Function at 0x1400b9690
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x68]
mov rbx, rcx
lea rdx, [0x14010a9a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400b9e06
mov rcx, qword [rbx + 0xf350]
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x70]
shl rcx, 3
mov qword [rsp + 0x78], rdi
call fcn.14004af90
mov rcx, qword [rbx + 0xf348]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b973e
mov r8, rax
nop word [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf348]
jne 0x1400b9720
mov eax, dword [rbx + 0xf350]
lea rdx, [0x14010a978]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf350]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf348]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b97be
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf348]
jne 0x1400b97a0
mov eax, dword [rbx + 0xf350]
lea rdx, [0x14010a9e8]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf338]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf330]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b983e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf330]
jne 0x1400b9820
mov eax, dword [rbx + 0xf338]
lea rdx, [0x14010aa20]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf338]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf330]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b98be
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf330]
jne 0x1400b98a0
mov eax, dword [rbx + 0xf338]
lea rdx, [0x14010aa48]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf320]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf318]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b993e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf318]
jne 0x1400b9920
mov eax, dword [rbx + 0xf320]
lea rdx, [0x14010aa78]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf320]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf318]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b99be
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf318]
jne 0x1400b99a0
mov eax, dword [rbx + 0xf320]
lea rdx, [0x14010aaa0]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf368]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf360]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9a3e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf360]
jne 0x1400b9a20
mov eax, dword [rbx + 0xf368]
lea rdx, [0x14010aad0]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf368]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf360]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9abe
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf360]
jne 0x1400b9aa0
mov eax, dword [rbx + 0xf368]
lea rdx, [0x14010aaf8]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf380]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf378]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9b3e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf378]
jne 0x1400b9b20
mov eax, dword [rbx + 0xf380]
lea rdx, [0x14010ab28]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf380]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf378]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9bbe
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf378]
jne 0x1400b9ba0
mov eax, dword [rbx + 0xf380]
lea rdx, [0x14010ab48]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf398]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf390]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9c3e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf390]
jne 0x1400b9c20
mov eax, dword [rbx + 0xf398]
lea rdx, [0x14010ab70]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf398]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf390]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9cbe
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf390]
jne 0x1400b9ca0
mov eax, dword [rbx + 0xf398]
lea rdx, [0x14010ab90]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf3b0]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf3a8]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9d3e
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x14]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf3a8]
jne 0x1400b9d20
mov eax, dword [rbx + 0xf3b0]
lea rdx, [0x14010abb8]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rbx + 0xf3b0]
mov rsi, qword [rsp + 0x70]
shl rcx, 3
call fcn.14004af90
mov rcx, qword [rbx + 0xf3a8]
mov rdx, qword [rcx]
mov rdi, rax
cmp rdx, rcx
je 0x1400b9dbe
mov r8, rax
nop dword [rax + rax]
mov ecx, dword [rdx + 0x10]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rdx + 0x18]
mov dword [r8 - 4], ecx
mov rdx, qword [rdx]
cmp rdx, qword [rbx + 0xf3a8]
jne 0x1400b9da0
mov eax, dword [rbx + 0xf3b0]
lea rdx, [0x14010abe8]
mov r9d, 3
shl eax, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14004b048
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rcx + 0x10]
jmp 0x1400b9690