Function at 0x14009dcb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
xor r12d, r12d
mov ebp, r8d
lea r13, [0x140101bd0]
mov r14, r9
mov rbx, rdx
mov r15, rcx
test rdx, rdx
je 0x14009dee0
test r8d, r8d
jne 0x14009dd05
xor r8d, r8d
mov edx, 1
call fcn.140011850
jmp 0x14009e1b0
mov ecx, dword [rdx + 0x10]
cmp ebp, 4
je 0x14009de5f
test ecx, ecx
je 0x14009de38
sub ecx, 1
je 0x14009de20
sub ecx, 1
je 0x14009ddad
cmp ecx, 2
je 0x14009dd38
mov rsi, r13
jmp 0x14009de49
mov rsi, qword [rdx]
cmp byte [rsi + 0x23], r12b
jne 0x14009dd54
mov rcx, qword [rsi + 0x10]
mov edx, 1
call fcn.140007a14
mov rsi, rax
jmp 0x14009dd7e
test byte [rsi + 0x21], 1
je 0x14009dd62
mov rcx, rsi
call fcn.140007880
cmp byte [rsi + 0x23], 3
jne 0x14009dd7a
cmp byte [rsi + 0x21], r12b
jl 0x14009dd7a
mov rcx, rsi
call fcn.1400a5c10
and byte [rsi + 0x21], 0x7f
mov rsi, qword [rsi + 8]
mov rbx, qword [rbx]
cmp byte [rbx + 0x23], r12b
jne 0x14009dd93
mov rcx, qword [rbx + 0x10]
call fcn.140005690
mov rbx, rax
test byte [rbx + 0x21], 1
je 0x14009dda1
mov rcx, rbx
call fcn.140007880
mov rbx, qword [rbx + 0x10]
shr rbx, 1
jmp 0x14009def0
movsd xmm3, qword [rdx]
lea r8, str._.17g
movq r9, xmm3
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.1400a2630
lea rdx, [0x140110864]
movsxd rbx, eax
lea rcx, [rsp + 0x60]
call fcn.1400d431c
cmp rax, rbx
jne 0x14009de13
lea ecx, [rbx + 3]
cmp ecx, 0x100
jg 0x14009de13
movzx eax, word [rsp + rbx*2 + 0x5e]
sub ax, 0x30
cmp ax, 9
ja 0x14009de13
mov dword [rsp + rbx*2 + 0x60], 0x30002e
add ebx, 2
movsxd rax, ebx
mov word [rsp + rax*2 + 0x60], r12w
movsxd rbx, ebx
lea rsi, [rsp + 0x60]
jmp 0x14009def0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x60]
mov r8d, 0xa
call fcn.1400caee4
mov rsi, rax
jmp 0x14009de49
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
cmp rbx, 0xffffffffffffffff
jne 0x14009def0
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r12w
jne 0x14009de50
jmp 0x14009def0
mov edx, ecx
test ecx, ecx
je 0x14009de82
sub edx, 1
je 0x14009de98
sub edx, 1
je 0x14009de98
cmp edx, 2
jne 0x14009df5d
mov rcx, qword [rbx]
call fcn.140065460
jmp 0x14009de96
mov rcx, qword [rbx]
mov r9d, 1
mov edx, r9d
xor r8d, r8d
call fcn.1400a23e0
mov ecx, eax
test ecx, ecx
je 0x14009df5d
mov ecx, dword [rbx + 0x10]
test ecx, ecx
je 0x14009ded1
sub ecx, 1
je 0x14009decc
sub ecx, 1
je 0x14009dec5
cmp ecx, 2
je 0x14009debb
mov rax, r12
jmp 0x14009ded9
mov rcx, qword [rbx]
call fcn.140065520
jmp 0x14009ded9
cvttsd2si rax, qword [rbx]
jmp 0x14009ded9
mov rax, qword [rbx]
jmp 0x14009ded9
mov rcx, qword [rbx]
call fcn.1400a2ef0
mov dword [rsp + 0x298], eax
mov rbx, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x298]
mov rax, qword [0x1401251d8]
mov r9, r13
mov rdx, qword [rsp + 0x2b0]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov ecx, dword [rax + 0xb0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
or ecx, 0x20006
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ecx
mov rcx, r14
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x14009e18b
cmp ebp, 7
ja case.0x14009df5b.5
lea rax, [0x140000000]
mov edx, dword [rax + rbp*4 + 0x9e1d4]
add rdx, rax
jmp rdx
lea r9, str.Number
mov r8, rbx
xor edx, edx
mov rcx, r15
call fcn.1400118a0
jmp 0x14009e1b0
mov r9d, 1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, qword [rsp + 0x2b8]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp case.0x14009df5b.0
mov r9d, 2
jmp 0x14009df7c
lea rcx, [rbx*2 + 4]
call fcn.1400c5924
mov r14, rax
test rax, rax
jne 0x14009dfd0
mov edi, recv
jmp case.0x14009df5b.0
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400d42d4
mov dword [r14 + rbx*2], r12d
test rbx, rbx
je 0x14009dff8
cmp word [r14 + rbx*2 - 2], 0xa
jne 0x14009dff8
dec rbx
mov word [r14 + rbx*2], r12w
movzx ecx, word [r14]
mov rax, r14
test cx, cx
je 0x14009e01b
cmp cx, 0xa
jne 0x14009e00e
mov word [rax], r12w
movzx ecx, word [rax + 2]
add rax, 2
test cx, cx
jne 0x14009e004
lea rax, [rbx + 2]
test rbx, rbx
jne 0x14009e027
mov rax, r12
mov rdx, qword [rsp + 0x2b8]
add eax, eax
mov rcx, qword [rsp + 0x50]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r14
mov edi, eax
call fcn.1400c5910
jmp case.0x14009df5b.0
lea rax, [rsp + 0x298]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
jmp 0x14009df8c
test bl, 1
jne case.0x14009df5b.5
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd rdi, eax
mov rcx, rdi
call fcn.1400c5924
mov rbp, rax
test rax, rax
jne 0x14009e0aa
mov edi, recv
jmp case.0x14009df5b.0
mov r11d, r12d
test ebx, ebx
jle 0x14009e11b
movsxd rbx, ebx
mov r9, r12
mov r10, r12
nop word [rax + rax]
cmp r10, rdi
jge 0x14009e11b
mov edx, r12d
mov r8d, reloc.WSOCK32.dll_recv
nop
movzx ecx, word [rsi + r9*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14009e0e3
lea eax, [rcx - 0x30]
jmp 0x14009e0fd
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x14009e0f1
lea eax, [rcx - 0x37]
jmp 0x14009e0fd
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x14009e14d
lea eax, [rcx - 0x57]
imul eax, r8d
inc r9
add edx, eax
sub r8d, 0xf
jns 0x14009e0d0
mov byte [r10 + rbp], dl
inc r11d
inc r10
cmp r9, rbx
jl 0x14009e0c0
mov rdx, qword [rsp + 0x2b8]
mov r9d, 3
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbp
mov edi, eax
call fcn.1400c5910
jmp case.0x14009df5b.0
mov rcx, rbp
call fcn.1400c5910
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1401251d8]
mov edi, 0x57
mov edx, edi
mov rcx, r15
mov dword [rax + 0x64], edi
call fcn.140011030
jmp 0x14009e1b0
mov edi, 0x57
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1401251d8]
mov dword [rax + 0x64], edi
test edi, edi
je 0x14009e1a5
mov edx, edi
mov rcx, r15
call fcn.140011030
jmp 0x14009e1b0
mov dword [r15 + 0x10], r12d
mov qword [r15], r13
mov qword [r15 + 8], r12
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret