Function at 0x14009e520
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0x128], rbx
mov r15, r8
mov rdi, rdx
mov r13, rcx
mov rbx, qword [rcx + 0xd0]
cmp dword [rbx + 8], 0
je 0x14009eb84
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009eb84
cmp byte [rbx + 0x28], 0
jne 0x14009eb84
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009eb84
mov rax, qword [rdi]
mov qword [rbp + 0xf], rax
lock inc dword [rax]
lea rdx, [rbp + 0xf]
lea rcx, [rsp + 0x38]
call fcn.14009d280
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 9]
call fcn.14009ceb0
mov rdi, rax
mov rbx, qword [r13 + 0xd0]
xor r12d, r12d
cmp dword [rbx + 8], r12d
je 0x14009e5ed
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009e5ed
cmp byte [rbx + 0x28], r12b
jne 0x14009e5ed
lea rcx, [rbx + 0x10]
call fcn.14009ce20
jmp 0x14009e5f0
mov rax, r12
mov r8, rdi
mov edx, 0x2001f
mov rcx, rax
call fcn.14009cce0
mov r14, rax
mov qword [rbp - 1], rax
mov rdx, qword [rbp - 9]
lock dec dword [rdx]
jne 0x14009e619
mov rcx, qword [rbp - 9]
call fcn.140012a00
test r14, r14
jne 0x14009e648
lea edx, [r14 + 1]
mov rcx, r13
call fcn.140082d20
nop
mov rax, qword [rsp + 0x38]
lock dec dword [rax]
jne 0x14009eb91
mov rcx, qword [rsp + 0x38]
call fcn.140012a00
jmp 0x14009eb91
lea rax, [0x1415d9338]
mov qword [rsp + 0x30], rax
lock inc dword [0x1415d9338]
mov rcx, r15
call fcn.140075990
add eax, 0xfffffffe
cmp eax, 9
ja case.0x14009e682.6
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x9ebac]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x7f], 7
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.14007a970
nop
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.140088090
nop
mov rax, qword [rbp - 0x49]
test rax, rax
je 0x14009e709
lock dec dword [rax]
jne 0x14009e709
mov r13, qword [rbp - 0x49]
movsxd rax, dword [r13 + 0xc]
lea rbx, [r13 + rax*8 + 0x18]
movsxd rax, dword [r13 + 8]
lea r14, [r13 + rax*8 + 0x18]
cmp r14, rbx
je 0x14009e6f1
nop
sub rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
je 0x14009e6ec
mov rcx, rdi
call fcn.140075950
mov rcx, rdi
call fcn.1400ae120
cmp rbx, r14
jne 0x14009e6d0
mov eax, dword [r13]
test eax, eax
jne 0x14009e701
mov rcx, r13
call fcn.14000c4e0
mov r14, qword [rbp - 1]
mov r13, qword [rbp + 0x67]
mov rax, qword [rbp - 0x69]
movsxd rcx, dword [rax + 8]
lea rbx, [rax + rcx*8 + 0x18]
mov rcx, rbx
movsxd rdx, dword [rax + 0xc]
lea rdx, [rax + rdx*8 + 0x18]
cmp rbx, rdx
je 0x14009e838
nop dword [rax + rax]
mov rax, qword [rcx]
mov r9d, dword [rax + 8]
test r9d, r9d
je 0x14009e762
mov r8d, r12d
jle 0x14009e757
mov rax, qword [rax + 0x10]
cmp word [rax], 0
je 0x14009e762
inc r8d
add rax, 2
cmp r8d, r9d
jl 0x14009e745
add rcx, 8
cmp rcx, rdx
je 0x14009e7d2
jmp 0x14009e730
mov dword [rbp + 0x7f], 3
mov rdx, r15
lea rcx, [rbp - 0x71]
call fcn.140084c10
nop
mov rax, qword [rbp - 0x71]
mov ecx, dword [rax + 8]
lea ebx, [rcx + rcx]
lea rcx, [rbp - 0x71]
call fcn.140012e50
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x39]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c9d0
nop
mov rax, qword [rbp - 0x39]
lock dec dword [rax]
jne 0x14009e7ba
mov rcx, qword [rbp - 0x39]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x71]
lock dec dword [rax]
jne 0x14009e851
mov rcx, qword [rbp - 0x71]
call fcn.140012a00
jmp 0x14009e851
cmp rbx, rdx
je 0x14009e838
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, dword [rax + 8]
lea edi, [rcx + rcx + 2]
mov rcx, rbx
call fcn.140012e50
mov rdx, rax
mov r8d, edi
lea rcx, [rbp - 0x59]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000cf40
nop
mov rax, qword [rbp - 0x59]
lock dec dword [rax]
jne 0x14009e822
mov rcx, qword [rbp - 0x59]
call fcn.14000c4e0
add rbx, 8
mov rax, qword [rbp - 0x69]
movsxd rcx, dword [rax + 0xc]
lea rax, [rax + rcx*8 + 0x18]
cmp rbx, rax
jne 0x14009e7e0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000d230
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000d230
nop
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x14009ea24
lock dec dword [rax]
jne 0x14009ea24
mov rdi, qword [rbp - 0x69]
movsxd rax, dword [rdi + 0xc]
lea rbx, [rdi + rax*8 + 0x18]
movsxd rax, dword [rdi + 8]
lea r12, [rdi + rax*8 + 0x18]
cmp r12, rbx
je 0x14009e89b
sub rbx, 8
mov rcx, qword [rbx]
lock dec dword [rcx]
jne 0x14009e896
mov rcx, qword [rbx]
call fcn.140012a00
cmp rbx, r12
jne 0x14009e882
mov eax, dword [rdi]
test eax, eax
jne 0x14009ea24
mov rcx, rdi
call fcn.14000c4e0
jmp 0x14009ea24
mov ebx, 4
mov dword [rbp + 0x7f], ebx
xor edx, edx
mov rcx, r15
call fcn.140077660
mov dword [rbp - 0x61], eax
mov r8d, ebx
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c9d0
nop
mov rax, qword [rbp - 0x29]
lock dec dword [rax]
jne 0x14009ea24
mov rcx, qword [rbp - 0x29]
call fcn.14000c4e0
jmp 0x14009ea24
mov dword [rbp + 0x7f], 0xb
xor edx, edx
mov rcx, r15
call fcn.1400776c0
mov qword [rbp + 0x17], rax
mov r8d, 8
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 7]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c9d0
nop
mov rax, qword [rbp + 7]
lock dec dword [rax]
jne 0x14009ea24
mov rcx, qword [rbp + 7]
call fcn.14000c4e0
jmp 0x14009ea24
mov rdx, r15
lea rcx, [rbp - 0x79]
call fcn.140084c10
nop
mov rax, qword [rbp - 0x79]
mov ebx, dword [rax + 8]
test ebx, ebx
jle 0x14009e988
mov rcx, qword [rax + 0x10]
nop
cmp word [rcx], 0
je 0x14009e984
inc r12d
add rcx, 2
cmp r12d, ebx
jl 0x14009e970
jmp 0x14009e988
mov cl, 1
jmp 0x14009e98a
xor cl, cl
mov eax, 1
mov edx, 3
test cl, cl
cmovne eax, edx
mov dword [rbp + 0x7f], eax
lea rcx, [rbp - 0x79]
cmp eax, edx
jne 0x14009e9d8
add ebx, ebx
call fcn.140012e50
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x19]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c9d0
nop
mov rax, qword [rbp - 0x19]
lock dec dword [rax]
jne 0x14009ea12
mov rcx, qword [rbp - 0x19]
jmp 0x14009ea0c
lea ebx, [rbx + rbx + 2]
call fcn.140012e50
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x51]
call fcn.14000cad0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c9d0
nop
mov rax, qword [rbp - 0x51]
lock dec dword [rax]
jne 0x14009ea12
mov rcx, qword [rbp - 0x51]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x79]
lock dec dword [rax]
jne 0x14009ea24
mov rcx, qword [rbp - 0x79]
call fcn.140012a00
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x41]
call fcn.14009d150
nop
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rcx, rax
call fcn.140012e50
mov rdx, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x7f]
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x41]
lock dec dword [rcx]
jne 0x14009ea77
mov rcx, qword [rbp - 0x41]
call fcn.140012a00
test ebx, ebx
jne 0x14009ea87
mov byte [r13 + 0xd8], bl
jmp 0x14009eb60
mov edx, ebx
lea rcx, [rbp - 0x11]
call fcn.14009cf30
nop
lea rdx, [rbp - 0x21]
mov rcx, rax
call fcn.140012020
mov rdi, rax
lea rdx, [rbp - 0x31]
lea rcx, [rsp + 0x38]
call fcn.140012020
mov rbx, rax
mov rcx, qword [rdi]
mov edx, dword [rcx]
cmp edx, 1
jne 0x14009eaca
mov rdx, qword [rdi]
lea rcx, [rdx + 0x18]
cmp qword [rdx + 0x10], rcx
je 0x14009ead8
mov rcx, qword [rdi]
mov edx, dword [rcx + 8]
mov rcx, rdi
call fcn.14000cc90
mov rax, qword [rdi]
mov rdi, qword [rax + 0x10]
mov rax, qword [rbx]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x14009eaf6
mov rcx, qword [rbx]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x14009eb04
mov rax, qword [rbx]
mov edx, dword [rax + 8]
mov rcx, rbx
call fcn.14000cc90
mov rax, qword [rbx]
mov r8, rdi
mov rdx, qword [rax + 0x10]
lea rcx, [0x1415a6c08]
call fcn.14001b2c0
nop
mov rax, qword [rbp - 0x31]
lock dec dword [rax]
jne 0x14009eb2e
mov rcx, qword [rbp - 0x31]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x21]
lock dec dword [rax]
jne 0x14009eb41
mov rcx, qword [rbp - 0x21]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x11]
lock dec dword [rax]
jne 0x14009eb53
mov rcx, qword [rbp - 0x11]
call fcn.140012a00
mov edx, 1
mov rcx, r13
call fcn.140082d20
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x14009eb7f
mov rcx, qword [rsp + 0x30]
call fcn.14000c4e0
nop
jmp 0x14009e62b
mov edx, 1
mov rcx, r13
call fcn.140082d20
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret