Function at 0x7d22b390
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rcx, qword [0x7d2abf78]
lea rax, [rsp + 0x40]
xor edi, edi
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
mov qword [rsp + 0x58], rdi
lea rdx, [rbp]
mov dword [rsp + 0x50], 0x30
movdqu xmmword [rsp + 0x70], xmm0
sub rdx, rcx
mov dword [rsp + 0x68], 0x40
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d22b3f0
lea rcx, [rbp]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x7d22b410
mov r8, qword [str.usercurrent]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x7d22b430
lea rcx, [rbp]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x7d22b450
movups xmm0, xmmword [str._softwareclasses]
mov eax, dword [0x7d28f738]
lea rdx, [rbp]
movups xmm1, xmmword [0x7d28f728]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov dword [rcx + 0x20], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], 2
lea rcx, [rbp + 0x310]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0xf013f
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
cmp eax, 0xc0000035
je 0x7d22b66c
cmp eax, 0xc0000022
jne 0x7d22b4de
mov ecx, 0x6b
lea rdx, [rbp]
call fcn.7d2211ae
test al, 0x30
je 0x7d22b4e2
jmp 0x7d22b66c
test ebx, ebx
jns 0x7d22b50a
mov r8d, ebx
lea rdx, str._11____08X_
lea rcx, [rbp - 0x80]
call sym.imfsbDll.dll_Sbie_swprintf
lea rdx, [rbp - 0x80]
mov ecx, 0x916
call sym.imfsbDll.dll_SbieApi_Log
xor al, al
jmp 0x7d22b66e
mov rcx, qword [0x7d2abf78]
lea rdx, [rbp]
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d22b520
lea rcx, [rbp]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x7d22b540
mov r8, qword [str.usercurrent]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x7d22b560
lea rcx, [rbp]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x7d22b580
movups xmm0, xmmword [str._classes]
movzx eax, word [0x7d28f778]
lea rdx, [rbp]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x318]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0xf013f
call qword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
js 0x7d22b683
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, str.SymbolicLinkValue
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x7d22b605
mov rcx, qword [rbp + 0x310]
lea rdx, [rsp + 0x40]
add eax, eax
mov r9d, 6
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x310]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x7d22b66c
mov r8d, ebx
lea rdx, str._33____08X_
lea rcx, [rbp - 0x80]
call sym.imfsbDll.dll_Sbie_swprintf
lea rdx, [rbp - 0x80]
mov ecx, 0x916
call sym.imfsbDll.dll_SbieApi_Log
mov al, 1
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cmp eax, 0xc0000035
je 0x7d22b5eb
mov r8d, eax
lea rdx, str._22____08X_
lea rcx, [rbp - 0x80]
call sym.imfsbDll.dll_Sbie_swprintf
lea rdx, [rbp - 0x80]
mov ecx, 0x916
call sym.imfsbDll.dll_SbieApi_Log
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.ntdll.dll_NtClose]
xor al, al
jmp 0x7d22b66e