Function at 0x140006590
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rcx
lea rdx, str.SoftwareAutodeskAutodesk_Digital_Signatures
lea rcx, [rax + 0x20]
call qword [0x14000f748]
nop
mov rdi, qword [rsp + 0xa8]
xor ebp, ebp
mov qword [rsp + 0x60], rbp
lea rax, vtable.AcRegistryWriteAccess.0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call qword [0x140011510]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
cmovne rcx, rbp
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x140006798
lea r9d, [rbp + 2]
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, qword [rbx + 0x740]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14000669f
lea rcx, [rbx + 0x700]
mov edx, eax
call qword [sym.imp.mfc100u.dll_COleDataObject::GetFileData]
mov rdx, qword [rax + 0x18]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea r9d, [rbp + 1]
xor r8d, r8d
lea rdx, str.LastCertificate
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx + 0xa98]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastAddDirectory
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11, qword [rbx + 0xa88]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastSearchFolder
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11, qword [rbx + 0xa90]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastSearchName
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, ebp
cmp byte [rbx + 0xaa8], dl
setne dl
mov dword [rsp + 0x98], edx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SubFolderSearch
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x140018a48]
test rcx, rcx
je 0x1400067aa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x140018c10]
mov rdi, rbp
cmp dword [rax - 0x10], edi
je 0x1400067e8
mov rcx, rbp
lea rsi, [0x140018c10]
mov rcx, qword [rcx + rsi + 0x10]
test rcx, rcx
je 0x1400067d3
mov rax, qword [rcx]
call qword [rax + 0x10]
inc rdi
lea rcx, [rdi + rdi*2]
shl rcx, 4
mov rax, qword [rcx + rsi]
cmp dword [rax - 0x10], 0
jne 0x1400067c3
mov rcx, rbx
call qword [sym.imp.mfc100u.dll_CMFCToolBar::m_UsageCount]
nop
lea rax, vtable.AcRegistryAccess.0
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006813
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc100u.dll_CWinApp::CWinApp]
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret