Function at 0x1400da8a7
Capabilities:
Set registry value

Disassembly:
jmp 0x14011ff80
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2c48
call fcn.1400db464
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x986
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c68]
mov rax, qword [0x140329a40]
xor rax, rbp
mov qword [rbp + 0x2c00], rax
lea rcx, [0x1403510a0]
call fcn.1400e103a
xor eax, eax
mov word [rbp + 0x2044], ax
mov dword [rbp + 0x2064], 0
mov dword [rbp + 0x2084], 0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400da07d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14012001c
mov eax, dword [rbp + 4]
jmp 0x1401207b6
lea rdx, [rbp + 0x2044]
lea rcx, [rbp + 0x30]
call fcn.1400db3ba
test eax, eax
jne 0x14012009a
lea rcx, [0x14032eeec]
call fcn.1400e1aa8
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x140327098]
add ecx, 0xc
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ac8]
call fcn.1400dca17
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str._Ts_Type_not_supported_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
mov edx, 0x20f
mov rcx, qword [rbp + 0x2c30]
call fcn.1400dce63
jmp 0x1401207b6
mov rcx, qword [rbp + 0x2c30]
call fcn.1400deef7
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400da07d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1401200c7
mov eax, dword [rbp + 4]
jmp 0x1401207b6
movzx eax, word [rbp + 0x2044]
mov dword [rbp + 0x2be4], eax
cmp dword [rbp + 0x2be4], 8
je 0x14012010c
cmp dword [rbp + 0x2be4], 0x11
je 0x14012054c
cmp dword [rbp + 0x2be4], 0x13
je 0x1401203f2
cmp dword [rbp + 0x2be4], 0x4008
je 0x1401201bf
jmp 0x140120773
mov r9d, 1
lea r8, [rbp + 0x30]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400de362
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x140120149
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x140120157
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14032eeec]
call fcn.1400e1aa8
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x140327098]
add ecx, 0x19
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2af8]
call fcn.1400dca17
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
jmp 0x140120773
cmp qword [rbp + 0x2c40], 0
jne 0x1401201d9
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x1401201e7
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14032eeec]
call fcn.1400e1aa8
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x140327098]
add ecx, 0x1e
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b28]
call fcn.1400dca17
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, str.Setting_Value__Ts_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
lea rcx, [rbp + 0x30]
call fcn.1400da762
add rax, 2
mov dword [rbp + 0x20a4], eax
lea rcx, [rbp + 0x20d0]
call fcn.1400e0c84
nop
movsxd rax, dword [rbp + 0x20a4]
mov rdx, rax
lea rcx, [rbp + 0x20d0]
call fcn.1400dc16b
nop
jmp 0x140120283
lea rcx, [rbp + 0x20d0]
call fcn.1400da08c
test rax, rax
je 0x1401203d7
lea rcx, [rbp + 0x20d0]
call fcn.1400da08c
mov qword [rbp + 0x21f8], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x2218], rax
mov dword [rbp + 0x20a4], 0
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
test eax, eax
je 0x140120383
mov rcx, qword [rbp + 0x2218]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2238], rax
mov rax, qword [rbp + 0x2218]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x140120338
mov rax, qword [rbp + 0x2238]
movzx eax, word [rax]
cmp eax, 0x30
jne 0x140120338
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rcx, qword [rbp + 0x2238]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp + 0x2218], rax
jmp 0x140120370
mov rax, qword [rbp + 0x21f8]
mov rcx, qword [rbp + 0x2218]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
mov rax, qword [rbp + 0x2218]
add rax, 2
mov qword [rbp + 0x2218], rax
mov eax, dword [rbp + 0x20a4]
inc eax
mov dword [rbp + 0x20a4], eax
jmp 0x1401202c0
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
mov rax, qword [rbp + 0x21f8]
add rax, 2
mov qword [rbp + 0x21f8], rax
xor eax, eax
mov rcx, qword [rbp + 0x21f8]
mov word [rcx], ax
lea rcx, [rbp + 0x20d0]
call fcn.1400da08c
mov r8, rax
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400dac94
mov dword [rbp + 0x2064], eax
jmp 0x1401203e1
mov dword [rbp + 0x2064], 0xe
lea rcx, [rbp + 0x20d0]
call fcn.1400dcc88
jmp 0x140120773
mov dword [rbp + 0x2274], 0
call fcn.1400dff32
mov dword [rbp + 0x2294], eax
mov qword [rbp + 0x22b8], 0
mov qword [rbp + 0x22d8], 0
lea rcx, [rbp + 0x22f8]
call fcn.1400df89d
nop
mov edx, 0x400
lea rcx, [rbp + 0x30]
call fcn.1400dfd9d
mov qword [rbp + 0x2318], rax
lea r9, [rbp + 0x2254]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2318]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140120481
mov eax, dword [rbp + 4]
mov dword [rbp + 0x2b54], eax
lea rcx, [rbp + 0x22f8]
call fcn.1400df163
mov eax, dword [rbp + 0x2b54]
jmp 0x1401207b6
mov r8d, dword [rbp + 0x2254]
mov rdx, qword [rbp + 0x2c40]
mov rcx, qword [rbp + 0x2c38]
call fcn.1400dbf7c
mov dword [rbp + 0x2064], eax
cmp qword [rbp + 0x2c40], 0
jne 0x1401204bb
lea rax, str.default
mov qword [rbp + 0x2be8], rax
jmp 0x1401204c9
mov rax, qword [rbp + 0x2c40]
mov qword [rbp + 0x2be8], rax
lea rcx, [0x14032eeec]
call fcn.1400e1aa8
mov dword [rbp + 0x2bf0], eax
mov ecx, dword [0x140327098]
add ecx, 0x5e
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2b78]
call fcn.1400dca17
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x2254]
mov dword [rsp + 0x20], ecx
lea r9, str.Setting_Value__d_at__Ts_n
mov r8d, 2
mov ecx, dword [rbp + 0x2bf0]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
nop
lea rcx, [rbp + 0x22f8]
call fcn.1400df163
jmp 0x140120773
lea rcx, [rbp + 0x30]
call fcn.1400da762
mov dword [rbp + 0x2334], eax
mov eax, dword [rbp + 0x2334]
and eax, 1
test eax, eax
je 0x1401205bd
lea rcx, [0x14032eeec]
call fcn.1400e1aa8
mov dword [rbp + 0x2be4], eax
mov ecx, dword [0x140327098]
add ecx, 0x66
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_statreg.h
lea rcx, [rbp + 0x2ba8]
call fcn.1400dca17
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov ecx, dword [rbp + 0x2be4]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
mov eax, 0x80004005
jmp 0x1401207b6
mov eax, dword [rbp + 0x2334]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x2354], eax
lea rcx, [rbp + 0x2380]
call fcn.1400dcc5b
nop
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x2380]
call fcn.1400dd985
nop
jmp 0x1401205f4
lea rcx, [rbp + 0x2380]
call fcn.1400dbdd8
test rax, rax
jne 0x140120626
mov dword [rbp + 0x2bd4], 0x80004005
lea rcx, [rbp + 0x2380]
call fcn.1400de70e
mov eax, dword [rbp + 0x2bd4]
jmp 0x1401207b6
movsxd rax, dword [rbp + 0x2354]
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.1400dbdd8
mov rcx, qword [rbp + 0x2be8]
mov r8, rcx
xor edx, edx
mov rcx, rax
call fcn.1400df370
mov dword [rbp + 0x24a4], 0
jmp 0x14012066e
mov eax, dword [rbp + 0x24a4]
inc eax
mov dword [rbp + 0x24a4], eax
mov eax, dword [rbp + 0x2334]
cmp dword [rbp + 0x24a4], eax
jge 0x140120704
mov eax, dword [rbp + 0x24a4]
cdq
sub eax, edx
sar eax, 1
cdqe
mov qword [rbp + 0x2be8], rax
lea rcx, [rbp + 0x2380]
call fcn.1400dbdd8
mov rcx, qword [rbp + 0x2be8]
add rax, rcx
mov qword [rbp + 0x2bf0], rax
mov eax, dword [rbp + 0x24a4]
and eax, 1
mov ecx, 1
sub ecx, eax
mov eax, ecx
shl eax, 2
mov dword [rbp + 0x2bf8], eax
movsxd rcx, dword [rbp + 0x24a4]
movzx ecx, word [rbp + rcx*2 + 0x30]
call fcn.1400dcfa3
movzx eax, al
mov ecx, dword [rbp + 0x2bf8]
shl eax, cl
mov rcx, qword [rbp + 0x2bf0]
movzx ecx, byte [rcx]
or ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x2bf0]
mov byte [rcx], al
jmp 0x140120660
lea rcx, [rbp + 0x2380]
call fcn.1400dbdd8
mov qword [rbp + 0x2be8], rax
mov rcx, qword [rbp + 0x2c38]
call fcn.1400e07d9
mov ecx, dword [rbp + 0x2354]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x2be8]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x2c40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x2064], eax
lea rcx, [rbp + 0x2380]
call fcn.1400de70e
jmp 0x140120773
cmp dword [rbp + 0x2064], 0
je 0x140120793
mov dword [rbp + 0x2084], 0x204
mov ecx, dword [rbp + 0x2064]
call fcn.1400e0a31
jmp 0x1401207b6
mov rdx, qword [rbp + 0x2c48]
mov rcx, qword [rbp + 0x2c30]
call fcn.1400da07d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1401207b4
mov eax, dword [rbp + 4]
jmp 0x1401207b6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400dfc67
mov rax, rdi
mov rcx, qword [rbp + 0x2c00]
xor rcx, rbp
call fcn.1400dd6a1
lea rsp, [rbp + 0x2c18]
pop rdi
pop rbp
ret