Function at 0x140067d60
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov r13, r8
mov qword [rsp + 0xa0], r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
lea r9, str.hKey_x__pAry_x
lea r8, str.EntryInstalledFiles
lea rdx, str.CRegistryIF
mov rcx, qword [rcx]
call fcn.140081070
lea r11, [rsp + 0x58]
mov qword [rsp + 0x30], r11
lea rbp, str.Installed_Files
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
xor esi, esi
mov ebx, esi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [rsi + 1]
test eax, eax
jne 0x140067e65
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov ebx, ecx
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fb428]
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test ebx, ebx
je 0x14006861d
mov r15, rsi
lea rcx, [rsp + 0x70]
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rsp + 0x70], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x98], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.140067540
mov r12, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x140068432
mov ebp, esi
mov rcx, qword [rax + 0x10]
mov rbx, rsi
test rcx, rcx
jle 0x140067fe2
test rbx, rbx
js 0x140067f1f
cmp rbx, rcx
jge 0x140067f1f
test rbx, rbx
js 0x140067fdc
cmp rbx, rcx
jge 0x140067fdc
mov rax, qword [r12 + 8]
mov rdi, qword [rax + rbx*8]
jmp 0x140067f22
mov rdi, rsi
mov ecx, 0x7fffffff
lea rax, [0x1400fc3a8]
nop
cmp word [rax], 0
je 0x140067f42
add rax, 2
sub rcx, 1
jne 0x140067f30
jmp 0x140067f59
test rcx, rcx
je 0x140067f59
mov eax, 0x7fffffff
sub rax, rcx
mov qword [rsp + 0xb0], rax
jmp 0x140067f64
mov rax, rsi
mov qword [rsp + 0xb0], rax
movsxd r8, eax
mov rdx, rdi
lea rcx, [0x1400fc3a8]
call fcn.1400ce2c0
test eax, eax
jne 0x140067f92
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.1400cf260
mov edi, eax
jmp 0x140067f9d
mov rcx, rdi
call fcn.1400cf2a0
mov rdi, rax
call fcn.1400cf300
cmp dword [rax], 0x22
je 0x140067fc3
call fcn.1400cf300
cmp dword [rax], 0x16
je 0x140067fc3
cmp rdi, 0xffffffff80000000
je 0x140067fc3
cmp rdi, r15
jl 0x140067fc3
lea r15, [rdi + 1]
add ebp, 1
add rbx, 1
mov rcx, qword [r12 + 0x10]
movsxd rax, ebp
cmp rax, rcx
jge 0x140067fe2
jmp 0x140067ef8
call fcn.1400a0610
int3
call fcn.14009d5e8
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140068001
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rax, qword [r14 + 0x10]
mov r8, qword [rax + 0x108]
cmp dword [r8 - 0x10], 0
cmove r8, rsi
lea r9, [0x1400fc394]
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call fcn.14000a800
mov r14, rsi
mov rax, qword [r13 + 0x10]
test rax, rax
jle 0x1400683f8
mov r12, qword [rsp + 0x68]
test r14, r14
js 0x14006807a
cmp r14, rax
jge 0x14006807a
test r14, r14
js 0x1400683c1
cmp r14, rax
jge 0x1400683c1
mov rax, qword [r13 + 8]
mov rbp, qword [rax + r14*8]
jmp 0x14006807d
mov rbp, rsi
call fcn.14009d5e8
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x1400683ed
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rbp, rbp
je 0x14006818d
test rbp, 0xffffffffffff0000
jne 0x1400680de
movzx edi, bp
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x1400681de
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000a990
jmp 0x1400681de
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x14006818d
mov r12d, dword [rbx - 0x10]
mov r13, rbp
sub r13, rbx
sar r13, 1
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, edx
jge 0x14006812b
mov edx, ecx
lea rcx, [rsp + 0x50]
call fcn.140003510
mov rbx, qword [rsp + 0x50]
cmp r13, r12
ja 0x14006814b
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rbx
call fcn.1400cd640
jmp 0x140068163
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
mov r8, rbp
mov rdx, r12
mov rcx, rbx
call fcn.1400cd500
test edi, edi
js 0x1400683c7
cmp edi, dword [rbx - 0xc]
jg 0x1400683c7
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], 0
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x68]
jmp 0x1400681de
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400681de
cmp dword [rdx + 0x10], 0
jge 0x1400681b4
cmp dword [rbx - 0xc], 0
jl 0x1400683d2
mov dword [rbx - 0x10], esi
mov word [rbx], 0
jmp 0x1400681de
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400681cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], esi
lea r9, [0x140104764]
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, qword [r12 + 8]
call fcn.140010dd0
mov ebp, esi
mov rbx, rsi
mov rdi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x80]
test rax, rax
jle 0x140068267
test ebp, ebp
jne 0x140068393
test rbx, rbx
js 0x14006823a
cmp rbx, rax
jge 0x14006823a
test rbx, rbx
js 0x1400683dd
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + rbx*8]
jmp 0x14006823d
mov rcx, rsi
mov rdx, rdi
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove ebp, eax
add rbx, rax
mov rax, qword [rsp + 0x80]
cmp rbx, rax
jl 0x140068214
test ebp, ebp
jne 0x140068393
mov r9, r15
lea r8, [0x1400fb428]
mov edx, 0xff
lea rcx, [rsp + 0xf0]
call fcn.14000ff40
test rdi, rdi
je 0x1400682d3
mov ecx, 0x3fffffff
mov rax, rdi
mov edx, esi
cmp word [rax], dx
je 0x1400682a3
add rax, 2
sub rcx, 1
jne 0x140068292
jmp 0x1400682a8
test rcx, rcx
jne 0x1400682ba
mov edx, 0x80070057
mov rbp, rsi
mov qword [rsp + 0xd0], rsi
jmp 0x1400682ca
mov ebp, 0x3fffffff
sub rbp, rcx
mov qword [rsp + 0xd0], rbp
test edx, edx
js 0x1400682d8
add rbp, rbp
jmp 0x1400682db
mov edx, 0x80070057
mov rbp, rsi
test edx, edx
jns 0x1400682ec
mov rbp, rsi
mov qword [rsp + 0xb8], rsi
jmp 0x1400682f8
add rbp, 2
mov qword [rsp + 0xb8], rbp
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], rdi
mov eax, 1
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r12]
call fcn.140081070
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, esi
test eax, eax
sete bl
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fb428]
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r12]
call fcn.140081270
test ebx, ebx
je 0x140068393
add r15, 1
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400683af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r14, 1
mov rax, qword [r13 + 0x10]
cmp r14, rax
jge 0x1400683e3
jmp 0x140068054
call fcn.1400a0610
nop
mov ecx, 0x80070057
call fcn.1400034f0
int3
mov ecx, 0x80070057
call fcn.1400034f0
nop
call fcn.1400a0610
nop
mov r12, qword [rsp + 0xa8]
jmp 0x1400683f8
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006858e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006858e
mov rbx, rsi
mov rax, qword [r13 + 0x10]
test rax, rax
jle 0x14006858e
test rbx, rbx
js 0x140068468
cmp rbx, rax
jge 0x140068468
test rbx, rbx
js 0x140068588
cmp rbx, rax
jge 0x140068588
mov rax, qword [r13 + 8]
mov r12, qword [rax + rbx*8]
jmp 0x14006846b
mov r12, rsi
mov r9, r15
lea r8, [0x1400fb428]
mov edx, 0xff
lea rcx, [rsp + 0xf0]
call fcn.14000ff40
test r12, r12
je 0x1400684c7
mov ecx, 0x3fffffff
mov rax, r12
mov edx, esi
cmp word [rax], dx
je 0x1400684a7
add rax, 2
sub rcx, 1
jne 0x140068496
jmp 0x1400684ac
test rcx, rcx
jne 0x1400684b6
mov edx, 0x80070057
mov rbp, rsi
jmp 0x1400684be
mov ebp, 0x3fffffff
sub rbp, rcx
test edx, edx
js 0x1400684cc
add rbp, rbp
jmp 0x1400684cf
mov edx, 0x80070057
mov rbp, rsi
test edx, edx
jns 0x1400684d8
mov rbp, rsi
jmp 0x1400684dc
add rbp, 2
mov rdi, qword [rsp + 0x58]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], r12
mov eax, 1
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r12
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, esi
test eax, eax
sete dil
mov dword [rsp + 0x20], edi
lea r9, [0x1400fb428]
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test edi, edi
je 0x140068576
add r15, 1
add rbx, 1
mov rax, qword [r13 + 0x10]
cmp rbx, rax
jge 0x14006858e
jmp 0x140068442
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jle 0x140068604
test rsi, rsi
js 0x1400685fe
cmp rsi, rcx
jge 0x1400685fe
mov rax, qword [rsp + 0x78]
mov r8, qword [rax + rsi*8]
test r8, r8
je 0x1400685e3
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x80]
add rsi, 1
cmp rsi, rcx
jl 0x1400685b3
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400aa464
jmp 0x140068604
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0x70]
call fcn.1400aa450
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400cd6e0
mov rbx, qword [rsp + 0x358]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret