Function at 0x1400d7360
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r10, r9
mov rdi, r8
mov ebx, edx
mov r14, rcx
test r8, r8
je 0x1400d763f
test edx, edx
je 0x1400d763f
cmp edx, 0xfffffffe
je 0x1400d763f
mov rax, qword [0x14013b0f8]
lea rcx, [r11 - 0x38]
xor ebp, ebp
mov eax, dword [rax + 0x110]
mov qword [r11 - 0x48], rcx
lea rcx, [r11 - 0x30]
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x58], rbp
or eax, 0x20006
mov dword [rsp + 0x28], eax
lea r9, [0x1401035ac]
xor r8d, r8d
mov rdx, r10
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400d76cc
dec ebx
je 0x1400d7680
dec ebx
je 0x1400d7678
dec ebx
je 0x1400d7516
dec ebx
je 0x1400d74d4
cmp ebx, 3
je 0x1400d7419
lea edi, [rbp + 0x57]
jmp 0x1400d76c1
mov rsi, qword [rsp + 0xb8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
lea rcx, [rcx + rcx + 2]
call qword [sym.imp.MSVCR100.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400d744f
lea edi, [rax + 0xe]
jmp 0x1400d76c1
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_wcsncpy]
mov dword [rbx + rdi*2], ebp
test rdi, rdi
je 0x1400d7475
cmp word [rbx + rdi*2 - 2], 0xa
jne 0x1400d7475
dec rdi
mov word [rbx + rdi*2], bp
mov rax, rbx
cmp word [rbx], bp
je 0x1400d7492
nop dword [rax]
cmp word [rax], 0xa
jne 0x1400d7489
mov word [rax], bp
add rax, 2
cmp word [rax], bp
jne 0x1400d7480
test rdi, rdi
je 0x1400d749b
lea rbp, [rdi + 2]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
lea eax, [rbp + rbp]
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x1400d76c1
mov rcx, qword [rsp + 0xb8]
cmp word [rcx], bp
je 0x1400d74ef
call fcn.1400050b0
mov dword [rsp + 0xa0], eax
jmp 0x1400d74f6
mov dword [rsp + 0xa0], ebp
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
jmp 0x1400d76a9
mov rbx, qword [rsp + 0xb8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
mov rdi, rcx
and eax, 0x80000001
jge 0x1400d7543
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1400d7551
mov edi, 0x57
jmp 0x1400d76c1
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
mov rcx, r12
call qword [sym.imp.MSVCR100.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x1400d7574
lea edi, [rax + 0xe]
jmp 0x1400d76c1
mov r11d, ebp
mov r9d, ebp
mov r8, rbp
mov r10, rbp
movsxd r13, edi
test edi, edi
jle 0x1400d75f5
cmp r10, r12
jge 0x1400d75f5
mov edi, ebp
mov edx, reloc.WSOCK32.dll_recv
nop word [rax + rax]
movzx ecx, word [rbx + r8*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1400d75b6
movzx eax, cx
sub eax, 0x30
jmp 0x1400d75d6
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x1400d75c7
movzx eax, cx
sub eax, 0x37
jmp 0x1400d75d6
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x1400d762b
movzx eax, cx
sub eax, 0x57
imul eax, edx
inc r9d
inc r8
add edi, eax
sub edx, 0xf
jns 0x1400d75a0
mov byte [r10 + rsi], dil
inc r10
inc r11d
cmp r8, r13
jl 0x1400d7587
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], r11d
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x1400d76c1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x57
mov r11d, edi
mov rax, qword [0x14013b0f8]
test edi, edi
mov rcx, r14
setne dl
mov dword [rax + 0x40], r11d
call fcn.14005e3f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov r9d, 2
jmp 0x1400d7686
mov r9d, 1
mov rdx, qword [rsp + 0xb8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0xffffffff
jne 0x1400d7644
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
jmp 0x1400d7647