Function at 0x1400025f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x1400c77b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [0x1400bb410]
movdqu xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x17], r12b
lea rdx, [rbp + 0x17]
call fcn.140001fb0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rax
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
lea r8d, [r12 + 1]
lea rdx, reloc.WS2_32.dll_ioctlsocket
lea rcx, [rbp - 9]
call fcn.140005fd0
nop
lea r8, [rbp - 9]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x21]
call fcn.140002290
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400026c3
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d9a
call fcn.14006ce50
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesGoogleChromeExtensionInstallForcelist
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400029ad
mov r15, r12
mov rax, qword [rbp - 0x19]
sub rax, qword [rbp - 0x21]
sar rax, 5
test rax, rax
je 0x1400029a1
mov rdi, r12
nop dword [rax]
lea rdx, [r15 + 1]
mov r15, rdx
lea rcx, [rbp - 9]
call fcn.140005810
nop
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 7]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov r8, rbx
xor edx, edx
lea rcx, [rbp - 0x41]
call fcn.140005d00
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 7]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov rbx, qword [rbp - 0x21]
add rbx, rdi
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400027b5
mov r8, qword [rbx]
lea rsi, [rbx + 0x10]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rsi]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], r12
mov r8, r14
xor edx, edx
lea rcx, [rbp - 0x61]
call fcn.140005d00
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
cmp qword [rbx + 0x18], 0x10
jb 0x14000280b
mov rbx, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsi]
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
mov eax, dword [rbp - 0x51]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400028ab
mov rbx, qword [rbp - 0x21]
add rbx, rdi
lea rdx, str.Failed_to_set_registry_value_for_Chrome:
lea rcx, [0x1400c8cd0]
call fcn.1400059c0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002896
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140006c40
mov rcx, rax
call fcn.140005c70
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x1400028eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da0
call fcn.14006ce50
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14000293c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002937
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da6
call fcn.14006ce50
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140002988
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dac
call fcn.14006ce50
add rdi, 0x20
mov rax, qword [rbp - 0x19]
sub rax, qword [rbp - 0x21]
sar rax, 5
cmp r15, rax
jb 0x140002710
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400029c8
lea rdx, str.Failed_to_open_registry_key_for_Chrome.
lea rcx, [0x1400c8cd0]
call fcn.1400059c0
mov rcx, rax
call fcn.140005c70
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftEdgeExtensionInstallForcelist
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002cbd
mov r15, r12
mov rax, qword [rbp - 0x19]
sub rax, qword [rbp - 0x21]
sar rax, 5
test rax, rax
je 0x140002cb1
mov rdi, r12
nop dword [rax]
nop word [rax + rax]
lea rdx, [r15 + 1]
mov r15, rdx
lea rcx, [rbp - 9]
call fcn.140005810
nop
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 7]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov r8, rbx
xor edx, edx
lea rcx, [rbp - 0x41]
call fcn.140005d00
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 7]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov rbx, qword [rbp - 0x21]
add rbx, rdi
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002ac5
mov r8, qword [rbx]
lea rsi, [rbx + 0x10]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rsi]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], r12
mov r8, r14
xor edx, edx
lea rcx, [rbp - 0x61]
call fcn.140005d00
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
cmp qword [rbx + 0x18], 0x10
jb 0x140002b1b
mov rbx, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsi]
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
mov eax, dword [rbp - 0x51]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140002bbb
mov rbx, qword [rbp - 0x21]
add rbx, rdi
lea rdx, str.Failed_to_set_registry_value_for_Edge:
lea rcx, [0x1400c8cd0]
call fcn.1400059c0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002ba6
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140006c40
mov rcx, rax
call fcn.140005c70
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x140002bfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002db2
call fcn.14006ce50
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x140002c4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002db8
call fcn.14006ce50
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140002c98
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dbe
call fcn.14006ce50
add rdi, 0x20
mov rax, qword [rbp - 0x19]
sub rax, qword [rbp - 0x21]
sar rax, 5
cmp r15, rax
jb 0x140002a20
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002cd9
lea rdx, str.Failed_to_open_registry_key_for_Edge.
lea rcx, [0x1400c8cd0]
call fcn.1400059c0
mov rcx, rax
call fcn.140005c70
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140002d30
mov rdx, qword [rbp - 0x19]
call fcn.140006210
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 0x21]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dc4
call fcn.14006ce50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r12
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x140002d67
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d94
call fcn.14006ce50
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14006ce30
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
nop
call fcn.140076e38
int3