Function at 0x14007845b
Capabilities:
Set registry value

Disassembly:
jmp 0x140088260
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2c48
call fcn.1400789d3
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x986
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c68]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x2c00], rax
lea rcx, [0x1401cb14a]
call fcn.14007b75f
xor eax, eax
mov word [rbp + 0x2044], ax
mov dword [rbp + 0x2064], 0
mov dword [rbp + 0x2084], 0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.14007803c
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400882fc
mov eax, dword [rbp + 4]
jmp 0x140088ac9
lea rdx, [rbp + 0x2044]
lea rcx, [rbp + 0x30]
call fcn.140078983
test eax, eax
jne 0x14008837a
lea rcx, [0x1401b5620]
call fcn.14007bbe7
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x1401b4054]
add ecx, 0xc
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ac8]
call fcn.140079527
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str._Ts_Type_not_supported_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
mov edx, 0x20f
mov rcx, qword [rbp + 0x2c30]
call fcn.140079739
jmp 0x140088ac9
mov rcx, qword [rbp + 0x2c30]
call fcn.14007a729
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.14007803c
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400883a7
mov eax, dword [rbp + 4]
jmp 0x140088ac9
movzx eax, word [rbp + 0x2044]
mov dword [rbp + 0x2be4], eax
cmp dword [rbp + 0x2be4], 8
je 0x1400883ec
cmp dword [rbp + 0x2be4], 0x11
je 0x14008884e
cmp dword [rbp + 0x2be4], 0x13
je 0x1400886e3
cmp dword [rbp + 0x2be4], 0x4008
je 0x14008849f
jmp 0x140088a86
mov r9d, 1
lea r8, [rbp + 0x30]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.14007a12a
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x140088429
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x140088437
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x1401b5620]
call fcn.14007bbe7
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1401b4054]
add ecx, 0x19
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2af8]
call fcn.140079527
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
jmp 0x140088a86
cmp qword [rbp + 0x2c40], 0
jne 0x1400884b9
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x1400884c7
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x1401b5620]
call fcn.14007bbe7
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1401b4054]
add ecx, 0x1e
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b28]
call fcn.140079527
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
lea rcx, [rbp + 0x30]
call fcn.1400783ac
add rax, 2
mov dword [rbp + 0x20a4], eax
mov edx, 0x108
lea rcx, [rbp + 0x20d0]
call fcn.14007844c
lea rcx, [rbp + 0x20d0]
call fcn.14007b589
nop
movsxd rax, dword [rbp + 0x20a4]
mov rdx, rax
lea rcx, [rbp + 0x20d0]
call fcn.14007904f
nop
jmp 0x140088574
lea rcx, [rbp + 0x20d0]
call fcn.140078046
test rax, rax
je 0x1400886c8
lea rcx, [rbp + 0x20d0]
call fcn.140078046
mov qword [rbp + 0x21f8], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x2218], rax
mov dword [rbp + 0x20a4], 0
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
test eax, eax
je 0x140088674
mov rcx, qword [rbp + 0x2218]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2238], rax
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x140088629
mov rax, qword [rbp + 0x2238]
movzx eax, word [rax]
cmp eax, 0x30
jne 0x140088629
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rcx, qword [rbp + 0x2238]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2218], rax
jmp 0x140088661
mov rax, qword [rbp + 0x21f8]
mov rcx, qword [rbp + 0x2218]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rax, qword [rbp + 0x2218]
add rax, 2
mov qword [rbp + 0x2218], rax
mov eax, dword [rbp + 0x20a4]
inc eax
mov dword [rbp + 0x20a4], eax
jmp 0x1400885b1
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
lea rcx, [rbp + 0x20d0]
call fcn.140078046
mov r8, rax
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.14007860e
mov dword [rbp + 0x2064], eax
jmp 0x1400886d2
mov dword [rbp + 0x2064], 0xe
lea rcx, [rbp + 0x20d0]
call fcn.14007965d
jmp 0x140088a86
mov dword [rbp + 0x2274], 0
call fcn.14007af26
mov dword [rbp + 0x2294], eax
mov qword [rbp + 0x22b8], 0
mov qword [rbp + 0x22d8], 0
mov edx, 8
lea rcx, [rbp + 0x22f8]
call fcn.14007ba61
lea rcx, [rbp + 0x22f8]
call fcn.14007abd9
nop
mov edx, 0x400
lea rcx, [rbp + 0x30]
call fcn.14007ae59
mov qword [rbp + 0x2318], rax
lea r9, [rbp + 0x2254]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2318]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140088783
mov eax, dword [rbp + 4]
mov dword [rbp + 0x2b54], eax
lea rcx, [rbp + 0x22f8]
call fcn.14007a878
mov eax, dword [rbp + 0x2b54]
jmp 0x140088ac9
mov r8d, dword [rbp + 0x2254]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.140078f64
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x1400887bd
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x1400887cb
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x1401b5620]
call fcn.14007bbe7
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x1401b4054]
add ecx, 0x5e
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b78]
call fcn.140079527
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x2254]
mov dword [rsp + 0x20], ecx
lea r9, str.Setting_Value__d_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
nop
lea rcx, [rbp + 0x22f8]
call fcn.14007a878
jmp 0x140088a86
lea rcx, [rbp + 0x30]
call fcn.1400783ac
mov dword [rbp + 0x2334], eax
mov eax, dword [rbp + 0x2334]
and eax, 1
test eax, eax
je 0x1400888bf
lea rcx, [0x1401b5620]
call fcn.14007bbe7
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x1401b4054]
add ecx, 0x66
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ba8]
call fcn.140079527
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
mov eax, 0x80004005
jmp 0x140088ac9
mov eax, dword [rbp + 0x2334]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x2354], eax
mov edx, 0x108
lea rcx, [rbp + 0x2380]
call fcn.140079a2c
lea rcx, [rbp + 0x2380]
call fcn.140079644
nop
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x2380]
call fcn.140079c89
nop
jmp 0x140088907
lea rcx, [rbp + 0x2380]
call fcn.140078ea1
test rax, rax
jne 0x140088939
mov dword [rbp + 0x2bd4], 0x80004005
lea rcx, [rbp + 0x2380]
call fcn.14007a319
mov eax, dword [rbp + 0x2bd4]
jmp 0x140088ac9
movsxd rax, dword [rbp + 0x2354]
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.140078ea1
mov rcx, qword [rbp + 0x2be8]
mov r8, rcx
xor edx, edx
mov rcx, rax
call fcn.14007a96d
mov dword [rbp + 0x24a4], 0
jmp 0x140088981
mov eax, dword [rbp + 0x24a4]
inc eax
mov dword [rbp + 0x24a4], eax
mov eax, dword [rbp + 0x2334]
cmp dword [rbp + 0x24a4], eax
jge 0x140088a17
mov eax, dword [rbp + 0x24a4]
cdq
sub eax, edx
sar eax, 1
cdqe
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.140078ea1
mov rcx, qword [rbp + 0x2be8]
add rax, rcx
mov qword [rbp + 0x2bf0], rax
mov eax, dword [rbp + 0x24a4]
and eax, 1
mov ecx, 1
sub ecx, eax
mov eax, ecx
shl eax, 2
mov dword [rbp + 0x2bf8], eax
movsxd rcx, dword [rbp + 0x24a4]
movzx ecx, word [rbp + rcx*2 + 0x30]
call fcn.1400797ca
movzx eax, al
mov ecx, dword [rbp + 0x2bf8]
shl eax, cl
mov rcx, qword [rbp + 0x2bf0]
movzx ecx, byte [rcx]
or ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x2bf0]
mov byte [rcx], al
jmp 0x140088973
lea rcx, [rbp + 0x2380]
call fcn.140078ea1
mov qword [rbp + 0x2be8], rax
mov rcx, qword [rbp + 0x2c38]
call fcn.14007b34f
mov ecx, dword [rbp + 0x2354]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x2c40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x2064], eax
lea rcx, [rbp + 0x2380]
call fcn.14007a319
jmp 0x140088a86
cmp dword [rbp + 0x2064], 0
je 0x140088aa6
mov dword [rbp + 0x2084], 0x204
mov ecx, dword [rbp + 0x2064]
call fcn.14007b48f
jmp 0x140088ac9
mov rdx, qword [rbp + 0x2c48]
mov rcx, qword [rbp + 0x2c30]
call fcn.14007803c
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140088ac7
mov eax, dword [rbp + 4]
jmp 0x140088ac9
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x2c00]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x2c18]
pop rdi
pop rbp
ret