Function at 0x1400b9e7c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, r9
mov r15, r8
mov rbx, rdx
mov r12, rcx
lea r14, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b9eee
test byte [rcx + 0x1c], 1
je 0x1400b9eee
cmp byte [rcx + 0x19], 5
jb 0x1400b9eee
mov edx, 0x60
mov qword [rax - 0x60], r9
mov qword [rax - 0x68], r8
mov r9, rbx
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.14002444c
xor r13d, r13d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140004b74
nop
lea rcx, [rbp - 0x30]
call fcn.140034130
mov r8, qword [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, r12
call fcn.1400ba5f4
mov esi, eax
mov bl, 4
mov r10, qword [0x140106190]
cmp r10, r14
je 0x1400b9f5e
test byte [r10 + 0x1c], 2
je 0x1400b9f5e
cmp byte [r10 + 0x19], bl
jb 0x1400b9f5e
lea edx, [r13 + 0x61]
mov r9d, eax
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
mov r10, qword [0x140106190]
test esi, esi
jne 0x1400ba10f
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.1400b3940
mov r14d, eax
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400b9fcd
test byte [rcx + 0x1c], 2
je 0x1400b9fcd
cmp byte [rcx + 0x19], bl
jb 0x1400b9fcd
lea edx, [rsi + 0x62]
mov r9d, r14d
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov rbx, qword [rbp - 0x28]
test r14d, r14d
jne 0x1400b9ffb
mov rax, rbx
mov r8, rdi
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400b9ff3
add rax, 2
test edx, edx
jne 0x1400b9fdf
test ecx, ecx
je 0x1400ba0e5
mov eax, r13d
test rdi, rdi
setne al
test eax, eax
jne 0x1400ba013
mov ecx, 0x80004005
call fcn.14000507c
int3
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r13w
jne 0x1400ba017
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400ba080
test byte [rcx + 0x1c], 2
je 0x1400ba080
cmp byte [rcx + 0x19], 4
jb 0x1400ba080
mov edx, 0x63
mov r9d, esi
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test r14d, r14d
jne 0x1400ba0e5
mov rdi, qword [rbp - 0x30]
mov rax, qword [r12]
mov edx, 0x3ec
mov rcx, r12
mov rax, qword [rax + 0x48]
call qword [case.0x14006e230.0]
mov ecx, eax
xor r9d, r9d
mov r8, r15
mov rdx, rdi
call fcn.1400bcb30
mov rcx, qword [0x140106190]
lea r14, [0x140106190]
cmp rcx, r14
je 0x1400ba0ec
test byte [rcx + 0x1c], 2
je 0x1400ba0ec
cmp byte [rcx + 0x19], 4
jb 0x1400ba0ec
mov edx, 0x64
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
jmp 0x1400ba0ec
lea r14, [0x140106190]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ba140
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
jmp 0x1400ba140
cmp esi, 2
jne 0x1400ba147
mov esi, 0x490
cmp r10, r14
je 0x1400ba181
test byte [r10 + 0x1c], 2
je 0x1400ba147
cmp byte [r10 + 0x19], bl
jb 0x1400ba147
mov edx, 0x65
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003574
mov r10, qword [0x140106190]
cmp r10, r14
je 0x1400ba181
test byte [r10 + 0x1c], 1
je 0x1400ba181
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400ba181
mov edx, 0x66
mov r9d, esi
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ba1a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400ba1b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret