Function at 0x14005c0c1
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
push r14
mov rax, 0x4a
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14005c0e0
sub rsp, 0x28
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov rdx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov rdx, qword [rsp + 0x2b8]
lea rcx, [rsp + 0x40]
sub rsp, 0x10
call fcn.14000b570
add rsp, 0x10
mov dword [0x14004d924], 0
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140009bd0
add rsp, 0x28
add qword [0x14004ea60], 2
movabs rcx, 0x14004a2f8
pop rdx
mov qword [0x14004ea60], rdx
add rdx, qword [0x14004ea58]
call fcn.14000b6b0
or rax, rax
je 0x14005c20c
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140009c70
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000a080
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14000b410
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000a080
add rsp, 0x28
add qword [0x14004ea60], 2
movabs rcx, 0x14004a2f8
pop rdx
mov qword [0x14004ea60], rdx
add rdx, qword [0x14004ea58]
call fcn.14000b6b0
or rax, rax
je 0x14005c2b1
push qword [0x14004ea60]
sub rsp, 8
push qword [0x14004ea60]
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140009c70
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140009bd0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14000b410
push qword [rsp + 0x40]
movabs rcx, 0x14004a028
pop rdx
call fcn.14000b6b0
or rax, rax
je 0x14005c30d
sub rsp, 8
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push 0xf003f
push 0
push qword [rsp + 0x48]
push qword [rsp + 0x2b8]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x58], eax
jmp 0x14005c3c4
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push qword [rsp + 0x298]
push qword [rsp + 0x50]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x58], eax
movsxd r15, dword [rsp + 0x58]
and r15, r15
je 0x14005c384
movsxd rax, dword [rsp + 0x58]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
xor rax, rax
jmp 0x14005c5a1
sub rsp, 8
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push 0xf003f
push 0
push qword [rsp + 0x48]
movsxd rax, dword [rsp + 0x78]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x58], eax
movsxd r15, dword [rsp + 0x58]
and r15, r15
jne 0x14005c52e
mov dword [rsp + 0x268], 0xff
push qword [rsp + 0x2b0]
mov r15, 1
cmp r15, qword [rsp]
jne 0x14005c456
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140009c70
add rsp, 0x20
mov r15, rax
shl r15, 1
add r15, 2
mov rax, r15
push rax
mov rax, qword [rsp + 0x50]
mov rax, rax
push rax
push 1
push 0
push qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x80]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x60], eax
jmp 0x14005c4d0
mov r15, 4
cmp r15, qword [rsp]
jne 0x14005c4d0
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14000a300
add rsp, 0x28
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x278], eax
sub rsp, 8
push 4
lea rax, [rsp + 0x288]
mov rax, rax
push rax
push 4
push 0
push qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x80]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x60], eax
add rsp, 8
movsxd r15, dword [rsp + 0x58]
and r15, r15
jne 0x14005c4e8
mov dword [rsp + 0x60], 1
jmp 0x14005c52c
movsxd rax, dword [rsp + 0x58]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
mov dword [rsp + 0x60], 0
jmp 0x14005c572
movsxd rax, dword [rsp + 0x58]
push rax
pop rax
mov dword [0x14004d924], eax
push qword [0x14004ea60]
push qword [0x14004ea60]
movsxd rax, dword [0x14004d924]
push rax
pop rcx
sub rsp, 0x20
call fcn.140055bb8
add rsp, 0x28
lea rcx, [0x14004d750]
pop rdx
call fcn.14000b410
mov dword [rsp + 0x60], 0
movsxd rax, dword [rsp + 0x48]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [rsp + 0x50], 0
je 0x14005c597
movsxd rax, dword [rsp + 0x50]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.dll_RegCloseKey
movsxd rax, dword [rsp + 0x60]
jmp 0x14005c5a1
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.14000b690
add rsp, 0x28
pop rax
add rsp, 0x278
pop r14
pop r15
ret