Function at 0x1400555a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp - 1], rax
mov r13, r9
mov qword [rbp - 0x49], r9
mov rdi, r8
mov qword [rbp - 0x51], r8
mov qword [rbp - 0x11], rdx
mov qword [rbp - 0x41], r8
mov qword [rbp - 0x39], r9
mov rcx, qword [rbp + 0x67]
mov qword [rbp - 0x69], rcx
mov qword [rbp - 0x31], rcx
mov rcx, qword [rbp + 0x6f]
mov qword [rbp - 0x61], rcx
mov qword [rbp - 0x29], rcx
mov rcx, qword [rbp + 0x77]
mov qword [rbp - 0x59], rcx
mov qword [rbp - 0x21], rcx
xor esi, esi
mov dword [rsp + 0x50], esi
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x19], rsi
mov rbx, qword [rdx]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140055628
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], rsi
lea rax, [rbp - 9]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DefaultIcon
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rbx, qword [rdi]
cmp qword [rbp - 0x19], 0
je 0x1400556a3
test rbx, rbx
je 0x1400556a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140262520]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov qword [rsp + 0x58], rsi
mov rax, qword [r13]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400556ca
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x1400556eb
call fcn.1400195b0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x140055d27
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], 1
mov r15, qword [r13]
movsxd r12, dword [r15 - 0x10]
lea rdx, str.Shell_
mov r14, 0xffffffffffffffff
mov rdi, r14
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140055722
lea esi, [rdi + r12]
test esi, esi
js 0x140055d1c
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x140055761
mov edx, esi
lea rcx, [rsp + 0x58]
call fcn.140018ec0
mov rbx, qword [rsp + 0x58]
lea rdx, str.Shell_
movsxd rax, edi
lea rdi, [rax + rax]
test rdi, rdi
je 0x14005578f
test rbx, rbx
jne 0x140055784
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x14005578f
mov r8, rdi
mov rcx, rbx
call fcn.1401f61a0
mov r8, r12
add r8, r8
lea rcx, [rdi + rbx]
je 0x1400557c6
test rcx, rcx
je 0x1400557b6
test r15, r15
je 0x1400557af
mov rdx, r15
call fcn.1401f61a0
jmp 0x1400557c6
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
cmp esi, dword [rbx - 0xc]
jg 0x140055d1c
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor esi, esi
mov word [rbx + rax*2], si
mov rdi, qword [rbp - 0x11]
mov rdi, qword [rdi]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400557f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], rsi
lea rax, [rbp - 5]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x50], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055857
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rbx, qword [rbp - 0x69]
mov rbx, qword [rbx]
cmp dword [rbx - 0x10], 0
je 0x14005589e
cmp qword [rbp - 0x19], 0
je 0x14005589e
test rbx, rbx
je 0x14005589e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140262520]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rbp - 0x61]
mov rbx, qword [rbx]
cmp dword [rbx - 0x10], 0
je 0x1400558e6
cmp qword [rbp - 0x19], 0
je 0x1400558e6
test rbx, rbx
je 0x1400558e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.FriendlyAppName
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov qword [rbp - 0x79], rsi
mov rax, qword [r13]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14005590c
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x14005592d
call fcn.1400195b0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x140055d32
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x79], rdi
or dword [rsp + 0x50], 2
mov r15, qword [r13]
movsxd r12, dword [r15 - 0x10]
mov rbx, r14
lea r13, str.Shell_
nop dword [rax]
inc rbx
cmp word [r13 + rbx*2], 0
jne 0x140055960
lea esi, [rbx + r12]
test esi, esi
js 0x140055d11
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x140055998
mov edx, esi
lea rcx, [rbp - 0x79]
call fcn.140018ec0
mov rdi, qword [rbp - 0x79]
movsxd rax, ebx
lea rbx, [rax + rax]
test rbx, rbx
je 0x1400559c9
test rdi, rdi
jne 0x1400559bb
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x1400559c9
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.1401f61a0
mov r8, r12
add r8, r8
lea rcx, [rbx + rdi]
je 0x140055a00
test rcx, rcx
je 0x1400559f0
test r15, r15
je 0x1400559e9
mov rdx, r15
call fcn.1401f61a0
jmp 0x140055a00
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
cmp esi, dword [rdi - 0xc]
jg 0x140055d11
mov dword [rdi - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rdi + rax*2], cx
mov qword [rbp - 0x71], rcx
lea r13, [rdi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x140055a3b
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x140055a5c
call fcn.1400195b0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x140055d3d
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x71], rbx
or dword [rsp + 0x50], 4
lea rcx, [0x140294030]
mov rsi, r14
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140055a80
movsxd r12, dword [rdi - 0x10]
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x140055d48
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r15d
or eax, ecx
jge 0x140055abd
mov edx, r15d
lea rcx, [rbp - 0x71]
call fcn.140018ec0
mov rbx, qword [rbp - 0x71]
add r12, r12
je 0x140055ae7
test rbx, rbx
jne 0x140055ad9
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140055ae7
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1401f61a0
movsxd r8, esi
add r8, r8
lea rcx, [r12 + rbx]
je 0x140055b16
test rcx, rcx
jne 0x140055b0a
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140055b16
lea rdx, [0x140294030]
call fcn.1401f61a0
cmp r15d, dword [rbx - 0xc]
jg 0x140055d48
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor esi, esi
mov word [rbx + rax*2], si
mov rax, qword [rbp - 0x11]
mov rdi, qword [rax]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140055b43
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
and dword [rsp + 0x50], 0xfffffffb
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055ba2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
and dword [rsp + 0x50], 0xfffffffd
mov eax, r14d
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x140055bc9
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rdi, qword [rbp - 0x59]
mov rbx, qword [rdi]
cmp qword [rbp - 0x19], 0
je 0x140055c0b
test rbx, rbx
je 0x140055c0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140262520]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140055c1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], rsi
mov rdx, qword [rbp - 0x51]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055c47
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp - 0x49]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055c70
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rax, qword [rbp - 0x69]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rax, qword [rbp - 0x61]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055cc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140055ce5
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038716.0]
mov eax, 1
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1401f3bf0
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80070057
call fcn.140019320
int3
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3
mov ecx, 0x80070057
call fcn.140019320
int3