Function at 0x1000ec76c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r12
push r13
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
lea rbp, [0x100153eb8]
lea r15, [0x10001dc18]
mov rcx, qword [0x100153eb8]
cmp rcx, rbp
je 0x1000ec7e0
test byte [rcx + 0x1c], 1
je 0x1000ec7e0
cmp byte [rcx + 0x19], 5
jb 0x1000ec7e0
mov edx, 0x62
mov qword [rax - 0x50], r9
mov qword [rax - 0x58], r8
mov r9, rbx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100057fe8
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.100035db8
nop
lea rcx, [rsp + 0x30]
call fcn.1000699ec
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.1000edb20
mov edi, eax
mov bl, 4
mov r10, qword [0x100153eb8]
cmp r10, rbp
je 0x1000ec854
test byte [r10 + 0x1c], 2
je 0x1000ec854
cmp byte [r10 + 0x19], bl
jb 0x1000ec854
mov edx, 0x63
mov r9d, eax
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036510
mov r10, qword [0x100153eb8]
test edi, edi
jne 0x1000ec9f5
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1000e5910
mov ebp, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000ec8ba
test byte [rcx + 0x1c], 2
je 0x1000ec8ba
cmp byte [rcx + 0x19], bl
jb 0x1000ec8ba
lea edx, [rdi + 0x64]
mov r9d, ebp
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rbx, qword [rsp + 0x38]
test ebp, ebp
jne 0x1000ec8e8
mov rax, rbx
mov r8, rsi
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000ec8e0
add rax, 2
test edx, edx
jne 0x1000ec8cc
test ecx, ecx
je 0x1000ec9b8
xor eax, eax
test rsi, rsi
setne al
test eax, eax
jne 0x1000ec8ff
mov ecx, 0x80004005
call fcn.100036284
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000ec961
test byte [rcx + 0x1c], 2
je 0x1000ec961
cmp byte [rcx + 0x19], 4
jb 0x1000ec961
mov edx, 0x65
mov r9d, edi
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036510
test ebp, ebp
jne 0x1000ec9c1
mov rax, qword [r13]
mov edx, 0x3ec
mov rcx, r13
call qword [rax + 0x48]
mov ecx, eax
xor r9d, r9d
mov r8, r12
mov rdx, qword [rsp + 0x30]
call fcn.1000f1054
mov rcx, qword [0x100153eb8]
lea rbp, [0x100153eb8]
cmp rcx, rbp
je 0x1000ec9c8
test byte [rcx + 0x1c], 2
je 0x1000ec9c8
cmp byte [rcx + 0x19], 4
jb 0x1000ec9c8
mov edx, 0x66
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034784
jmp 0x1000ec9c8
lea rbp, [0x100153eb8]
jmp 0x1000ec9c8
lea rbp, [0x100153eb8]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ec9ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r10, qword [0x100153eb8]
jmp 0x1000eca29
mov r10, qword [0x100153eb8]
jmp 0x1000eca29
cmp edi, 2
jne 0x1000eca29
mov edi, 0x490
cmp r10, rbp
je 0x1000eca5f
test byte [r10 + 0x1c], 2
je 0x1000eca29
cmp byte [r10 + 0x19], bl
jb 0x1000eca29
mov edx, 0x67
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100034784
mov r10, qword [0x100153eb8]
cmp r10, rbp
je 0x1000eca5f
test byte [r10 + 0x1c], 1
je 0x1000eca5f
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000eca5f
mov edx, 0x68
mov r9d, edi
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036510
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000eca80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000eca90
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret