Function at 0x140082f30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov qword [rbp - 0x50], rcx
xor esi, esi
mov dword [rsp + 0x50], esi
lea rdx, str.InstallTypeProfile::RegistTypeSelection
lea rcx, [rbp - 0x40]
call fcn.14001abe0
nop
lea rax, [0x1402a8360]
lea rdi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rax
je 0x140082fc9
test byte [rcx + 0x1c], 1
je 0x140082fc9
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rsi + 0xe]
lea r8, [0x140258560]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov ebx, esi
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0x10]
call fcn.1401e7e40
mov qword [rbp - 0x68], rsi
mov dword [rbp - 0x80], esi
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
call qword [case.0x1400136d6.0]
mov dword [rbp - 0x7c], eax
mov r12d, esi
mov dword [rsp + 0x60], esi
test eax, eax
jle 0x14008372f
lea rdi, str.SOFTWARECANON_
mov r13, 0xffffffffffffffff
nop word [rax + rax]
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0x10]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov edx, r12d
mov rax, qword [rax + 0x88]
call qword [case.0x1400136d6.0]
mov r12, rax
mov qword [rbp - 0x58], rax
cmp dword [rax + 4], 1
jne 0x140083711
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140083867
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
cmp rdi, 0x10000
jae 0x1400830bb
movzx edx, di
call fcn.1400041d0
jmp 0x1400830ca
mov r8d, send
mov rdx, rdi
call fcn.140004e60
nop
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0xa68]
cmp qword [rbx + 0x18], 8
jb 0x1400830ef
mov rbx, qword [rbx]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14008385c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rbp - 0x78], rax
test rbx, rbx
je 0x140083140
cmp rbx, 0x10000
jae 0x140083131
movzx edx, bx
lea rcx, [rbp - 0x78]
call fcn.1400041d0
jmp 0x140083152
mov rax, r13
inc rax
cmp word [rbx + rax*2], 0
jne 0x140083134
jmp 0x140083142
mov eax, esi
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140004e60
nop
mov rbx, qword [rbp - 0x78]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140007390
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008318d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x1400831b0
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x1400831d1
call fcn.1401bb0c4
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1400838a9
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
or dword [rsp + 0x50], 1
movsxd r15, dword [rdi - 0x10]
lea r14d, [r15 + 1]
test r14d, r14d
js 0x14008389e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140083226
lfence
mov edx, r14d
lea rcx, [rbp - 0x70]
call fcn.140004e00
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rbp - 0x70]
lea rsi, [r15 + r15]
test rsi, rsi
je 0x140083254
test rbx, rbx
jne 0x140083246
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140083254
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.1401e7770
lea rax, [rsi + rbx]
test rax, rax
jne 0x14008326f
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140083277
mov ecx, 0x5c
mov word [rax], cx
cmp r14d, dword [rbx - 0xc]
jg 0x14008389e
mov dword [rbx - 0x10], r14d
xor esi, esi
mov word [rbx + r15*2 + 2], si
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400832f2
cmp dword [rdi + 0x10], esi
jl 0x1400832e1
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400832e1
call fcn.140004d00
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400832d2
lfence
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp - 0x70]
jmp 0x1400832f2
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140004e60
and dword [rsp + 0x50], 0xfffffffe
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008331b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea r15, [r12 + 0x418]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140083346
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x140083367
call fcn.1401bb0c4
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x140083893
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
or dword [rsp + 0x50], 2
test r15, r15
je 0x14008339b
mov rsi, r13
nop word [rax + rax]
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140083390
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x140083888
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400833d8
lfence
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140004e00
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x70]
add r12, r12
je 0x140083402
test rbx, rbx
jne 0x1400833f4
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140083402
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1401e7770
movsxd r8, esi
add r8, r8
lea rcx, [r12 + rbx]
je 0x140083446
test rcx, rcx
je 0x140083436
test r15, r15
je 0x14008342f
lfence
mov rdx, r15
call fcn.1401e7770
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x70]
jmp 0x140083446
xor edx, edx
call fcn.1401e7e40
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
cmp r14d, dword [rbx - 0xc]
jg 0x140083888
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor esi, esi
mov word [rbx + rax*2], si
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400834c3
cmp dword [rdi + 0x10], esi
jl 0x1400834b2
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400834b2
call fcn.140004d00
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400834a2
lfence
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x70]
jmp 0x1400834c3
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140004e60
and dword [rsp + 0x50], 0xfffffffd
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400834ec
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14008381c
mov rbx, qword [rbp - 0x58]
mov eax, dword [rbx + 0x3ce4]
mov dword [rbp + 0x10], eax
cmp eax, 0x63
jne 0x14008369d
add rbx, 0x3ce8
je 0x14008369d
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14008387d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp rbx, 0x10000
jae 0x140083591
movzx edx, bx
lea rcx, [rsp + 0x78]
call fcn.1400041d0
jmp 0x1400835af
mov rax, r13
inc rax
cmp word [rbx + rax*2], 0
jne 0x140083594
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140004e60
nop
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140083872
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdi, [0x140251dfc]
lea rcx, [rsp + 0x68]
cmp rdi, 0x10000
jae 0x1400835f5
movzx edx, di
call fcn.1400041d0
jmp 0x140083601
xor r8d, r8d
mov rdx, rdi
call fcn.140004e60
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
call fcn.140004d00
add rax, 0x18
mov qword [rbp - 0x60], rax
mov rsi, qword [rbp - 0x50]
mov rax, qword [rsi]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x60]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400136d6.0]
mov r8, qword [rsp + 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x14]
call fcn.1401ebfa8
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083672
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008369b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
xor esi, esi
mov dword [rsp + 0x28], 0x20c
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.TypeSelection
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400836d9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14008381c
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008370a
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rdi, str.SOFTWARECANON_
mov r12d, dword [rsp + 0x60]
inc r12d
mov dword [rsp + 0x60], r12d
cmp r12d, dword [rbp - 0x7c]
jl 0x140083030
lea rdi, [0x1402bbdb0]
mov al, 1
mov byte [rbp - 0x38], al
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
cmp rcx, rsi
je 0x140083783
test byte [rcx + 0x1c], al
je 0x140083783
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, send
mov dword [rsp + 0x20], ebx
lea r8, [0x140258560]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
movzx eax, byte [rbp - 0x38]
mov rcx, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rbp - 0x40], rdx
test al, al
jne 0x1400837d8
cmp rcx, rsi
je 0x1400837d8
test byte [rcx + 0x1c], 1
je 0x1400837d8
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rax, qword [rbp - 0x30]
cmp qword [0x1402bbdc8], 8
cmovae rdi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x10]
call fcn.1400048a0
lea rcx, [rbp - 0x30]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ebx, 0x80010024
mov dword [0x1402bbd98], 0x24
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140083728
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
jmp 0x140083728
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
int3