Function at 0x140105fd0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rsp + 0x138], rbx
mov r12, r8
mov rdi, rdx
mov r13, rcx
mov r9, qword [rcx + 0x90]
cmp dword [r9 + 4], 0
je 0x140106756
mov rbx, qword [r9 + 0x10]
add rbx, r9
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140106756
cmp byte [rbx + 0x18], 0
jne 0x140106756
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140106756
mov rcx, qword [rdi]
mov qword [rbp - 0x69], rcx
mov eax, dword [rcx]
inc eax
cmp eax, 1
jbe 0x140106059
lock inc dword [rcx]
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x48]
call fcn.1401047d0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x61]
call fcn.140104f60
mov rdi, rax
mov rcx, qword [r13 + 0x90]
xor r14d, r14d
cmp dword [rcx + 4], r14d
je 0x1401060ad
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x1401060ad
cmp byte [rbx + 0x18], r14b
jne 0x1401060ad
mov rcx, rbx
call fcn.140104b80
jmp 0x1401060b0
mov rax, r14
mov r9d, dword [r13 + 0x9c]
mov r8, rdi
mov edx, 0x2001f
mov rcx, rax
call fcn.140104370
mov r15, rax
mov qword [rbp - 0x21], rax
mov rcx, qword [rbp - 0x61]
mov edx, dword [rcx]
or esi, 0xffffffff
test edx, edx
je 0x1401060ee
cmp edx, esi
je 0x1401060fc
mov edx, esi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x1401060fc
mov rcx, qword [rbp - 0x61]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
test r15, r15
jne 0x140106112
lea edx, [r15 + 1]
mov rcx, r13
call fcn.1400d99b0
jmp 0x140106728
lea rax, [0x1401e6610]
mov qword [rsp + 0x30], rax
mov rcx, r12
call fcn.1400bdfc0
add eax, 0xfffffffe
cmp eax, 0xa
ja case.0x140106145.6
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x106780]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x67], 7
lea rdx, [rbp - 0x59]
mov rcx, r12
call fcn.1400bdbe0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400db5e0
nop
mov r14, qword [rbp - 0x59]
mov eax, dword [r14]
test eax, eax
je 0x140106189
cmp eax, 0xffffffff
je 0x1401061e2
mov eax, esi
lock xadd dword [r14], eax
cmp eax, 1
jne 0x1401061e2
mov r14, qword [rbp - 0x59]
movsxd rbx, dword [r14 + 0xc]
add rbx, 2
lea rbx, [r14 + rbx*8]
movsxd r15, dword [r14 + 8]
add r15, 2
lea r15, [r14 + r15*8]
cmp r15, rbx
je 0x1401061d6
nop word [rax + rax]
sub rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
je 0x1401061d1
mov rcx, rdi
call fcn.1400b9e30
mov edx, 0x10
mov rcx, rdi
call fcn.14015c170
cmp rbx, r15
jne 0x1401061b0
mov rcx, r14
call fcn.14002d690
mov r15, qword [rbp - 0x21]
mov rcx, qword [rsp + 0x38]
movsxd rax, dword [rcx + 8]
add rax, 2
lea rbx, [rcx + rax*8]
movsxd rax, dword [rcx + 0xc]
add rax, 2
lea rax, [rcx + rax*8]
mov qword [rbp - 0x19], rax
cmp rbx, rax
setne al
test al, al
je 0x14010630c
xor edi, edi
mov rax, qword [rbx]
cmp dword [rax + 4], edi
je 0x14010625c
mov r9d, 1
xor r8d, r8d
movzx edx, di
mov rcx, rbx
call fcn.14001cad0
cmp eax, 0xffffffff
jne 0x14010625c
add rbx, 8
mov rcx, qword [rsp + 0x38]
movsxd rax, dword [rcx + 0xc]
add rax, 2
lea rax, [rcx + rax*8]
mov qword [rbp - 0x19], rax
cmp rbx, rax
setne al
test al, al
jne 0x140106213
jmp 0x14010630c
mov dword [rbp + 0x67], 3
mov rdx, r12
lea rcx, [rbp - 0x79]
call fcn.1400db6f0
nop
mov rax, qword [rbp - 0x79]
mov ecx, dword [rax + 4]
lea ebx, [rcx + rcx]
lea rcx, [rbp - 0x79]
call fcn.140022180
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x51]
call fcn.14002de80
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 7], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x51]
mov eax, dword [rcx]
test eax, eax
je 0x1401062c4
cmp eax, 0xffffffff
je 0x1401062d3
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1401062d3
mov rcx, qword [rbp - 0x51]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.14002cfa0
nop
mov rcx, qword [rbp - 0x79]
mov eax, dword [rcx]
test eax, eax
je 0x1401062f9
cmp eax, 0xffffffff
je 0x1401063df
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1401063df
mov rcx, qword [rbp - 0x79]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
jmp 0x1401063df
movsxd rax, dword [rcx + 8]
add rax, 2
lea rbx, [rcx + rax*8]
movsxd rax, dword [rcx + 0xc]
add rax, 2
lea rax, [rcx + rax*8]
mov qword [rbp - 0x11], rax
cmp rbx, rax
setne al
test al, al
je 0x1401063c6
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, dword [rax + 4]
lea edi, [rcx*2 + 2]
mov rcx, rbx
call fcn.140022180
mov rdx, rax
mov r8d, edi
lea rcx, [rbp - 0x49]
call fcn.14002de80
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14002e3f0
nop
mov rcx, qword [rbp - 0x49]
mov eax, dword [rcx]
test eax, eax
je 0x140106391
cmp eax, 0xffffffff
je 0x14010639f
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14010639f
mov rcx, qword [rbp - 0x49]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.14002cfa0
add rbx, 8
mov rax, qword [rsp + 0x38]
movsxd rcx, dword [rax + 0xc]
add rcx, 2
lea rcx, [rax + rcx*8]
mov qword [rbp - 0x11], rcx
cmp rbx, rcx
setne al
test al, al
jne 0x140106340
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002e4c0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002e4c0
nop
mov rdi, qword [rsp + 0x38]
mov eax, dword [rdi]
test eax, eax
je 0x1401063ff
cmp eax, 0xffffffff
je 0x14010645c
mov eax, esi
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x14010645c
mov rdi, qword [rsp + 0x38]
movsxd rbx, dword [rdi + 0xc]
add rbx, 2
lea rbx, [rdi + rbx*8]
movsxd r14, dword [rdi + 8]
add r14, 2
lea r14, [rdi + r14*8]
cmp r14, rbx
je 0x140106453
nop dword [rax]
sub rbx, 8
mov rcx, qword [rbx]
mov eax, dword [rcx]
test eax, eax
je 0x14010643d
cmp eax, 0xffffffff
je 0x14010644e
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14010644e
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbx]
call fcn.14002cfa0
cmp rbx, r14
jne 0x140106420
mov rcx, rdi
call fcn.14002d690
nop
jmp 0x140106609
mov ebx, 4
mov dword [rbp + 0x67], ebx
xor edx, edx
mov rcx, r12
call fcn.1400bd9e0
mov dword [rbp + 0x7f], eax
mov r8d, ebx
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x41]
call fcn.14002de80
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 0xf], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x41]
mov eax, dword [rcx]
test eax, eax
je 0x1401064c0
cmp eax, 0xffffffff
je 0x140106609
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140106609
mov rcx, qword [rbp - 0x41]
mov edx, 1
jmp 0x1401065fe
mov dword [rbp + 0x67], 0xb
xor edx, edx
mov rcx, r12
call fcn.1400bdc10
mov qword [rbp - 9], rax
mov r8d, 8
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.14002de80
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 0x17], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x39]
mov eax, dword [rcx]
test eax, eax
je 0x14010652c
cmp eax, 0xffffffff
je 0x140106609
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140106609
mov rcx, qword [rbp - 0x39]
mov edx, 1
jmp 0x1401065fe
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400db6f0
nop
mov r9d, 1
xor r8d, r8d
movzx edx, r14w
lea rcx, [rsp + 0x40]
call fcn.14001cad0
mov ecx, 1
mov edx, 3
cmp eax, 0xffffffff
cmovne ecx, edx
mov dword [rbp + 0x67], ecx
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax + 4]
cmp ecx, 1
jne 0x14010657d
inc ebx
add ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.140022180
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x31]
call fcn.14002de80
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 0x1f], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x31]
mov eax, dword [rcx]
test eax, eax
je 0x1401065ca
cmp eax, 0xffffffff
je 0x1401065d9
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1401065d9
mov rcx, qword [rbp - 0x31]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.14002cfa0
nop
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x1401065f9
cmp eax, 0xffffffff
je 0x140106609
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140106609
mov rcx, qword [rsp + 0x40]
mov edx, 2
mov r8d, 8
call fcn.14002cfa0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x29]
call fcn.140104e00
nop
mov rcx, qword [rsp + 0x30]
mov edi, dword [rcx + 4]
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rax
call fcn.140022180
mov rdx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x29]
mov eax, dword [rcx]
test eax, eax
je 0x14010666b
cmp eax, 0xffffffff
je 0x140106679
mov edx, esi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140106679
mov rcx, qword [rbp - 0x29]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
test ebx, ebx
jne 0x140106686
mov byte [r13 + 0x98], bl
jmp 0x1401066ef
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x71], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x14010669b
lock inc dword [rax]
lea rcx, [rbp - 0x71]
call fcn.140022180
mov r8, rax
lea rdx, [0x1402e4230]
mov ecx, ebx
call fcn.140010d50
nop
mov rcx, qword [rbp - 0x71]
mov eax, dword [rcx]
test eax, eax
je 0x1401066d4
cmp eax, 0xffffffff
je 0x1401066e2
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1401066e2
mov rcx, qword [rbp - 0x71]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
mov edx, 1
mov rcx, r13
call fcn.1400d99b0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140106719
cmp eax, 0xffffffff
je 0x140106728
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140106728
mov rcx, qword [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.14002cfa0
nop
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x140106746
cmp eax, 0xffffffff
je 0x140106763
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x140106763
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
jmp 0x140106763
mov edx, 1
mov rcx, r13
call fcn.1400d99b0
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret