Function at 0x140008549
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov rax, 0x11
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140008566
sub rsp, 0x28
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14002aa00
add rsp, 0x10
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14002aa00
add rsp, 0x10
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.14002aa00
add rsp, 0x10
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x40]
sub rsp, 0x10
call fcn.14002aa00
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.140008c55
push qword [rsp + 0x40]
movabs rcx, 0x1400d1340
pop rdx
call fcn.14002a9a0
or rax, rax
je 0x140008681
cmp dword [0x1401158bc], 0
je 0x140008659
sub rsp, 8
lea rax, [rsp + 0x58]
mov rax, rax
push rax
movsxd r15, dword [0x1401158c4]
or r15, 0xf003f
mov rax, r15
push rax
push 0
push qword [0x1401157c8]
push qword [0x1401157f0]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegOpenKeyExW
add rsp, 0x30
mov qword [rsp + 0x48], rax
jmp 0x14000867c
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push qword [0x1401157c8]
push qword [0x1401157f0]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_RegOpenKeyW
mov qword [rsp + 0x48], rax
jmp 0x14000871a
lea rax, [rsp + 0x60]
mov rax, rax
push rax
push qword [0x1401157f0]
push qword [rsp + 0x50]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x58], rax
cmp dword [0x1401158bc], 0
je 0x1400086f9
sub rsp, 8
lea rax, [rsp + 0x58]
mov rax, rax
push rax
movsxd r15, dword [0x1401158c4]
or r15, 0xf003f
mov rax, r15
push rax
push 0
push qword [0x1401157c8]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegOpenKeyExW
add rsp, 0x30
mov qword [rsp + 0x48], rax
jmp 0x14000871a
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push qword [0x1401157c8]
push qword [rsp + 0x70]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_RegOpenKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x140008aa3
mov qword [rsp + 0x68], 0x400
push qword [0x140117620]
sub rsp, 8
push qword [0x140117620]
push qword [rsp + 0x80]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [rsp + 0x78]
pop rdx
call fcn.14002a8d0
push qword [rsp + 0xd8]
mov r15, 2
cmp r15, qword [rsp]
jne 0x1400087d4
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028210
add rsp, 0x20
mov r15, rax
add r15, r15
inc r15
mov rax, r15
push rax
mov rax, qword [rsp + 0x50]
mov rax, rax
push rax
push 2
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x50], rax
jmp 0x140008a80
mov r15, 1
cmp r15, qword [rsp]
jne 0x14000883f
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028210
add rsp, 0x20
mov r15, rax
add r15, r15
inc r15
mov rax, r15
push rax
mov rax, qword [rsp + 0x50]
mov rax, rax
push rax
push 1
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x50], rax
jmp 0x140008a80
mov r15, 4
cmp r15, qword [rsp]
jne 0x1400088b1
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140027d70
add rsp, 0x28
mov qword [rsp + 0x80], rax
sub rsp, 8
push 4
lea rax, [rsp + 0x90]
mov rax, rax
push rax
push 4
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x50], rax
jmp 0x140008a80
mov r15, 3
cmp r15, qword [rsp]
jne 0x140008a80
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.140028210
add rsp, 0x28
mov r15, rax
mov rax, r15
mov rcx, 2
cqo
idiv rcx
mov r15, rax
mov qword [rsp + 0x88], r15
sub rsp, 8
push qword [rsp + 0x90]
pop rcx
sub rsp, 0x20
call fcn.140029440
add rsp, 0x28
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
jmp 0x140008924
mov r15, qword [rsp + 0x88]
dec r15
cmp r15, qword [rsp + 0x98]
jl 0x140008a28
push qword [0x140117620]
push qword [0x140117620]
push 2
mov r15, qword [rsp + 0xb0]
add r15, r15
inc r15
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140027cb0
add rsp, 0x20
lea rcx, [rsp + 0xa8]
pop rdx
sub rsp, 0x28
call fcn.14002a8d0
add rsp, 0x28
push qword [0x140117620]
push qword [0x140117620]
movabs rcx, 0x1400d12cc
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rcx, qword [rsp + 0xb0]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140027d70
add rsp, 0x20
pop qword [0x140117620]
mov qword [rsp + 0xa8], rax
sub rsp, 8
push qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa0]
add r15, qword [rsp + 0xa8]
mov rax, r15
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029700
add rsp, 0x28
inc qword [rsp + 0x98]
jno 0x140008924
sub rsp, 8
push qword [rsp + 0x90]
push qword [rsp + 0xa0]
push 3
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x50], rax
sub rsp, 8
push qword [rsp + 0x98]
pop rcx
sub rsp, 0x20
call fcn.1400296b0
add rsp, 0x28
pop rax
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov qword [rsp + 0xa8], 1
mov rax, qword [rsp + 0xa8]
jmp 0x140008ac6
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0xa8]
jmp 0x140008ac6
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
mov rcx, qword [rsp + 0x78]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
mov rcx, qword [rsp + 0xa0]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14002aa70
add rsp, 0x28
pop rax
add rsp, 0xb0
pop r15
ret