + rbx*2], r15d
test rbx, rbx
je 0x1400b85ec
cmp word [rdi + rbx*2 - 2], 0xa
jne 0x1400b85ec
dec rbx
mov word [rdi + rbx*2], r15w
movzx ecx, word [rdi]
mov rax, rdi
test cx, cx
je 0x1400b860e
cmp cx, 0xa
jne 0x1400b8601
mov word [rax], r15w
movzx ecx, word [rax + 2]
add rax, 2
test cx, cx
jne 0x1400b85f7
mov rdx, qword [rsp + 0xa0]
lea eax, [rbx + 2]
mov rcx, qword [rsp + 0x58]
test rbx, rbx
mov r9d, 7
cmove eax, r15d
xor r8d, r8d
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call fcn.1400e89fc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8835
mov rbx, qword [rsp + 0xa8]
movzx eax, word [rbx]
test ax, ax
je 0x1400b86e0
mov rcx, rbx
nop dword [rax]
cmp ax, 0x20
je 0x1400b867c
cmp ax, 9
jne 0x1400b8686
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x1400b8670
test ax, ax
je 0x1400b86d6
cmp ax, 0x2d
je 0x1400b8697
cmp ax, 0x2b
jne 0x1400b86a1
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x1400b86d6
movzx eax, word [rcx + 2]
mov edx, 0xffdf
sub ax, 0x58
test dx, ax
jne 0x1400b86d6
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x1400b86d6
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea4ec
jmp 0x1400b86e3
mov rcx, rbx
call fcn.1400e9f38
jmp 0x1400b86e3
mov eax, r15d
mov dword [rsp + 0x90], eax
mov r9d, 4
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x1400b88b5
mov rdi, qword [rsp + 0xa8]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x1400b8720
test bl, 1
je 0x1400b8744
mov rcx, qword [rsp + 0x58]
mov ebx, 0x57
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8835
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd rbp, eax
mov rcx, rbp
call fcn.1400e5e30
mov rsi, rax
test rax, rax
je 0x1400b85b0
movsxd rbx, ebx
mov r11d, r15d
test rbx, rbx
jle 0x1400b87e0
mov rdx, r15
mov r10, r15
cmp r10, rbp
jge 0x1400b87e0
mov ecx, r15d
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
nop dword [rax]
nop word [rax + rax]
mov r9d, ecx
movzx ecx, word [rdi + rdx*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1400b87a5
lea eax, [rcx - 0x30]
jmp 0x1400b87bf
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x1400b87b3
lea eax, [rcx - 0x37]
jmp 0x1400b87bf
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x1400b881d
lea eax, [rcx - 0x57]
mov ecx, r8d
inc rdx
imul ecx, eax
add ecx, r9d
sub r8d, 0xf
jns 0x1400b8790
mov byte [r10 + rsi], cl
inc r11d
inc r10
cmp rdx, rbx
jl 0x1400b8773
mov rdx, qword [rsp + 0xa0]
mov r9d, 3
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call fcn.1400e89fc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8835
mov rcx, rsi
call fcn.1400e89fc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x57
test ebx, ebx
mov r8d, ebx
mov rcx, r14
setne dl
call fcn.140050150
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, qword [rsp + 0xa8]
mov rbx, 0xffffffffffffffff
nop
cmp word [rcx + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x1400b8870
mov r9d, 2
jmp 0x1400b88a5
mov rcx, qword [rsp + 0xa8]
mov rbx, 0xffffffffffffffff
cmp word [rcx + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x1400b8893
mov r9d, 1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b8835