Function at 0x14003ad20
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1f90
call sub.ntdll.dll___chkstk
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1fd0], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x1f80], rax
mov r14, r8
mov rsi, rdx
mov r15, rcx
lea rcx, [rsp + 0x1020]
call fcn.140024aa0
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rax, fcn.140001470
mov qword [rsp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rdx, [rsi + 0x404]
lea rcx, [rsp + 0x30]
call fcn.140028290
test al, al
jne 0x14003adce
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140028730
test al, al
jne 0x14003ae20
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmovne rcx, rdi
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmovne rcx, rdi
mov qword [rsp + 0x38], rcx
mov word [rsp + 0x1300], di
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
lea rcx, [rsp + 0x1302]
call sub.ntdll.dll_memset
xor edx, edx
mov r8d, 0x480
lea rcx, [rsp + 0x1700]
call sub.ntdll.dll_memset
mov dword [rsp + Ordinal_4723], edi
xor edx, edx
mov r8d, 0x8c
lea rcx, [rsp + 0x1274]
call sub.ntdll.dll_memset
lea rax, [rsi + 4]
mov qword [rsp + 0x48], rax
mov r9, rax
lea r8, [0x1403b5c74]
mov edx, 0x400
lea rcx, [rsp + 0x1300]
call fcn.140013b00
lea r9, [rsi + reloc.MFC80U.DLL_Ordinal_2692]
lea r8, [0x1403b5c74]
mov edx, 0x400
lea rcx, [rsp + 0x1780]
call fcn.140013b00
lea r9, [rsi + 0xa04]
lea r8, [0x1403b5c74]
mov edx, 0x80
lea rcx, [rsp + 0x1700]
call fcn.140013b00
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0x1300]
mov r8d, Ordinal_2179
call sub.ntdll.dll_memcpy
lea r8, [rsp + 0x1270]
lea rdx, [rsp + 0x160]
mov rcx, r15
call fcn.14003cb70
test al, al
jne 0x14003af49
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
lea rax, [0x1403b7b58]
mov qword [rsp + 0x50], rax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsi + 0x604]
repne scasw ax, word [rdi]
not rcx
lea r13, [rcx - 1]
lea ebp, [rcx + rcx + 0x8c]
mov ebx, ebp
mov ecx, ebp
call qword [sym.imp.MSVCR80.dll_malloc]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14003afb1
nop
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_malloc]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14003af90
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.ntdll.dll_memset
mov dword [rsp + 0x60], ebp
lea rdx, [r13 + r13 + 2]
lea rcx, [rdi + 0x8c]
lea r9, [rsi + 0x604]
lea r8, [0x1403b5c74]
call fcn.140013b00
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x1270]
mov r8d, 0x90
call sub.ntdll.dll_memcpy
lea rcx, [rsp + 0x160]
mov rdx, rsi
mov r8d, 0xe84
call sub.ntdll.dll_memcpy
mov r9, rdi
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x160]
mov rcx, r15
call fcn.14003c530
test al, al
jne 0x14003b064
test rdi, rdi
je 0x14003b040
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
mov rsi, qword [rsp + 0x48]
mov rdx, rsi
lea rcx, [rsp + 0xff0]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Objects_
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov rdx, r14
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.Elements11000001
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rbx, [rsp + 0xff8]
cmp qword [rsp + 0x1010], 8
cmovae rbx, qword [rsp + 0xff8]
xor r12d, r12d
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4136], r12
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b100
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003b164
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4144], 0xffffffff80000002
mov rdx, rbx
lea rcx, [rsp + 0x1240]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rcx, [rsp + 0x1020]
call fcn.140027ed0
mov byte [rsp + Ordinal_4669], al
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b197
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b173
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003b25b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x1238], r12b
je 0x14003b1ff
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b1ff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b228
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b237
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
cmp byte [rsp + 0x1238], r12b
je 0x14003b28c
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b28c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b2b4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, rsi
lea rcx, [rsp + 0xff0]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Objects_
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov rdx, r14
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.Elements21000001
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rbx, [rsp + 0xff8]
cmp qword [rsp + 0x1010], 8
cmovae rbx, qword [rsp + 0xff8]
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4136], r12
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b348
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003b3ac
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4144], 0xffffffff80000002
mov rdx, rbx
lea rcx, [rsp + 0x1240]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rcx, [rsp + 0x1020]
call fcn.140027ed0
mov byte [rsp + Ordinal_4669], al
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b3df
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b3bb
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003b4a3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x1238], r12b
je 0x14003b447
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b447
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b470
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b47f
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
cmp byte [rsp + 0x1238], r12b
je 0x14003b4d4
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b4d4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b4fc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, rsi
lea rcx, [rsp + 0xff0]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Objects_
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov rdx, r14
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.Elements12000002
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov word [rsp + 0x1b80], r12w
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
lea rcx, [rsp + 0x1b82]
call sub.ntdll.dll_memset
mov r11d, dword [rsp + 0x70]
test r11d, r11d
je 0x14003b5c4
cmp r11d, 1
je 0x14003b5a9
test rdi, rdi
je 0x14003b585
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
lea r8, str.Windows_system32winload.efi
mov edx, 0x400
lea rcx, [rsp + 0x1b80]
call fcn.140013b00
jmp 0x14003b5dd
lea r8, str.Windows_system32winload.exe
mov edx, 0x400
lea rcx, [rsp + 0x1b80]
call fcn.140013b00
lea rbx, [rsp + 0xff8]
cmp qword [rsp + 0x1010], 8
cmovae rbx, qword [rsp + 0xff8]
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4136], r12
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b625
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003b689
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_4144], 0xffffffff80000002
mov rdx, rbx
lea rcx, [rsp + 0x1240]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
lea rcx, [rsp + 0x1020]
call fcn.140027ed0
mov byte [rsp + Ordinal_4669], al
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_4136]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003b6bc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b698
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
mov dword [rsp + 0x28], 0x400
lea rax, [rsp + 0x1b80]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003b78c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x1238], r12b
je 0x14003b730
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b730
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b759
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b768
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14003b814
cmp byte [rsp + 0x1238], r12b
je 0x14003b7bd
lea r8, [rsp + 0x1038]
mov edx, 4
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x14003b7bd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_4136]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14003b7e6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test rdi, rdi
je 0x14003b7f5
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
lea rcx, [rsp + 0xff0]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1240]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x1f80]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x1fd0]
add rsp, 0x1f90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret