Function at 0x1400dbde0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov r12d, ecx
lea r15, [0x140148ea8]
mov eax, 5
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400dbe55
test byte [rcx + 0x1c], 1
je 0x1400dbe55
cmp byte [rcx + 0x19], al
jb 0x1400dbe55
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov r9d, r12d
mov rcx, qword [rcx + 0x10]
call fcn.1400db118
xor r13d, r13d
mov qword [rbp + 0x17], r13
mov qword [rbp + 0x1f], r13
mov qword [rbp + 0x27], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x39], r13
xor edx, edx
lea rcx, [rbp + 0x17]
call fcn.1400dc704
mov edi, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400dbeac
test byte [rcx + 0x1c], 2
je 0x1400dbeac
cmp byte [rcx + 0x19], 4
jb 0x1400dbeac
lea edx, [r13 + 0x2e]
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test edi, edi
jne 0x1400dbeef
lea rdx, [rbp - 0x41]
lea rcx, [rbp + 0x17]
call fcn.1400d2210
mov edi, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400dbeef
test byte [rcx + 0x1c], 2
je 0x1400dbeef
cmp byte [rcx + 0x19], 4
jb 0x1400dbeef
mov edx, 0x2f
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rdx, r14
lea rcx, [rbp - 9]
call fcn.140011450
nop
lea rdx, [0x140009258]
lea rcx, [rbp - 0x21]
call fcn.140011450
nop
lea rdx, [0x140009258]
lea rcx, [rbp - 0x31]
call fcn.140011450
nop
or r15, 0xffffffffffffffff
test edi, edi
jne 0x1400dbfd6
test rbx, rbx
je 0x1400dbf7f
mov rax, r15
inc rax
cmp word [rbx + rax*2], r13w
jne 0x1400dbf32
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.1400118b4
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400dbf7f
test byte [rcx + 0x1c], 2
je 0x1400dbf7f
cmp byte [rcx + 0x19], 4
jb 0x1400dbf7f
mov edx, 0x30
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
test rsi, rsi
je 0x1400dbfd6
mov rax, r15
inc rax
cmp word [rsi + rax*2], r13w
jne 0x1400dbf87
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.1400118b4
mov rcx, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rcx, rsi
je 0x1400dbfdd
test byte [rcx + 0x1c], 2
je 0x1400dbfdd
cmp byte [rcx + 0x19], 4
jb 0x1400dbfdd
mov edx, 0x31
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
jmp 0x1400dbfdd
lea rsi, [0x140148ea8]
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x19], rax
test edi, edi
jne 0x1400dc5c7
lea rcx, [rbp - 0x19]
call fcn.1400d1160
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc04a
test byte [rcx + 0x1c], 2
je 0x1400dc04a
cmp byte [rcx + 0x19], 4
jb 0x1400dc04a
lea edx, [rdi + 0x32]
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
mov eax, 0x54f
test ebx, ebx
cmovns eax, r13d
test eax, eax
jne 0x1400dc5ce
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x49], rax
mov rdi, r13
mov qword [rbp - 1], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r13
mov r14d, r13d
mov eax, dword [rbp - 0x39]
test eax, eax
jle 0x1400dc588
mov r15, r13
test r14d, r14d
js 0x1400dc575
cmp r14d, eax
jge 0x1400dc575
movsxd rcx, r14d
mov rax, qword [rbp - 0x41]
lea rdx, [rax + rcx*8]
lea rcx, [rbp - 0x49]
call fcn.1400115a8
mov r8d, 1
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x49]
call fcn.140010e38
mov rdx, qword [rbp - 0x19]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.140010e38
mov dword [rsp + 0x28], 0x2011f
mov r8, qword [rbp - 0x49]
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp - 1]
call fcn.140029e44
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc13a
test byte [rcx + 0x1c], 2
je 0x1400dc13a
cmp byte [rcx + 0x19], 4
jb 0x1400dc13a
mov edx, 0x33
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rdi, qword [rbp - 1]
test ebx, ebx
jne 0x1400dc355
mov dword [rbp + 0x67], r12d
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
xor r8d, r8d
lea rdx, [0x140009220]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc1a4
test byte [rcx + 0x1c], 2
je 0x1400dc1a4
cmp byte [rcx + 0x19], 4
jb 0x1400dc1a4
mov edx, 0x34
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dc355
mov ecx, r13d
mov rax, qword [rbp - 9]
test rax, rax
setne cl
test ecx, ecx
je 0x1400dc53e
or rsi, 0xffffffffffffffff
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1400dc1c8
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140009230]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400dc234
test byte [rcx + 0x1c], 2
je 0x1400dc234
cmp byte [rcx + 0x19], 4
jb 0x1400dc234
mov edx, 0x35
mov r9d, ebx
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dc34e
mov ecx, r13d
mov rax, qword [rbp - 0x21]
test rax, rax
setne cl
test ecx, ecx
je 0x1400dc533
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1400dc254
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140009238]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400dc2c0
test byte [rcx + 0x1c], 2
je 0x1400dc2c0
cmp byte [rcx + 0x19], 4
jb 0x1400dc2c0
mov edx, 0x36
mov r9d, ebx
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test ebx, ebx
jne 0x1400dc34e
mov ecx, r13d
mov rax, qword [rbp - 0x31]
test rax, rax
setne cl
test ecx, ecx
je 0x1400dc528
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1400dc2e0
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140009248]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rcx, rsi
je 0x1400dc355
test byte [rcx + 0x1c], 2
je 0x1400dc355
cmp byte [rcx + 0x19], 4
jb 0x1400dc355
mov edx, 0x37
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
jmp 0x1400dc355
lea rsi, [0x140148ea8]
test rdi, rdi
je 0x1400dc36a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
mov qword [rbp - 1], r13
test ebx, ebx
jne 0x1400dc50d
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x11], rax
cmp r14d, dword [rbp - 0x39]
jge 0x1400dc55c
mov r8, qword [rbp - 0x41]
mov r8, qword [r8 + r15]
lea rdx, [0x140009208]
lea rcx, [rbp - 0x11]
call fcn.1400157a0
mov rbx, qword [rbp - 0x11]
mov r8, rbx
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
test rax, rax
jne 0x1400dc416
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc41d
test byte [rcx + 0x1c], 2
je 0x1400dc41d
lea edx, [rdi + 2]
test eax, eax
lea eax, [rdi + 5]
cmove edx, eax
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jl 0x1400dc41d
lea edx, [rdi + 0x38]
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
mov qword [rbp - 0x29], rdi
cmp rcx, rsi
je 0x1400dc44a
test byte [rcx + 0x1c], 2
je 0x1400dc44a
cmp byte [rcx + 0x19], 4
jb 0x1400dc44a
mov edx, 0x39
mov r9, rdi
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fda0
test rdi, rdi
je 0x1400dc497
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc488
test byte [rcx + 0x1c], 2
je 0x1400dc488
cmp byte [rcx + 0x19], 4
jb 0x1400dc488
mov edx, 0x3a
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x29], r13
jmp 0x1400dc4e3
cmp r14d, dword [rbp - 0x39]
jge 0x1400dc54c
mov rdx, qword [rbp - 0x41]
mov rdx, qword [rdx + r15]
lea rcx, [rbp + 0x17]
call fcn.1400d2778
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400dc4e3
test byte [rcx + 0x1c], 2
je 0x1400dc4e3
cmp byte [rcx + 0x19], 4
jb 0x1400dc4e3
mov edx, 0x3b
mov r9d, eax
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
nop
lea rsi, [rbx - 0x18]
lock add dword [rsi + 0x10], 0xffffffff
jg 0x1400dc509
mov rdi, qword [rsi]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, rsi
mov rcx, rdi
call rbx
mov rdi, qword [rbp - 1]
inc r14d
add r15, 8
mov eax, dword [rbp - 0x39]
cmp r14d, eax
jge 0x1400dc56f
lea rsi, [0x140148ea8]
jmp 0x1400dc0a2
mov ecx, 0x80004005
call fcn.1400119f0
int3
mov ecx, 0x80004005
call fcn.1400119f0
int3
mov ecx, 0x80004005
call fcn.1400119f0
nop
jmp 0x1400dc54b
nop
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
nop
jmp 0x1400dc56e
nop
or r15, 0xffffffffffffffff
jmp 0x1400dc588
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
nop
jmp 0x1400dc587
nop
test rdi, rdi
je 0x1400dc597
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rsi, qword [rbp - 0x49]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400dc5c7
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400dc5f6
test byte [rcx + 0x1c], 1
je 0x1400dc5f6
mov edx, 0x3c
lea r8, [0x140009268]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
nop
mov rsi, qword [rbp - 0x19]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400dc627
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp - 0x31]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400dc658
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp - 0x21]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400dc689
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp - 9]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400dc6ba
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
lea rcx, [rbp - 0x41]
call fcn.140026ee0
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400dc6d4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x1400dc6e3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret