Function at 0x1400066d0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x2088]
mov eax, 0x2188
call fcn.14001d020
sub rsp, rax
mov rax, qword [0x1400975a0]
xor rax, rsp
mov qword [rbp + 0x2060], rax
mov r15, rdx
mov qword [rsp + 0x48], rdx
mov rbx, r9
lea rdx, [rbp + 0x60]
xor esi, esi
mov r12, r8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r8
mov r14, rcx
mov word [rsp + 0x30], si
call fcn.14000ea70
test eax, eax
js 0x140006a70
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140019660
test eax, eax
jne 0x14000674f
mov eax, 0x80020009
jmp 0x140006a70
mov qword [rsp + 0x2180], rdi
movabs rdi, 0x100002600
mov rcx, qword [r14]
movzx eax, word [rcx]
cmp eax, 0x20
ja 0x14000677d
bt rdi, rax
jae 0x14000677d
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140006761
lea rdx, [rbp + 0x60]
mov rcx, r14
call fcn.14000ea70
test eax, eax
js 0x140006a68
movzx eax, word [rsp + 0x30]
mov qword [rsp + 0x2178], r13
cmp eax, 8
je 0x140006a0b
cmp eax, 0x11
je 0x1400068e4
cmp eax, 0x13
je 0x1400068b4
cmp eax, 0x4008
jne 0x140006a4e
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x50], rsi
lea rdx, [rbp + 0x60]
mov rax, rcx
inc rax
cmp word [rdx + rax*2], si
jne 0x1400067d4
add eax, 2
movsxd r8, eax
je 0x14000681d
xor edx, edx
mov rax, rcx
div r8
cmp rax, 2
jb 0x140006a90
lea rdx, [r8 + r8]
cmp rdx, 0x100
jbe 0x14000681d
lea rcx, [rsp + 0x50]
call fcn.1400070d0
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x140006827
lea edi, [rbx + 0xe]
jmp 0x140006887
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
lea rdi, [rbp + 0x60]
cmp word [rbp + 0x60], si
je 0x14000686e
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rdi]
cmp cx, 0x5c
jne 0x14000685e
cmp word [rax], 0x30
jne 0x14000685e
mov word [rbx], si
mov rcx, rax
add rbx, 2
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
jmp 0x140006869
mov word [rbx], cx
add rbx, 2
add rdi, 2
cmp word [rdi], si
jne 0x140006831
mov dword [rbx], esi
mov r8, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r15
call fcn.140017780
mov rbx, qword [rsp + 0x50]
mov edi, eax
lea rax, [rsp + 0x58]
cmp rbx, rax
je 0x14000689b
lea rcx, [rsp + 0x50]
call fcn.14000c910
mov rbx, qword [rsp + 0x38]
test edi, edi
je 0x140006a4e
mov ecx, edi
call fcn.140007680
jmp 0x140006a60
lea r9, [rsp + 0x30]
lea rcx, [rbp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x140006a60
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, r15
call fcn.140017530
mov edi, eax
jmp 0x1400068a0
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x60]
mov rbx, rcx
nop
inc rbx
cmp word [rax + rbx*2], si
jne 0x1400068f0
test bl, 1
jne 0x140006958
mov eax, ebx
mov qword [rsp + 0x50], rsi
cdq
sub eax, edx
sar eax, 1
movsxd r13, eax
mov rdi, r13
je 0x140006962
xor edx, edx
mov rax, rcx
div rdi
cmp rax, 1
jb 0x140006a9b
cmp r13, 0x100
jbe 0x140006962
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.140007070
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x14000696c
lea rax, [rsp + 0x58]
test rax, rax
je 0x140006958
lea rcx, [rsp + 0x50]
call fcn.14000c8f0
mov eax, 0x80004005
jmp 0x140006a60
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
mov r8, r13
xor edx, edx
call fcn.14001d0b0
mov edi, esi
mov r15, rsi
movsxd r12, ebx
test ebx, ebx
jle 0x1400069bf
movzx ecx, word [rbp + r15*2 + 0x60]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
add rbx, qword [rsp + 0x50]
call fcn.140008110
mov ecx, edi
and ecx, 1
movzx edx, al
mov eax, 4
shl ecx, 2
inc r15
inc edi
sub eax, ecx
movzx ecx, al
shl dl, cl
or byte [rbx], dl
cmp r15, r12
jl 0x140006982
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x14000689b
lea rcx, [rsp + 0x50]
call fcn.14000c8f0
jmp 0x14000689b
lea rax, [rbp + 0x60]
or rcx, 0xffffffffffffffff
cmp word [rax + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x140006a13
lea eax, [rcx*2 + 2]
mov rcx, qword [r15]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x60]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x1400068a0
mov rdx, rbx
mov rcx, r14
call fcn.14000ea70
test eax, eax
cmovs esi, eax
mov eax, esi
mov r13, qword [rsp + 0x2178]
mov rdi, qword [rsp + 0x2180]
mov rcx, qword [rbp + 0x2060]
xor rcx, rsp
call fcn.14001d080
add rsp, 0x2188
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070216
call fcn.140007790
int3
mov ecx, 0x80070216
call fcn.140007790
int3