Function at 0x1400afa70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
call fcn.1400a68b0
mov rcx, qword [0x14022ab50]
mov edx, eax
call fcn.140074c74
mov r10, qword [rdi]
mov rbp, rax
mov r11b, byte [r10 + 0x1610]
add r10, 0x1608
neg r11b
sbb rcx, rcx
xor r12d, r12d
and rcx, r10
mov rbx, rcx
jne 0x1400afb21
mov rdx, qword [rdi + 0x3d18]
test rdx, rdx
je 0x1400afadc
cmp word [rdx], r12w
jne 0x1400afaf1
cmp byte [rax + 0x19], r12b
je 0x1400afb30
lea rdx, [rax + 0x1a]
cmp word [rdx], r12w
je 0x1400afb30
test rdx, rdx
je 0x1400afb30
mov rbx, rcx
cmp word [rdx], r12w
je 0x1400afb30
mov rcx, qword [0x14022ab50]
call fcn.14007add4
mov rbx, r12
test eax, eax
js 0x1400afb30
lfence
mov rcx, qword [0x14022ab50]
mov edx, eax
call fcn.14007adac
mov rbx, rax
test rbx, rbx
je 0x1400afb30
mov al, byte [rbx + 9]
mov byte [rsi], al
mov al, byte [rbx + 0xa]
jmp 0x1400afb42
mov rcx, rbp
call fcn.1400c1578
mov rcx, rbp
mov byte [rsi], al
call fcn.1400c10f0
mov byte [r14], al
mov cl, byte [rsi]
cmp cl, 0xf
jbe 0x1400afb60
cmp al, 0xf
jbe 0x1400afb60
mov byte [r14], 0x10
mov al, r12b
mov byte [rsi], 0x10
mov byte [rdi + 0x21], 7
jmp 0x1400afbbc
cmp cl, 0x10
jb 0x1400afb6d
mov byte [rsi], 7
mov cl, 7
mov al, byte [r14]
cmp al, 0x10
jb 0x1400afb79
mov byte [r14], r12b
mov al, r12b
mov cl, byte [rsi]
cmp cl, al
jne 0x1400afbb4
mov rdx, qword [rdi]
mov rcx, qword [0x14022ab58]
call fcn.140083c98
test al, al
je 0x1400afba6
mov rax, qword [0x14022ab50]
movzx edx, byte [r14]
mov ecx, dword [rax + 0xee8]
bt ecx, edx
jb 0x1400afbb4
mov al, byte [r14]
neg al
sbb cl, cl
not cl
and cl, 7
mov byte [rsi], cl
mov al, byte [rsi]
mov byte [rdi + 0x21], al
mov al, byte [r14]
mov byte [rdi + 0x22], al
test rbx, rbx
je 0x1400afbcf
mov al, byte [rbx + 0xb]
mov byte [r15], al
mov al, byte [rbx + 0xc]
jmp 0x1400afbe2
mov rcx, rbp
call fcn.1400c1434
mov rcx, rbp
mov byte [r15], al
call fcn.1400c1410
mov rbx, qword [rsp + 0xa0]
mov byte [rbx], al
mov cl, byte [r15]
cmp cl, 0xf
jbe 0x1400afc08
cmp al, 0xf
jbe 0x1400afc08
mov byte [rbx], 0x10
mov cl, 5
mov byte [r15], 0x10
mov al, 0xf
mov byte [rdi + 0x23], cl
jmp 0x1400afc36
cmp cl, 0x10
jb 0x1400afc14
mov cl, 5
mov byte [r15], cl
mov al, byte [rbx]
cmp al, 0x10
jb 0x1400afc20
mov byte [rbx], 0xf
mov al, 0xf
mov cl, byte [r15]
cmp cl, al
jne 0x1400afc31
neg cl
sbb al, al
not al
and al, 0xf
mov byte [rbx], al
mov cl, byte [r15]
mov byte [rdi + 0x23], cl
mov al, byte [rbx]
mov byte [rdi + 0x24], al
cmp byte [rsp + 0xa8], r12b
je 0x1400afd9e
mov r10, qword [rsp + 0xb0]
mov bpl, r12b
test r10, r10
jne 0x1400afcca
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
lea rdx, str.ConsoleConEmu
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400afcbf
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, str.Failed_to_create_open_registry_key_HKCUConsoleConEmu
mov edx, eax
call fcn.140113304
mov r10, r12
mov qword [rsp + 0xb0], r12
jmp 0x1400afcca
mov r10, qword [rsp + 0xb0]
mov bpl, 1
mov cl, byte [rsi]
cmp cl, 0xf
jbe 0x1400afcd9
mov cl, byte [rdi + 0x21]
and cl, 0xf
mov byte [rsi], cl
mov al, byte [r14]
cmp al, 0xf
jbe 0x1400afcea
mov al, byte [rdi + 0x22]
and al, 0xf
mov byte [r14], al
mov cl, byte [rsi]
shl al, 4
mov esi, 4
movzx edx, al
movzx eax, cl
and eax, 0xf
or edx, eax
mov dword [rsp + 0x80], edx
test r10, r10
je 0x1400afd38
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ScreenColors
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r10, qword [rsp + 0xb0]
cmp byte [r15], 0xf
jbe 0x1400afd43
cmp byte [rbx], 0xf
ja 0x1400afd90
test r10, r10
je 0x1400afd90
mov al, byte [rdi + 0x24]
lea rdx, str.PopupColors
shl al, 4
mov r9d, esi
movzx ecx, al
xor r8d, r8d
movzx eax, byte [rdi + 0x23]
and eax, 0xf
mov dword [rsp + 0x28], esi
or ecx, eax
lea rax, [rsp + 0x88]
mov dword [rsp + 0x88], ecx
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r10, qword [rsp + 0xb0]
test bpl, bpl
je 0x1400afd9e
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret