Function at 0x14000c020
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
add rax, 0x18
lea rbx, str.SOFTWAREMicrosoftWindowsCurrentVersionWINEVTPublishers_
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.140006910
mov r14, 0xffffffffffffffff
test al, al
jne 0x14000c0aa
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c090
mov r8d, eax
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.140007e80
mov qword [rsp + 0x330], rsi
mov qword [rsp + 0x338], rdi
mov qword [rsp + 0x340], r12
mov qword [rsp + 0x308], r13
mov qword [rsp + 0x300], r15
call fcn.14000b650
test eax, eax
jne 0x14000c1a7
mov eax, 0xc
lea r8, str.The_process_needs_to_run_elevated_n
movzx edx, ax
mov ecx, 0xfffffff4
call fcn.1400085c0
xor esi, esi
lea r13, [0x140000000]
mov r9d, esi
mov edi, 0x80070005
mov edx, 0x114f
mov r10d, 0x80070005
mov eax, esi
mov r8, r10
add rax, rax
mov ecx, esi
mov eax, dword [r13 + rax*8 + 0x3c070]
sub r8, rax
je 0x14000c148
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x14000c114
jmp 0x14000c153
add rcx, rcx
mov r9, qword [r13 + rcx*8 + 0x3c078]
cmp dword [0x140055944], 0
je 0x14000c841
lea rax, str.__HRESULT_0x80070005L_
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov qword [rsp + 0x20], r9
mov ecx, 0xfffffff4
mov r9d, edi
movzx edx, si
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c841
mov dword [rsp + 0x20], 0xa1
jmp 0x14000c826
lea rdx, [rbp - 0x20]
call fcn.14000b280
xor esi, esi
mov edi, eax
lea r13, [0x140000000]
test eax, eax
jns 0x14000c263
mov edx, 0x114f
mov r10d, esi
nop dword [rax + rax]
mov eax, esi
mov r8, rdi
add rax, rax
mov ecx, esi
mov eax, dword [r13 + rax*8 + 0x3c070]
sub r8, rax
je 0x14000c204
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x14000c1d0
jmp 0x14000c20f
add rcx, rcx
mov r10, qword [r13 + rcx*8 + 0x3c078]
cmp dword [0x140055944], 0
je 0x14000c841
lea rax, str.GetDetoursDllPath__L_mfdetours.dll___pszDetoursDllFullPath___sizeof_RtlpNumberOf_pszDetoursDllFullPath_____
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, si
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r10
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c841
mov dword [rsp + 0x20], 0xa4
jmp 0x14000c826
mov eax, 1
lea rcx, [0x140055108]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x50], rcx
nop dword [rax + rax]
lea rcx, [rax + rax*4]
mov r8d, 0x32
lea rcx, [rcx*8 + 0x550d0]
add rcx, r13
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
je 0x14000c78b
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14000c2cb
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x1400185c0]
mov rdx, rax
test rax, rax
jne 0x14000c2e6
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
mov rax, qword [rax + 0x20]
call qword [0x1400185c0]
mov rdx, rax
test rdx, rdx
je 0x14000c8ab
mov rcx, qword [rdx]
mov rax, qword [rcx + 0x18]
mov rcx, rdx
call qword [0x1400185c0]
mov r15, r14
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x70]
inc r15
cmp word [rax + r15*2], si
jne 0x14000c310
movsxd r14, dword [rdi - 0x10]
mov ecx, 1
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
lea r12d, [r14 + r15]
sub eax, r12d
or ecx, eax
jge 0x14000c346
mov edx, r12d
lea rcx, [rsp + 0x48]
call fcn.140007e20
mov rbx, qword [rsp + 0x48]
add r14, r14
mov r8, rdi
mov r9, r14
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memcpy_s]
movsxd rdx, r15d
lea rcx, [r14 + rbx]
add rdx, rdx
lea r8, [rsp + 0x70]
mov r9, rdx
call qword [sym.imp.msvcrt.dll_memcpy_s]
test r12d, r12d
js 0x14000c8b6
cmp r12d, dword [rbx - 0xc]
jg 0x14000c8b6
mov r15, qword [rsp + 0x50]
mov r14, 0xffffffffffffffff
movsxd rax, r12d
mov dword [rbx - 0x10], r12d
mov word [rbx + rax*2], si
mov rax, r14
mov rcx, qword [r15]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14000c3a3
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, [0x14005025c]
mov qword [rsp + 0x20], rcx
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
jle 0x14000c3ea
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14000c6b3
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [0x14004f860]
mov dword [rsp + 0x40], 1
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
jle 0x14000c438
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14000c613
lea rcx, [rbp - 0x20]
mov rax, r14
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14000c450
lea eax, [rax*2 + 2]
mov r9d, 2
mov dword [rsp + 0x28], eax
lea r8, str.MessageFileName
lea rax, [rbp - 0x20]
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
jle 0x14000c49b
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14000c5aa
lea rcx, [rbp - 0x20]
mov rax, r14
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14000c4b0
lea eax, [rax*2 + 2]
mov r9d, 2
mov dword [rsp + 0x28], eax
lea r8, str.ResourceFileName
lea rax, [rbp - 0x20]
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
jle 0x14000c4fb
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14000c541
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c520
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
mov eax, dword [rsp + 0x30]
add r15, 0x28
inc eax
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x30], eax
cmp eax, 3
jb 0x14000c280
jmp 0x14000c841
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rsi
mov ecx, edi
call fcn.140008520
cmp dword [0x140055944], esi
je 0x14000c761
lea rax, str.HRESULT_FROM_WIN32__RegSetKeyValueW_____HKEY____ULONG_PTR___LONG_0x80000002_____strRegPathCur__L_ResourceFileName_____2ul____pszDetoursDllFullPath____wcslen__pszDetoursDllFullPath____1____sizeof__WCHAR______
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x58]
mov r9d, edi
movzx edx, si
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c761
mov dword [rsp + 0x20], 0xd2
jmp 0x14000c746
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
mov ecx, edi
call fcn.140008520
cmp dword [0x140055944], esi
je 0x14000c761
lea rax, str.HRESULT_FROM_WIN32__RegSetKeyValueW_____HKEY____ULONG_PTR___LONG_0x80000002_____strRegPathCur__L_MessageFileName_____2ul____pszDetoursDllFullPath____wcslen__pszDetoursDllFullPath____1____sizeof__WCHAR______
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x60]
mov r9d, edi
movzx edx, si
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c761
mov dword [rsp + 0x20], 0xc9
jmp 0x14000c746
mov edx, 0x114f
mov r9d, edi
mov r10, rsi
nop
mov eax, esi
mov r8, r9
add rax, rax
mov ecx, esi
mov eax, dword [r13 + rax*8 + 0x3c070]
sub r8, rax
je 0x14000c654
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x14000c620
jmp 0x14000c65f
add rcx, rcx
mov r10, qword [r13 + rcx*8 + 0x3c078]
cmp dword [0x140055944], 0
je 0x14000c761
lea rax, str.HRESULT_FROM_WIN32__RegSetKeyValueW_____HKEY____ULONG_PTR___LONG_0x80000002_____strRegPathCur__L_Enabled_____4ul____nEnabled__sizeof__nEnabled______
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, si
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r10
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c761
mov dword [rsp + 0x20], 0xc0
jmp 0x14000c746
mov edx, 0x114f
mov r9d, edi
mov r10, rsi
nop
mov eax, esi
mov r8, r9
add rax, rax
mov ecx, esi
mov eax, dword [r13 + rax*8 + 0x3c070]
sub r8, rax
je 0x14000c6f4
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x14000c6c0
jmp 0x14000c6ff
add rcx, rcx
mov r10, qword [r13 + rcx*8 + 0x3c078]
cmp dword [0x140055944], 0
je 0x14000c761
lea rax, str.HRESULT_FROM_WIN32__RegSetKeyValueW_____HKEY____ULONG_PTR___LONG_0x80000002_____strRegPathCur__L______1ul____g_providerMappingTable__n__.pszName____wcslen__g_providerMappingTable__n__.pszName____1____sizeof__WCHAR______
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, si
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r10
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c761
mov dword [rsp + 0x20], 0xb6
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracehelpers.cpp
movzx edx, si
lea r8, str.___at__s:_i_n
mov ecx, 0xfffffff4
call fcn.1400085c0
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c841
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
jmp 0x14000c841
mov edi, 0x80004005
mov edx, 0x114f
mov r9, rsi
mov r10d, 0x80004005
nop
mov eax, esi
mov r8, r10
add rax, rax
mov ecx, esi
mov eax, dword [r13 + rax*8 + 0x3c070]
sub r8, rax
je 0x14000c7d4
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x14000c7a0
jmp 0x14000c7df
add rcx, rcx
mov r9, qword [r13 + rcx*8 + 0x3c078]
cmp dword [0x140055944], 0
je 0x14000c841
lea rax, str.StringFromGUID2__g_providerMappingTable__n__.guid__pszGuid___sizeof_RtlpNumberOf_pszGuid_____
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov qword [rsp + 0x20], r9
mov ecx, 0xfffffff4
mov r9d, edi
movzx edx, si
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000c841
mov dword [rsp + 0x20], 0xab
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracehelpers.cpp
movzx edx, si
lea r8, str.___at__s:_i_n
mov ecx, 0xfffffff4
call fcn.1400085c0
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14000c866
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
mov r15, qword [rsp + 0x300]
mov eax, edi
mov rdi, qword [rsp + 0x338]
mov r13, qword [rsp + 0x308]
mov r12, qword [rsp + 0x340]
mov rsi, qword [rsp + 0x330]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140016790
add rsp, 0x310
pop r14
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140008690
int3
mov ecx, 0x80070057
call fcn.140008690
int3