Function at 0x140002bec
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rdi
mov rax, qword [0x1400153a0]
xor rax, rbp
mov qword [rbp + 0x30], rax
mov r15, rcx
mov qword [rbp + 0x28], rcx
xor r14d, r14d
mov qword [rbp + 0x20], r9
mov ecx, 0x2000
mov qword [rbp + 0x18], r8
mov ebx, r14d
mov qword [rbp + 0x10], rdx
mov r13, r8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
jne 0x140002c5f
mov eax, 0x8007000e
jmp 0x1400031ad
mov rdx, r12
mov rcx, r15
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140002fe6
mov edi, r14d
lea rsi, [0x1400105c0]
mov rdx, qword [rsi]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140002ca9
inc edi
add rsi, 0x10
cmp edi, 3
jb 0x140002c7e
mov edi, 0x80020009
jmp 0x140002fe6
movsxd rax, edi
lea rcx, [0x1400105c0]
add rax, rax
movzx edi, word [rcx + rax*8 + 8]
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140002fe1
mov r12d, 0x13
mov rcx, qword [r15]
movzx edx, word [rcx]
sub edx, 9
je 0x140002cf8
sub edx, 1
je 0x140002cf8
sub edx, 3
je 0x140002cf8
cmp edx, r12d
jne 0x140002d09
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov qword [r15], rax
jmp 0x140002cde
mov rdx, rsi
mov rcx, r15
call fcn.140004c34
mov r12, qword [rbp + 8]
xor ecx, ecx
mov r14d, eax
test eax, eax
jns 0x140002d38
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov edi, r14d
jmp 0x140002fe6
xor r14d, r14d
mov dword [rbp], r14d
lea eax, [r14 + 8]
cmp di, ax
je 0x140002f7d
cmp di, 0x11
je 0x140002d9a
lea eax, [r14 + 0x13]
cmp di, ax
jne 0x140003140
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
nop dword [rax + rax]
mov eax, dword [rbp]
lea r9d, [r14 + 4]
mov dword [rbp + 8], eax
mov rdx, r13
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x140002f2d
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r14w
jne 0x140002d9e
test dil, 1
jne 0x140002fa3
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd r13, eax
cmp r13, 0x400
ja 0x140002dfa
mov rcx, r13
call fcn.140006dc0
xor r15d, r15d
test al, al
je 0x140002dfd
lea rax, [r13 + 0xf]
cmp rax, r13
ja 0x140002de7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14000f230
sub rsp, rax
lea r15, [rsp + 0x30]
jmp 0x140002e29
xor r15d, r15d
lea rcx, [r13 + 0x10]
cmp rcx, r13
jb 0x140002f48
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140002f48
mov qword [rax], r15
mov rbx, rax
lea r15, [rax + 0x10]
test r15, r15
je 0x140002f48
mov r8, r13
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
movsxd r11, edi
mov r9d, r14d
test edi, edi
jle 0x140002f19
mov r10, r14
movzx r8d, word [rsi + r10*2]
mov ecx, r8d
cmp r8d, 0x61
ja 0x140002ebe
je 0x140002edc
cmp ecx, 0x38
ja 0x140002e95
je 0x140002e8f
sub ecx, 0x30
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
sub ecx, 1
je 0x140002e8f
cmp ecx, 1
jne 0x140002ed7
sub r8b, 0x30
jmp 0x140002ee0
sub ecx, 0x39
je 0x140002e8f
sub ecx, 8
je 0x140002eb8
sub ecx, 1
je 0x140002eb8
sub ecx, 1
je 0x140002eb8
sub ecx, 1
je 0x140002eb8
sub ecx, 1
je 0x140002eb8
cmp ecx, 1
jne 0x140002ed7
sub r8b, 0x37
jmp 0x140002ee0
sub ecx, 0x62
je 0x140002edc
sub ecx, 1
je 0x140002edc
sub ecx, 1
je 0x140002edc
sub ecx, 1
je 0x140002edc
cmp ecx, 1
je 0x140002edc
mov r8b, r14b
jmp 0x140002ee0
sub r8b, 0x57
mov eax, r9d
test r9d, r9d
jns 0x140002eec
lea eax, [r9 + 1]
sar eax, 1
mov ecx, r9d
and ecx, 1
movsxd rdx, eax
shl ecx, 2
mov eax, 4
sub eax, ecx
inc r9d
mov cl, al
inc r10
shl r8b, cl
or byte [rdx + r15], r8b
cmp r10, r11
jl 0x140002e50
mov rdx, qword [rbp + 0x18]
mov r9d, 3
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp + 0x10]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
jmp 0x140003140
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, r12
jmp 0x140002f62
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140002f5c
mov eax, 0x80004005
jmp 0x1400031ad
or rdi, 0xffffffffffffffff
mov r13, rsi
cmp byte [rbp + 0x90], cl
je 0x1400030f1
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x140002f93
cmp eax, 0xffe
jle 0x140002fb9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov edi, 0x80004005
jmp 0x140002fe6
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x140002ffc
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov edi, 0x8007000e
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, edi
jmp 0x1400031ad
mov rcx, qword [r15 + 8]
lea rdx, [0x1400114e8]
call fcn.140006940
xor ecx, ecx
mov r12, rax
test rax, rax
je 0x1400030ed
mov rdx, rax
mov rcx, rsi
call fcn.1400069e8
xor ecx, ecx
mov r15, rax
test rax, rax
je 0x1400030ed
cmp rax, qword [rbp + 0x20]
je 0x140003057
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharPrevW]
nop dword [rax + rax]
xor ecx, ecx
cmp word [rax], 0x22
je 0x1400030ed
mov word [r14], cx
mov r8, r15
sub r8, rsi
mov rdx, rsi
sar r8, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
mov r13d, 0x1000
lea r8, [0x1400114f8]
mov edx, r13d
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov r8, r12
mov edx, r13d
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea r8, [0x1400114f8]
mov edx, r13d
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rax, rdi
xor ecx, ecx
inc rax
cmp word [r12 + rax*2], cx
jne 0x1400030c8
lea r8, [r15 + rax*2]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
xor ecx, ecx
mov r13, r14
mov r12, qword [rbp + 8]
inc rdi
cmp word [r13 + rdi*2], cx
jne 0x1400030f1
mov rcx, qword [rbp + 0x10]
lea eax, [rdi*2 + 2]
mov rdx, qword [rbp + 0x18]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test r14, r14
je 0x140003140
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
call fcn.140004c34
mov edi, eax
mov rcx, rsi
test eax, eax
jns 0x140003183
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, r12
jmp 0x14000316d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140003167
jmp 0x140002ff5
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, r12
jmp 0x14000319a
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140003194
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rbp
call fcn.140001830
mov rbx, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x80]
lea rsp, [rbp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret