Function at 0x140097720
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
mov r12, r8
mov rbx, rdx
mov dword [r8], esi
mov eax, dword [0x1400eb520]
mov rbp, rcx
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400eb524]
mov dil, 1
mov word [rsp + 0x44], ax
test rdx, rdx
je 0x140097ac6
nop word [rax + rax]
cmp word [rbx], si
je 0x140097ac6
lea rax, [rsp + 0x40]
nop
movzx ecx, word [rax]
test cx, cx
je 0x14009779b
cmp word [rbx], cx
je 0x1400977b1
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
test rax, rax
jne 0x140097780
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x140097770
jmp 0x140097ac6
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
test rax, rax
je 0x140097ac6
nop word [rax + rax]
lea rdx, str.UnregServer
mov rcx, rbx
call fcn.140092c30
test eax, eax
je 0x140097a45
lea rdx, str.RegServer
mov rcx, rbx
call fcn.140092c30
test eax, eax
je 0x1400979b6
lea rdx, str.Service
mov rcx, rbx
call fcn.140092c30
test eax, eax
je 0x14009786b
cmp word [rbx], si
je 0x140097ac6
lea rcx, [rsp + 0x40]
nop
movzx eax, word [rcx]
test ax, ax
je 0x14009783b
cmp word [rbx], ax
je 0x140097851
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
test rax, rax
jne 0x140097820
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x140097811
jmp 0x140097ac6
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x1400977d0
jmp 0x140097ac6
mov dl, 1
mov rcx, rbp
call fcn.140093f80
mov dword [r12], eax
test eax, eax
js 0x140097914
mov rcx, rbp
call fcn.1400957c0
mov rbx, qword [0x14011e4a0]
mov rcx, qword [0x14011e4a8]
mov eax, esi
cmp rbx, rcx
jae 0x1400978e1
nop
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400978d4
mov ecx, 1
call qword [rdi + 8]
test eax, eax
js 0x140097908
call qword [rdi + reloc.ATL100.DLL_Ordinal_56]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, rax
call qword [sym.imp.ATL100.DLL_Ordinal_49]
test eax, eax
js 0x140097908
mov rcx, qword [0x14011e4a8]
add rbx, 8
cmp rbx, rcx
jb 0x1400978a0
test eax, eax
js 0x140097908
mov rcx, qword [0x14011e498]
xor edx, edx
call fcn.140086650
test eax, eax
js 0x140097908
mov rdx, qword [0x14011df10]
test rdx, rdx
je 0x140097908
mov rcx, qword [0x14011e428]
call rdx
mov rcx, rbp
mov dword [r12], eax
call fcn.140092da0
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareClassesAppID9E6E16CC_84B2_4E7F_A839_26BD17D6E906
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140097ac3
lea r8, [rsp + 0x38]
lea edx, [rax + 1]
lea rcx, str.O:BAG:BAD:_A__0xb___WD_S:_ML__NX___LW_
xor r9d, r9d
mov qword [rsp + 0x38], rsi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rdi, qword [rsp + 0x38]
test eax, eax
je 0x14009799d
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
lea rdx, str.LaunchPermission
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140097ac3
xor edx, edx
mov rcx, rbp
call fcn.140093f80
mov dword [r12], eax
test eax, eax
js 0x140097ac3
mov rbx, qword [0x14011e4a0]
mov rax, qword [0x14011e4a8]
cmp rbx, rax
jae 0x140097a21
nop
mov rdi, qword [rbx]
test rdi, rdi
je 0x140097a18
mov ecx, 1
call qword [rdi + 8]
mov esi, eax
test eax, eax
js 0x140097a21
call qword [rdi + reloc.ATL100.DLL_Ordinal_56]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, rax
call qword [sym.imp.ATL100.DLL_Ordinal_49]
mov esi, eax
test eax, eax
js 0x140097a21
mov rax, qword [0x14011e4a8]
add rbx, 8
cmp rbx, rax
jb 0x1400979e0
test esi, esi
js 0x140097a3c
mov rax, qword [0x14011df10]
test rax, rax
je 0x140097a3c
mov rcx, qword [0x14011e428]
call rax
mov esi, eax
mov dword [r12], esi
jmp 0x140097ac3
mov rax, qword [0x14011df18]
test rax, rax
je 0x140097a57
call rax
test eax, eax
js 0x140097aa7
mov rbx, qword [0x14011e4a0]
mov rcx, qword [0x14011e4a8]
mov eax, esi
cmp rbx, rcx
jae 0x140097aa7
nop dword [rax]
mov rdi, qword [rbx]
test rdi, rdi
je 0x140097a9e
call qword [rdi + reloc.ATL100.DLL_Ordinal_56]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ATL100.DLL_Ordinal_49]
test eax, eax
js 0x140097aa7
xor ecx, ecx
call qword [rdi + 8]
test eax, eax
js 0x140097aa7
mov rcx, qword [0x14011e4a8]
add rbx, 8
cmp rbx, rcx
jb 0x140097a70
mov dword [r12], eax
test eax, eax
js 0x140097ac3
mov rcx, rbp
call fcn.1400968b0
mov rcx, rbp
call fcn.140094170
mov dword [r12], eax
xor dil, dil
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cafa0
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret