Function at 0x140002518
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2078]
mov eax, 0x2178
call fcn.1400114e0
sub rsp, rax
mov rax, qword [0x1400190b8]
xor rax, rsp
mov qword [rbp + 0x2060], rax
mov r13, rdx
mov qword [rsp + 0x40], r9
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x38], r8
mov r15, r8
mov r12, rcx
call fcn.140002ca0
xor ebx, ebx
test eax, eax
js 0x14000294c
lea r14, str.SMDB
mov edi, ebx
mov rsi, r14
mov rdx, qword [rsi]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400025a9
inc edi
add rsi, 0x10
cmp edi, 4
jb 0x14000257d
mov eax, 0x80020009
jmp 0x14000294c
movsxd rax, edi
add rax, rax
movzx edi, word [r14 + rax*8 + 8]
mov rcx, qword [r12]
cmp word [rcx], 9
jb 0x1400025e3
cmp word [rcx], 0xa
jbe 0x1400025d1
cmp word [rcx], 0xd
je 0x1400025d1
cmp word [rcx], 0x20
jne 0x1400025e3
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov qword [r12], rax
jmp 0x1400025b5
lea rdx, [rbp + 0x60]
mov rcx, r12
call fcn.140002ca0
test eax, eax
js 0x14000294c
cmp di, 8
je 0x1400028e8
cmp di, 0x11
je 0x14000279d
cmp di, 0x13
je 0x140002759
mov eax, 0x4008
cmp di, ax
jne 0x140002938
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x50], rbx
mov rax, rsi
lea rcx, [rbp + 0x60]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140002633
add eax, 2
movsxd rcx, eax
je 0x140002674
xor edx, edx
mov rax, rsi
div rcx
cmp rax, 2
jb 0x14000297b
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x140002674
lea rcx, [rsp + 0x50]
call fcn.140002090
mov rdi, qword [rsp + 0x50]
jmp 0x14000267e
lea rdi, [rsp + 0x58]
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x140002737
lea r14, [rbp + 0x60]
cmp word [rbp + 0x60], bx
je 0x1400026d8
mov rcx, r14
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
movzx ecx, word [r14]
cmp cx, 0x5c
jne 0x1400026c7
cmp word [rax], 0x30
jne 0x1400026c7
mov rcx, rax
mov word [rdi], bx
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov r14, rax
jmp 0x1400026ce
mov word [rdi], cx
add r14, 2
add rdi, 2
cmp word [r14], bx
jne 0x140002691
mov dword [rdi], ebx
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140002986
mov r9d, ebx
mov r8, rdx
mov rcx, rsi
inc rcx
cmp word [r8 + rcx*2], bx
jne 0x1400026f1
inc ecx
lea r8, [r8 + rcx*2]
lea r9d, [r9 + rcx*2]
cmp ecx, 1
jne 0x1400026ee
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea r9d, [rcx + 6]
mov rcx, qword [r13]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x50]
mov esi, eax
jmp 0x14000273c
mov esi, 0xe
lea rax, [rsp + 0x58]
cmp rdi, rax
je 0x14000292b
lea rcx, [rsp + 0x50]
call fcn.140002078
jmp 0x14000292b
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
lea rcx, [rbp + 0x60]
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
nop dword [rax + rax]
test eax, eax
js 0x14000294c
mov eax, dword [rsp + 0x30]
mov ecx, 4
mov dword [rsp + 0x38], eax
mov r9d, ecx
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x38]
jmp 0x14000290e
or rsi, 0xffffffffffffffff
lea rax, [rbp + 0x60]
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1400027a8
test dil, 1
jne 0x140002813
mov eax, edi
mov qword [rsp + 0x50], rbx
cdq
sub eax, edx
sar eax, 1
movsxd r15, eax
mov r14, r15
je 0x1400027fa
xor edx, edx
mov rax, rsi
div r14
cmp rax, 1
jb 0x140002970
cmp r15, 0x100
jbe 0x1400027fa
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140002090
mov rcx, qword [rsp + 0x50]
jmp 0x140002804
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
test rcx, rcx
jne 0x14000281d
lea rcx, [rsp + 0x50]
call fcn.140002078
mov eax, 0x80004005
jmp 0x14000294c
mov r8, r14
xor edx, edx
call sub.msvcrt.dll_memset
movsxd r11, edi
mov r9d, ebx
test edi, edi
jle 0x1400028a1
mov r8, rbx
mov eax, r9d
cdq
sub eax, edx
movzx edx, word [rbp + r8*2 + 0x60]
sar eax, 1
movsxd r10, eax
add r10, qword [rsp + 0x50]
cmp dx, 0x30
jb 0x14000287d
cmp dx, 0x39
jbe 0x140002878
cmp dx, 0x40
jbe 0x14000287d
cmp dx, 0x46
jbe 0x140002873
cmp dx, 0x60
jbe 0x14000287d
cmp dx, 0x66
ja 0x14000287d
sub dl, 0x57
jmp 0x14000287f
sub dl, 0x37
jmp 0x14000287f
sub dl, 0x30
jmp 0x14000287f
mov dl, bl
mov ecx, r9d
mov eax, 4
and ecx, 1
inc r9d
shl ecx, 2
inc r8
sub eax, ecx
mov cl, al
shl dl, cl
or byte [r10], dl
cmp r8, r11
jl 0x140002834
mov rax, qword [rsp + 0x50]
mov r9d, 3
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [r13]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov esi, eax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x14000292b
lea rcx, [rsp + 0x50]
call fcn.140002078
jmp 0x14000292b
lea rax, [rbp + 0x60]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], bx
jne 0x1400028f0
lea eax, [rsi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x60]
mov rcx, qword [r13]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov esi, eax
test esi, esi
je 0x140002938
mov ecx, esi
call fcn.140002c88
jmp 0x14000294c
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.140002ca0
test eax, eax
cmovs ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x2060]
xor rcx, rsp
call fcn.140010b90
add rsp, 0x2178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140003dac
int3
mov ecx, 0x80070057
call fcn.140003dac
int3
mov ecx, 0x80004005
call fcn.140003dac
int3