Function at 0x140024320
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
lea rbp, [rsp - 0x1270]
mov eax, 0x1370
call fcn.14002f320
sub rsp, rax
test rdx, rdx
je 0x140024710
cmp r8d, 1
jb 0x140024710
mov qword [rsp + 0x1380], rbx
lea rbx, [rdx + 0x10]
mov qword [rsp + 0x1388], rsi
lea rsi, [rdx + 8]
mov qword [rsp + 0x1368], rdi
mov qword [rsp + 0x1360], r12
movabs r12, 0x624dd2f1a9fbe77
mov qword [rsp + 0x1358], r14
mov qword [rsp + 0x1350], r15
xor r15d, r15d
movzx eax, r15w
mov r14d, r8d
mov word [rbp + 0x250], ax
lea rdi, [r15 - 1]
test ax, ax
je 0x1400243c5
mov r9, rdi
lea r8, [0x1401b80e4]
mov edx, 0x7ff
lea rcx, [rbp + 0x250]
call fcn.14003e54c
lea rdx, [0x1401b7668]
mov rcx, rbx
call fcn.140030c6c
test rax, rax
lea rcx, [rsp + 0x50]
mov r9, rdi
mov edx, 0x100
lea r8, [rax + 6]
cmove r8, rbx
call fcn.14003c5c8
lea rdx, [0x1401b7688]
lea rcx, [rsp + 0x50]
call fcn.140030c6c
test rax, rax
je 0x14002440b
mov word [rax], r15w
mov r9, rdi
lea r8, [rsp + 0x50]
mov edx, 0x800
lea rcx, [rbp + 0x250]
call fcn.14003e54c
mov rcx, qword [rsi]
lea r9, str._I64u
mov rax, r12
mov r8, rdi
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov edx, 0x100
shr rcx, 9
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
call fcn.140003dd0
mov r9, rdi
lea r8, [rsp + 0x50]
mov edx, 0x800
lea rcx, [rbp + 0x250]
call fcn.14003e54c
add rbx, 0x110
add rsi, 0x110
sub r14, 1
je 0x140024491
movzx eax, word [rbp + 0x250]
jmp 0x1400243a5
lea rax, [rbp + 0x1298]
mov qword [rbp + 0x1298], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14, qword [rsp + 0x1358]
mov r12, qword [rsp + 0x1360]
test eax, eax
je 0x14002454a
lea rax, [rbp + 0x1298]
mov qword [rbp + 0x1298], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14002454a
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x1298]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140024557
mov rcx, qword [rbp + 0x1298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call fcn.140035e90
lea r9, str._I64d
mov qword [rsp + 0x20], rax
mov r8, rdi
lea rcx, [rsp + 0x50]
mov edx, 0x100
call fcn.140003dd0
lea rsi, [0x1401c8444]
mov r8, rdi
lea r9, str._s.Time
mov qword [rsp + 0x20], rsi
mov edx, 0x80
lea rcx, [rbp + 0x150]
call fcn.140003dd0
lea rcx, [rsp + 0x50]
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x1400245b0
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x140024633
lea rax, [rbp + 0x1298]
mov qword [rbp + 0x1298], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024633
mov rcx, qword [rbp + 0x1298]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
lea rdx, [rbp + 0x150]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x1298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1380]
lea rax, [rbp + 0x250]
cmp word [rax + rdi*2 + 2], r15w
lea rdi, [rdi + 1]
jne 0x140024642
lea edi, [rdi*2 + 2]
test edi, edi
je 0x1400246c3
lea rax, [rbp + 0x1298]
mov qword [rbp + 0x1298], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400246c3
mov rcx, qword [rbp + 0x1298]
lea rax, [rbp + 0x250]
mov dword [rsp + 0x28], edi
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x1298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x1350]
lea rdi, [rbp + 0x150]
mov rsi, qword [rsp + 0x1388]
xor eax, eax
mov ecx, 0x40
rep stosd dword [rdi], eax
lea rdi, [rbp + 0x250]
mov ecx, 0x400
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x50]
mov ecx, 0x80
rep stosd dword [rdi], eax
mov rdi, qword [rsp + 0x1368]
mov al, 1
add rsp, 0x1370
pop rbp
ret
xor al, al
add rsp, 0x1370
pop rbp
ret