Function at 0x1000ec278
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r12
push r13
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
lea rbp, [0x100152eb8]
lea r15, [0x10001dc18]
mov rcx, qword [0x100152eb8]
cmp rcx, rbp
je 0x1000ec2ec
test byte [rcx + 0x1c], 1
je 0x1000ec2ec
cmp byte [rcx + 0x19], 5
jb 0x1000ec2ec
mov edx, 0x62
mov qword [rax - 0x50], r9
mov qword [rax - 0x58], r8
mov r9, rbx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100057d6c
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.100035d98
nop
lea rcx, [rsp + 0x30]
call fcn.100069790
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.1000ed62c
mov edi, eax
mov bl, 4
mov r10, qword [0x100152eb8]
cmp r10, rbp
je 0x1000ec360
test byte [r10 + 0x1c], 2
je 0x1000ec360
cmp byte [r10 + 0x19], bl
jb 0x1000ec360
mov edx, 0x63
mov r9d, eax
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036328
mov r10, qword [0x100152eb8]
test edi, edi
jne 0x1000ec501
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1000e52b8
mov ebp, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000ec3c6
test byte [rcx + 0x1c], 2
je 0x1000ec3c6
cmp byte [rcx + 0x19], bl
jb 0x1000ec3c6
lea edx, [rdi + 0x64]
mov r9d, ebp
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rbx, qword [rsp + 0x38]
test ebp, ebp
jne 0x1000ec3f4
mov rax, rbx
mov r8, rsi
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000ec3ec
add rax, 2
test edx, edx
jne 0x1000ec3d8
test ecx, ecx
je 0x1000ec4c4
xor eax, eax
test rsi, rsi
setne al
test eax, eax
jne 0x1000ec40b
mov ecx, 0x80004005
call fcn.100036264
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000ec46d
test byte [rcx + 0x1c], 2
je 0x1000ec46d
cmp byte [rcx + 0x19], 4
jb 0x1000ec46d
mov edx, 0x65
mov r9d, edi
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036328
test ebp, ebp
jne 0x1000ec4cd
mov rax, qword [r13]
mov edx, 0x3ec
mov rcx, r13
call qword [rax + 0x48]
mov ecx, eax
xor r9d, r9d
mov r8, r12
mov rdx, qword [rsp + 0x30]
call fcn.1000f0b60
mov rcx, qword [0x100152eb8]
lea rbp, [0x100152eb8]
cmp rcx, rbp
je 0x1000ec4d4
test byte [rcx + 0x1c], 2
je 0x1000ec4d4
cmp byte [rcx + 0x19], 4
jb 0x1000ec4d4
mov edx, 0x66
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034764
jmp 0x1000ec4d4
lea rbp, [0x100152eb8]
jmp 0x1000ec4d4
lea rbp, [0x100152eb8]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ec4f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r10, qword [0x100152eb8]
jmp 0x1000ec535
mov r10, qword [0x100152eb8]
jmp 0x1000ec535
cmp edi, 2
jne 0x1000ec535
mov edi, 0x490
cmp r10, rbp
je 0x1000ec56b
test byte [r10 + 0x1c], 2
je 0x1000ec535
cmp byte [r10 + 0x19], bl
jb 0x1000ec535
mov edx, 0x67
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100034764
mov r10, qword [0x100152eb8]
cmp r10, rbp
je 0x1000ec56b
test byte [r10 + 0x1c], 1
je 0x1000ec56b
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000ec56b
mov edx, 0x68
mov r9d, edi
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036328
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ec58c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000ec59c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret