Function at 0x14000cfbc
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11a8
call fcn.140043350
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14005c8c0]
xor rax, rbp
mov qword [rbp + 0x1160], rax
mov r14, r8
mov r15, rdx
mov qword [rbp + 8], rdx
mov r13, rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x20], r9
xor edi, edi
mov word [rbp], di
lea rdx, [rbp + 0x160]
call fcn.14000a258
cmp eax, edi
jl 0x14000d5a2
lea rdx, [rbp]
lea rcx, [rbp + 0x160]
call fcn.14000a058
cmp eax, edi
jne 0x14000d081
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x36e
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str._s_Type_not_supported_n
xor r8d, r8d
mov rdx, qword [0x14005e690]
lea rcx, [rbp + 0x20]
call fcn.140009800
mov eax, 0x80020009
jmp 0x14000d5a2
mov rcx, qword [r13]
cmp byte [rcx], 9
jl 0x14000d0a5
cmp byte [rcx], 0xa
jle 0x14000d099
cmp byte [rcx], 0xd
je 0x14000d099
cmp byte [rcx], 0x20
jne 0x14000d0a5
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r13], rax
jmp 0x14000d081
lea rdx, [rbp + 0x160]
mov rcx, r13
call fcn.14000a258
cmp eax, edi
jl 0x14000d5a2
movzx eax, word [rbp]
cmp eax, 8
je 0x14000d51a
cmp eax, 0x11
je 0x14000d3af
cmp eax, 0x13
je 0x14000d237
cmp eax, 0x4008
jne 0x14000d58f
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x381
lea rcx, str.default
mov rax, r14
cmp r14, rdi
cmove rax, rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x14005e690]
lea rcx, [rbp + 8]
call fcn.140009800
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov qword [rbp + 0x50], rdi
movsxd rcx, eax
cmp rcx, rdi
jne 0x14000d158
mov rcx, rdi
jmp 0x14000d167
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x14000d176
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.14000b15c
nop
jmp 0x14000d18f
mov ecx, 0x80070057
call fcn.140009850
nop
xor edi, edi
mov r13, qword [rbp + 0x40]
mov r15, qword [rbp + 0x38]
mov r14, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x50]
cmp rbx, rdi
je 0x14000d217
lea rsi, [rbp + 0x160]
cmp byte [rbp + 0x160], dil
je 0x14000d1f9
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [rsi]
cmp cl, 0x5c
jne 0x14000d1d1
cmp byte [rax], 0x30
jne 0x14000d1d1
mov byte [rbx], dil
inc rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rsi, rax
jmp 0x14000d1f4
mov byte [rbx], cl
mov cl, byte [rsi]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
cmp eax, edi
je 0x14000d1ee
inc rbx
inc rsi
mov al, byte [rsi]
cmp al, dil
je 0x14000d1f9
mov byte [rbx], al
inc rbx
inc rsi
cmp byte [rsi], dil
jne 0x14000d1a8
mov byte [rbx], dil
mov byte [rbx + 1], dil
mov r8, qword [rbp + 0x50]
mov rdx, r14
mov rcx, r15
call fcn.140009e40
mov esi, eax
mov rbx, qword [rbp + 0x50]
jmp 0x14000d21c
mov esi, 0xe
lea rax, [rbp + 0x58]
cmp rbx, rax
je 0x14000d582
lea rcx, [rbp + 0x50]
call fcn.14000aa14
jmp 0x14000d582
mov rbx, rdi
mov qword [rbp + 8], rbx
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r12, eax
add r12, r12
mov eax, 0x80000000
add rax, r12
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000d390
cmp r12d, 0x400
jg 0x14000d2a8
movsxd rsi, r12d
mov rcx, rsi
call fcn.14000aa48
cmp al, dil
je 0x14000d2a8
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x14000d295
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140043350
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x14000d2d9
movsxd rsi, r12d
or rax, 0xffffffffffffffff
sub rax, rsi
cmp rax, 0x10
jb 0x14000d385
lea rcx, [rsi + 0x10]
call fcn.14001bcd0
cmp rax, rdi
jne 0x14000d2cf
mov rcx, rdi
jmp 0x14000d2d9
mov qword [rax], rdi
mov rbx, rax
lea rcx, [rax + 0x10]
shr rsi, 1
mov r9d, 3
mov r8d, esi
lea rdx, [rbp + 0x160]
call fcn.140009640
cmp rax, rdi
je 0x14000d390
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r8d, dword [rbp]
mov rdx, r14
mov rcx, r15
call fcn.140009cc8
mov esi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x3be
lea rcx, str.default
cmp r14, rdi
cmove r14, rcx
mov qword [rsp + 0x28], r14
mov eax, dword [rbp]
mov dword [rsp + 0x20], eax
lea r9, str.Setting_Value__d_at__s_n
mov r8d, 2
mov rdx, qword [0x14005e690]
lea rcx, [rbp + 8]
call fcn.140009800
nop
cmp rbx, rdi
je 0x14000d582
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400197c0
cmp rbx, rdi
jne 0x14000d370
jmp 0x14000d582
mov ecx, 0x80070057
call fcn.140009850
nop
cmp rbx, rdi
je 0x14000d3a5
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400197c0
cmp rbx, rdi
jne 0x14000d395
mov eax, 0x8007000e
jmp 0x14000d5a2
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov dword [rbp + 0x30], eax
test al, 1
je 0x14000d3fb
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x3c6
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov rdx, qword [0x14005e690]
lea rcx, [rbp + 0x20]
call fcn.140009800
mov eax, 0x80004005
jmp 0x14000d5a2
cdq
sub eax, edx
sar eax, 1
movsxd rsi, eax
mov dword [rbp], esi
mov qword [rbp + 0x50], rdi
mov rcx, rsi
cmp rsi, rdi
jne 0x14000d417
mov rcx, rdi
jmp 0x14000d426
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x14000d435
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.14000b15c
nop
jmp 0x14000d458
mov ecx, 0x80070057
call fcn.140009850
nop
xor edi, edi
mov ebx, dword [rbp + 0x30]
mov esi, dword [rbp]
mov r13, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 8], rax
mov r14, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x50]
cmp rcx, rdi
jne 0x14000d47d
lea rax, [rbp + 0x58]
cmp rax, rdi
je 0x14000d473
lea rcx, [rbp + 0x50]
call fcn.14000aa14
mov eax, 0x80004005
jmp 0x14000d5a2
movsxd r8, esi
xor edx, edx
call fcn.140019180
mov r12d, edi
mov r15, rdi
movsxd rax, ebx
cmp rax, rdi
jle 0x14000d4dd
mov rsi, rax
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
add rbx, qword [rbp + 0x50]
mov cl, byte [rbp + r15 + 0x160]
call fcn.14000a14c
mov r11b, al
mov ecx, r12d
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
mov cl, al
shl r11b, cl
or byte [rbx], r11b
inc r12d
inc r15
cmp r15, rsi
jl 0x14000d498
mov esi, dword [rbp]
mov dword [rsp + 0x28], esi
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x14000d582
lea rcx, [rbp + 0x50]
call fcn.14000aa14
jmp 0x14000d582
mov r9d, 1
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r15
call fcn.140009d40
mov esi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x37c
lea rcx, str.default
cmp r14, rdi
cmove r14, rcx
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x14005e690]
lea rcx, [rbp + 8]
call fcn.140009800
cmp esi, edi
je 0x14000d58f
mov ecx, esi
call fcn.140009970
jmp 0x14000d5a2
mov rdx, qword [rbp + 0x20]
mov rcx, r13
call fcn.14000a258
cmp eax, edi
cmovl edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x1160]
xor rcx, rbp
call fcn.1400193c0
lea rsp, [rbp + 0x1178]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret