Function at 0x1400a7980
Capabilities:
Set registry value

Disassembly:
mov eax, dword [rcx + 8]
test eax, eax
jne 0x1400a79b4
mov eax, dword [rsp + 0x28]
test r9, r9
je 0x1400a7998
test eax, eax
jne 0x1400a79c0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rcx]
jmp qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x80], rbx
mov rax, qword [0x1403ceac0]
xor rax, rbp
mov qword [rbp + 0x20], rax
mov r15, r9
mov r12, rdx
mov r13, rcx
xor edi, edi
mov r14d, edi
mov dword [rbp], edi
test r9, r9
jne 0x1400a7a17
mov esi, 0x57
mov eax, esi
jmp 0x1400a7a57
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400a7a4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a7a52
mov r14d, eax
mov dword [rbp], eax
mov eax, edi
mov esi, 0x57
test eax, eax
jne 0x1400a7bf6
mov qword [rbp + 8], rdi
mov eax, r14d
lea rcx, [rax + 0x10]
mov rdx, rdi
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x1400a7ae3
cmp rdx, 0x400
ja 0x1400a7abf
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400a7a95
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140297960
sub rsp, rax
lea rbx, [rsp + 0x40]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x1400a7ae6
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
jmp 0x1400a7ae6
mov rcx, rdx
call fcn.1402c79a8
mov rbx, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x1400a7ae6
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x1400a7ae6
mov rbx, rdi
mov qword [rbp + 8], rbx
jmp 0x1400a7b0d
test rbx, rbx
jne 0x1400a7b1a
lea eax, [rbx + 0xe]
jmp 0x1400a7bf6
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.1402b60e0
test r15, r15
je 0x1400a7bbf
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400a7b65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400a7bbf
cmp r14d, eax
jge 0x1400a7b74
mov r14d, eax
mov esi, 0xea
jmp 0x1400a7bbf
movsxd r8, r14d
xor edx, edx
mov rcx, rbx
call fcn.1402b60e0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x1400a7bbd
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400a7bbf
mov esi, edi
test esi, esi
jne 0x1400a7be3
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x1400a7bf4
call fcn.1402ba464
mov eax, esi
mov rcx, qword [rbp + 0x20]
xor rcx, rbp
call fcn.140296f70
mov rbx, qword [rbp + 0x80]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret