Function at 0x1400612d0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x18f8
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x18e0], rax
mov rbx, r9
mov rbp, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
lea r9, str.lpszLinkApp_s__lpszPrnName_s__lpszUninstKey_s
lea r8, str.EntryLinkedApp
lea rdx, str.CRegistryIF
mov rcx, qword [rcx]
call fcn.140080c70
xor esi, esi
test rbx, rbx
je 0x1400618bf
mov edi, 0x410
mov rdx, rdi
lea rcx, [rsp + 0xa0]
mov r8d, esi
lea rax, [rsp + 0xa0]
sub rbx, rax
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140061394
movzx eax, word [rcx + rbx]
test ax, ax
je 0x140061394
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061370
jmp 0x140061399
test rdx, rdx
jne 0x1400613a3
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
test r8d, r8d
jne 0x1400614d4
mov rdx, rdi
lea rcx, [rsp + 0x10c0]
mov r9d, esi
lea r8, [rsp + 0xa0]
lea rax, [rsp + 0x10c0]
sub r8, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x1400613f5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400613f5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400613d0
jmp 0x1400613fa
test rdx, rdx
jne 0x140061404
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], si
test r9d, r9d
jne 0x1400614d4
lea rdx, str.PrinterDrivers
lea rcx, [rsp + 0x10c0]
call fcn.14002ae40
lea rcx, [rsp + 0xa0]
mov r8d, esi
lea rdx, [rsp + 0x10c0]
lea rax, [rsp + 0xa0]
sub rdx, rax
lea rax, [rdi + 0x7ffffbee]
test rax, rax
je 0x140061466
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140061466
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140061442
jmp 0x14006146b
test rdi, rdi
jne 0x140061475
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
mov eax, esi
test r8d, r8d
sete al
test eax, eax
je 0x1400614d4
mov edx, 0x400
lea rcx, [rsp + 0x8c0]
lea rdi, [rsp + 0xa0]
lea rax, [rsp + 0x8c0]
sub rdi, rax
lea rax, [rdx + 0x7ffffbfe]
test rax, rax
je 0x1400614c8
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400614c8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400614a4
jmp 0x1400614cd
test rdx, rdx
jne 0x1400614d1
sub rcx, 2
mov word [rcx], si
mov r9d, 0x400
mov r8, rbp
lea rdx, [rsp + 0x8c0]
mov rcx, qword [r15 + 8]
call fcn.140012f30
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r15]
call fcn.140081070
mov edi, esi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x8c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 1
test eax, eax
jne 0x140061585
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov edi, ecx
mov dword [rsp + 0x20], edi
lea r9, [0x1400fb428]
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r15]
call fcn.140081270
test edi, edi
je 0x1400618bf
mov ebx, esi
call fcn.14009d5e8
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400615cf
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
lea rbp, str.LinkedAppName
mov r8, rbp
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.1400678e0
mov r12, rax
or r13, 0xffffffffffffffff
test rax, rax
je 0x1400616d9
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140003940
xor r9d, r9d
mov r8w, 0x2c
mov rdx, r12
mov rcx, qword [r15 + 8]
call fcn.140010520
mov rbp, rax
test rax, rax
je 0x1400616ab
mov ebx, esi
mov rdi, rsi
mov rcx, qword [rax + 0x10]
test rcx, rcx
jle 0x14006169c
test ebx, ebx
jne 0x14006169c
test rdi, rdi
js 0x140061673
cmp rdi, rcx
jge 0x140061673
test rdi, rdi
js 0x140061696
cmp rdi, rcx
jge 0x140061696
mov rax, qword [rbp + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x140061676
mov rcx, rsi
mov rdx, r14
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove ebx, eax
add rdi, rax
mov rcx, qword [rbp + 0x10]
cmp rdi, rcx
jge 0x14006169c
jmp 0x140061651
call fcn.1400a0610
int3
mov rax, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r15 + 8]
mov r8, r12
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x1400616cf
mov rdi, qword [rsp + 0x50]
lea rbp, str.LinkedAppName
jmp 0x1400616d9
mov rdi, qword [rsp + 0x50]
jmp 0x140061897
cmp dword [rdi - 0x10], 0
jne 0x1400617e3
test r14, r14
je 0x140061732
mov eax, 0x3fffffff
mov r8, rax
mov rcx, r14
mov edx, esi
cmp word [rcx], dx
je 0x140061706
add rcx, 2
sub r8, 1
jne 0x1400616f5
jmp 0x14006170b
test r8, r8
jne 0x14006171d
mov edx, 0x80070057
mov rax, rsi
mov qword [rsp + 0x88], rax
jmp 0x140061728
sub rax, r8
mov qword [rsp + 0x88], rax
test edx, edx
js 0x140061737
lea rbp, [rax + rax]
jmp 0x14006173a
mov edx, 0x80070057
mov rbp, rsi
test edx, edx
jns 0x140061748
mov rbp, rsi
mov qword [rsp + 0x60], rsi
jmp 0x140061751
add rbp, 2
mov qword [rsp + 0x60], rbp
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], r14
mov r12d, 1
mov dword [rsp + 0x30], r12d
lea rax, str.LinkedAppName
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r15]
call fcn.140081070
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov r9d, r12d
xor r8d, r8d
lea rdx, str.LinkedAppName
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete sil
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r15]
call fcn.140081270
jmp 0x140061897
mov r8, r14
lea rdx, [0x1400fac38]
lea rcx, [rsp + 0x50]
call fcn.1400037a0
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140061847
mov eax, 0x3fffffff
mov r8, rax
mov rcx, rdi
mov edx, esi
nop
cmp word [rcx], dx
je 0x140061821
add rcx, 2
sub r8, 1
jne 0x140061810
jmp 0x140061826
test r8, r8
jne 0x140061835
mov edx, 0x80070057
mov rax, rsi
mov qword [rsp + 0x78], rax
jmp 0x14006183d
sub rax, r8
mov qword [rsp + 0x78], rax
test edx, edx
js 0x14006184c
lea rbx, [rax + rax]
jmp 0x14006184f
mov edx, 0x80070057
mov rbx, rsi
test edx, edx
jns 0x14006185d
mov rbx, rsi
mov qword [rsp + 0x68], rbx
jmp 0x140061866
add rbx, 2
mov qword [rsp + 0x68], rbx
cmp dword [rdi - 8], 1
jle 0x14006187e
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140003570
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x20], ebx
mov r9, rdi
mov r8, rbp
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.140067ac0
mov esi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x1400618bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.EntryLinkedApp
lea rdx, str.CRegistryIF
mov rcx, qword [r15]
call fcn.140080e70
mov eax, esi
mov rcx, qword [rsp + 0x18e0]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x18f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret