Function at 0x14000ca60
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rcx
mov r12b, 1
mov qword [rbp - 9], 7
xor r14d, r14d
mov qword [rbp - 0x11], r14
mov word [rbp - 0x21], r14w
lea r8d, [r14 + 0x2a]
lea rdx, [0x1400360f0]
lea rcx, [rbp - 0x21]
call fcn.14000b2e0
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], 2
mov byte [rbp - 0x39], r14b
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp - 0x3d], eax
test eax, eax
jne 0x14000cb2e
cmp dword [rbp - 0x31], 1
jne 0x14000cb32
mov byte [rbp - 0x39], r12b
jmp 0x14000cb32
mov qword [rbp - 0x49], r14
cmp qword [rbp - 9], 8
jb 0x14000cb6d
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x14000cb6d
cmp qword [0x140044d10], 0
jne 0x14000cb61
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000cb6d
xor edx, edx
lea rcx, [rbp - 0x59]
call qword [0x140044d10]
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r14
mov word [rbp - 0x21], r14w
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r14
mov word [rbp + 7], r14w
lea rbx, [0x140043020]
mov rdx, rbx
lea rcx, [r13 + 0x28]
call fcn.14000fc30
mov qword [rbp - 0x59], rax
mov rcx, qword [r13 + 0x30]
mov esi, 1
or r15, 0xffffffffffffffff
cmp rax, rcx
je 0x14000cc44
lea rdx, [rax + 0x18]
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000cbce
mov rdx, qword [rdx]
cmp qword [0x140043038], 8
cmovae rbx, qword [0x140043020]
mov r8, r9
mov r10, qword [0x140043030]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x14000cc17
movzx eax, word [rdx]
cmp word [rbx], ax
jne 0x14000cc0b
add rbx, 2
add rdx, 2
dec r8
jne 0x14000cbf4
jmp 0x14000cc17
mov r8d, esi
cmp word [rbx], ax
cmovb r8d, r15d
jmp 0x14000cc1a
mov r8d, r14d
movsxd rax, r8d
test r8d, r8d
jne 0x14000cc35
cmp r10, r9
jae 0x14000cc2c
mov eax, r15d
jmp 0x14000cc35
mov eax, r14d
cmp r10, r9
setne al
test eax, eax
sets al
test al, al
jne 0x14000cc44
lea rax, [rbp - 0x59]
jmp 0x14000cc4c
mov qword [rbp - 0x51], rcx
lea rax, [rbp - 0x51]
mov rax, qword [rax]
cmp rax, qword [r13 + 0x30]
je 0x14000ccb5
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.14000ab50
lea rcx, str.19728374
call fcn.14001aa04
mov dword [rbp - 0x59], eax
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14000ccb2
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.UPDADS
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x3d], eax
test eax, eax
sete r12b
jmp 0x14000ccb5
xor r12b, r12b
lea rbx, [0x140043048]
mov rdx, rbx
lea rcx, [r13 + 0x28]
call fcn.14000fc30
mov qword [rbp - 0x51], rax
mov rcx, qword [r13 + 0x30]
cmp rax, rcx
je 0x14000cd5a
lea rdx, [rax + 0x18]
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000cceb
mov rdx, qword [rdx]
cmp qword [0x140043060], 8
cmovae rbx, qword [0x140043048]
mov r8, r9
mov r10, qword [0x140043058]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x14000cd2e
movzx eax, word [rdx]
cmp word [rbx], ax
jne 0x14000cd28
add rbx, 2
add rdx, 2
dec r8
jne 0x14000cd11
jmp 0x14000cd2e
cmovb esi, r15d
jmp 0x14000cd31
mov esi, r14d
movsxd rax, esi
test esi, esi
jne 0x14000cd4b
cmp r10, r9
jae 0x14000cd42
mov eax, r15d
jmp 0x14000cd4b
mov eax, r14d
cmp r10, r9
setne al
test eax, eax
sets al
test al, al
jne 0x14000cd5a
lea rax, [rbp - 0x51]
jmp 0x14000cd62
mov qword [rbp - 0x59], rcx
lea rax, [rbp - 0x59]
mov rax, qword [rax]
cmp rax, qword [r13 + 0x30]
je 0x14000cd96
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.14000ab50
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14000cd96
lea rdx, str.UPDADS
call fcn.1400161e0
mov dword [rbp - 0x3d], eax
cmp qword [rbp + 0x1f], 8
jb 0x14000cdd1
mov rax, qword [rbp + 7]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x14000cdd1
cmp qword [0x140044d10], 0
jne 0x14000cdc5
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000cdd1
xor edx, edx
lea rcx, [rbp - 0x51]
call qword [0x140044d10]
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r14
mov word [rbp + 7], r14w
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14000cdf1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, r12b
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret