Function at 0x1400eb983
Capabilities:
Set registry value

Disassembly:
jmp 0x140157f00
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2c48
call fcn.1400ec5ae
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x986
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c68]
mov rax, qword [0x140359238]
xor rax, rbp
mov qword [rbp + 0x2c00], rax
lea rcx, [0x1403814f3]
call fcn.1400f28c8
xor eax, eax
mov word [rbp + 0x2044], ax
mov dword [rbp + 0x2064], 0
mov dword [rbp + 0x2084], 0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400eb082
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140157f9c
mov eax, dword [rbp + 4]
jmp 0x1401587c3
lea rdx, [rbp + 0x2044]
lea rcx, [rbp + 0x30]
call fcn.1400ec4d7
test eax, eax
jne 0x14015801a
lea rcx, [0x14035caa0]
call fcn.1400f3340
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x1403590dc]
add ecx, 0xc
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ac8]
call fcn.1400edcf6
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str._Ts_Type_not_supported_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
mov edx, 0x20f
mov rcx, qword [rbp + 0x2c30]
call fcn.1400ee174
jmp 0x1401587c3
mov rcx, qword [rbp + 0x2c30]
call fcn.1400f0474
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400eb082
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140158047
mov eax, dword [rbp + 4]
jmp 0x1401587c3
movzx eax, word [rbp + 0x2044]
mov dword [rbp + 0x2be4], eax
cmp dword [rbp + 0x2be4], 8
je 0x14015808c
cmp dword [rbp + 0x2be4], 0x11
je 0x14015851e
cmp dword [rbp + 0x2be4], 0x13
je 0x1401583b3
cmp dword [rbp + 0x2be4], 0x4008
je 0x14015813f
jmp 0x140158780
mov r9d, 1
lea r8, [rbp + 0x30]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400ef795
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x1401580c9
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x1401580d7
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14035caa0]
call fcn.1400f3340
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1403590dc]
add ecx, 0x19
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2af8]
call fcn.1400edcf6
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
jmp 0x140158780
cmp qword [rbp + 0x2c40], 0
jne 0x140158159
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x140158167
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14035caa0]
call fcn.1400f3340
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1403590dc]
add ecx, 0x1e
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b28]
call fcn.1400edcf6
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
lea rax, [rbp + 0x30]
mov qword [rbp + 0x2be8], rax
mov qword [rbp + 0x2bf0], 0xffffffffffffffff
inc qword [rbp + 0x2bf0]
mov rax, qword [rbp + 0x2be8]
mov rcx, qword [rbp + 0x2bf0]
cmp word [rax + rcx*2], 0
jne 0x1401581e0
mov rax, qword [rbp + 0x2bf0]
add rax, 2
mov dword [rbp + 0x20a4], eax
mov edx, 0x108
lea rcx, [rbp + 0x20d0]
call fcn.1400eb938
lea rcx, [rbp + 0x20d0]
call fcn.1400f246d
nop
movsxd rax, dword [rbp + 0x20a4]
mov rdx, rax
lea rcx, [rbp + 0x20d0]
call fcn.1400ed305
nop
jmp 0x140158244
lea rcx, [rbp + 0x20d0]
call fcn.1400eb091
test rax, rax
je 0x140158398
lea rcx, [rbp + 0x20d0]
call fcn.1400eb091
mov qword [rbp + 0x21f8], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x2218], rax
mov dword [rbp + 0x20a4], 0
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
test eax, eax
je 0x140158344
mov rcx, qword [rbp + 0x2218]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2238], rax
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x1401582f9
mov rax, qword [rbp + 0x2238]
movzx eax, word [rax]
cmp eax, 0x30
jne 0x1401582f9
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rcx, qword [rbp + 0x2238]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2218], rax
jmp 0x140158331
mov rax, qword [rbp + 0x21f8]
mov rcx, qword [rbp + 0x2218]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rax, qword [rbp + 0x2218]
add rax, 2
mov qword [rbp + 0x2218], rax
mov eax, dword [rbp + 0x20a4]
inc eax
mov dword [rbp + 0x20a4], eax
jmp 0x140158281
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
lea rcx, [rbp + 0x20d0]
call fcn.1400eb091
mov r8, rax
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400ebdb1
mov dword [rbp + 0x2064], eax
jmp 0x1401583a2
mov dword [rbp + 0x2064], send
lea rcx, [rbp + 0x20d0]
call fcn.1400edf6c
jmp 0x140158780
mov dword [rbp + 0x2274], 0
call fcn.1400f1612
mov dword [rbp + 0x2294], eax
mov qword [rbp + 0x22b8], 0
mov qword [rbp + 0x22d8], 0
mov edx, 8
lea rcx, [rbp + 0x22f8]
call fcn.1400f2f35
lea rcx, [rbp + 0x22f8]
call fcn.1400f0f3c
nop
mov edx, 0x400
lea rcx, [rbp + 0x30]
call fcn.1400f1487
mov qword [rbp + 0x2318], rax
lea r9, [rbp + 0x2254]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2318]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140158453
mov eax, dword [rbp + 4]
mov dword [rbp + 0x2b54], eax
lea rcx, [rbp + 0x22f8]
call fcn.1400f0735
mov eax, dword [rbp + 0x2b54]
jmp 0x1401587c3
mov r8d, dword [rbp + 0x2254]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400ed143
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x14015848d
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x14015849b
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14035caa0]
call fcn.1400f3340
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1403590dc]
add ecx, 0x5e
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b78]
call fcn.1400edcf6
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x2254]
mov dword [rsp + 0x20], ecx
lea r9, str.Setting_Value__d_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
nop
lea rcx, [rbp + 0x22f8]
call fcn.1400f0735
jmp 0x140158780
lea rax, [rbp + 0x30]
mov qword [rbp + 0x2be8], rax
mov qword [rbp + 0x2bf0], 0xffffffffffffffff
inc qword [rbp + 0x2bf0]
mov rax, qword [rbp + 0x2be8]
mov rcx, qword [rbp + 0x2bf0]
cmp word [rax + rcx*2], 0
jne 0x140158534
mov rax, qword [rbp + 0x2bf0]
mov dword [rbp + 0x2334], eax
mov eax, dword [rbp + 0x2334]
and eax, 1
test eax, eax
je 0x1401585bf
lea rcx, [0x14035caa0]
call fcn.1400f3340
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x1403590dc]
add ecx, 0x66
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ba8]
call fcn.1400edcf6
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
mov eax, 0x80004005
jmp 0x1401587c3
mov eax, dword [rbp + 0x2334]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x2354], eax
mov edx, 0x108
lea rcx, [rbp + 0x2380]
call fcn.1400ee831
lea rcx, [rbp + 0x2380]
call fcn.1400edf49
nop
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x2380]
call fcn.1400eed40
nop
jmp 0x140158607
lea rcx, [rbp + 0x2380]
call fcn.1400ecf9f
test rax, rax
jne 0x140158639
mov dword [rbp + 0x2bd4], 0x80004005
lea rcx, [rbp + 0x2380]
call fcn.1400efb96
mov eax, dword [rbp + 0x2bd4]
jmp 0x1401587c3
movsxd rax, dword [rbp + 0x2354]
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.1400ecf9f
mov rdi, rax
xor eax, eax
mov rcx, qword [rbp + 0x2be8]
rep stosb byte [rdi], al
mov dword [rbp + 0x24a4], 0
jmp 0x14015867b
mov eax, dword [rbp + 0x24a4]
inc eax
mov dword [rbp + 0x24a4], eax
mov eax, dword [rbp + 0x2334]
cmp dword [rbp + 0x24a4], eax
jge 0x140158711
mov eax, dword [rbp + 0x24a4]
cdq
sub eax, edx
sar eax, 1
cdqe
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.1400ecf9f
mov rcx, qword [rbp + 0x2be8]
add rax, rcx
mov qword [rbp + 0x2bf0], rax
mov eax, dword [rbp + 0x24a4]
and eax, 1
mov ecx, 1
sub ecx, eax
mov eax, ecx
shl eax, 2
mov dword [rbp + 0x2bf8], eax
movsxd rcx, dword [rbp + 0x24a4]
movzx ecx, word [rbp + rcx*2 + 0x30]
call fcn.1400ee2fa
movzx eax, al
mov ecx, dword [rbp + 0x2bf8]
shl eax, cl
mov rcx, qword [rbp + 0x2bf0]
movzx ecx, byte [rcx]
or ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x2bf0]
mov byte [rcx], al
jmp 0x14015866d
lea rcx, [rbp + 0x2380]
call fcn.1400ecf9f
mov qword [rbp + 0x2be8], rax
mov rcx, qword [rbp + 0x2c38]
call fcn.1400f1f13
mov ecx, dword [rbp + 0x2354]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x2c40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x2064], eax
lea rcx, [rbp + 0x2380]
call fcn.1400efb96
jmp 0x140158780
cmp dword [rbp + 0x2064], 0
je 0x1401587a0
mov dword [rbp + 0x2084], 0x204
mov ecx, dword [rbp + 0x2064]
call fcn.1400f222e
jmp 0x1401587c3
mov rdx, qword [rbp + 0x2c48]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400eb082
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1401587c1
mov eax, dword [rbp + 4]
jmp 0x1401587c3
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400f1356
mov rax, rdi
mov rcx, qword [rbp + 0x2c00]
xor rcx, rbp
call fcn.1400eea70
lea rsp, [rbp + 0x2c18]
pop rdi
pop rbp
ret