Function at 0x1400a9b80
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x100], rbx
mov rax, qword [0x14013d0a8]
xor rax, rbp
mov qword [rbp + 0xa0], rax
mov r14, rdx
movsxd rax, dword [rcx + 8]
cmp eax, 9
ja case.default.0x1400a9bd2
lea r8, [0x140000000]
mov edx, dword [r8 + rax*4 + 0xaa004]
add rdx, r8
jmp rdx
mov rax, qword [rcx + 0x10]
mov ebx, dword [rax]
call fcn.1400b0200
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call fcn.1400aa100
jmp 0x1400a9fd9
mov rax, qword [rcx + 0x10]
movzx ebx, byte [rax]
call fcn.1400b0200
mov rcx, qword [r14]
test rcx, rcx
mov dword [rbp], ebx
je 0x1400a9c36
mov dword [rsp + 0x28], 4
lea rdx, [rbp]
mov r9d, 4
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
jmp 0x1400a9fd9
mov rcx, qword [r14 + 8]
test rcx, rcx
je case.default.0x1400a9bd2
mov r9d, 4
lea r8, [rbp]
mov rdx, rax
call fcn.1400a8d80
jmp 0x1400a9fd9
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
call fcn.1400b0200
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a9c88
mov dword [rsp + 0x28], 8
lea rdx, [rbp]
mov r9d, 3
jmp 0x1400a9c1b
mov rcx, qword [r14 + 8]
test rcx, rcx
je case.default.0x1400a9bd2
mov r9d, 8
lea r8, [rbp]
mov rdx, rax
call fcn.1400a8d80
jmp 0x1400a9fd9
mov rax, qword [rcx + 0x10]
movsx ebx, word [rax]
jmp 0x1400a9bf9
mov rbx, qword [rcx + 0x10]
call fcn.1400b0200
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x1400a9cd0
add edx, edx
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a9cf8
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 1
jmp 0x1400a9c20
mov rcx, qword [r14 + 8]
test rcx, rcx
je case.default.0x1400a9bd2
mov r9d, edx
mov r8, rbx
mov rdx, rax
call fcn.1400a8d80
jmp 0x1400a9fd9
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
call fcn.1400b0200
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], eax
lea r8, [rbp + 0x40]
lea edx, [rax + 0x5c]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [0x140141f2c]
mov edx, 0x48
mov ecx, dword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [rbp + 0x40], eax
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a9daf
mov dword [rsp + 0x28], 0x5c
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
jmp 0x1400a9fd9
mov rcx, qword [r14 + 8]
test rcx, rcx
je case.default.0x1400a9bd2
mov r9d, 0x5c
lea r8, [rbp + 0x40]
mov rdx, rdi
call fcn.1400a8d80
jmp 0x1400a9fd9
mov rdi, qword [rcx + 0x10]
call fcn.1400b0200
mov rsi, rax
mov rcx, rdi
call fcn.1400b0850
mov ebx, eax
add rbx, rbx
mov rcx, rdi
call fcn.1400b0200
mov rdx, rbx
mov rcx, rax
call fcn.1400b0780
mov rbx, rax
mov qword [rbp], rax
lea r9, [rbp]
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.1400aa030
movzx edi, al
test rbx, rbx
je 0x1400a9e2c
mov rcx, rbx
call fcn.1400b0810
nop
movzx eax, dil
jmp 0x1400a9fd9
mov rbx, qword [rcx + 0x10]
call fcn.1400b0200
mov rsi, rax
xor r15d, r15d
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea rdx, [rbp + 8]
mov rcx, rbx
call fcn.14002df80
mov ecx, dword [rbp + 0x10]
call fcn.1400b5c60
mov rdi, rax
mov edx, dword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], rdx
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.14002df80
mov edx, dword [rbp + 0x28]
mov rcx, rdi
call fcn.1400b0780
mov rbx, rax
mov qword [rbp], rax
mov rcx, rdi
call fcn.1400b56bc
lea r9, [rbp]
lea r8d, [r15 + 3]
mov rdx, rsi
mov rcx, r14
call fcn.1400aa030
movzx edi, al
test rbx, rbx
je 0x1400a9ec0
mov rcx, rbx
call fcn.1400b0810
nop
movzx eax, dil
jmp 0x1400a9fd9
mov ebx, dword [rcx + 0xc]
mov rdi, qword [rcx + 0x10]
call fcn.1400b0200
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a9eff
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov al, 1
jmp 0x1400a9fd9
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400a9fd3
mov r9d, ebx
mov r8, rdi
mov rdx, rax
call fcn.1400a8d80
mov al, 1
jmp 0x1400a9fd9
mov r15d, dword [rcx + 0xc]
shr r15d, 1
mov rsi, qword [rcx + 0x10]
call fcn.1400b0200
mov r13, rax
mov edi, r15d
lea rcx, [r15 + r15]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400a9f4e
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400b5dc0
sub rsp, rax
lea r12, [rsp + 0x30]
test r15d, r15d
je 0x1400a9f93
mov rbx, r12
sub rsi, r12
nop word [rax + rax]
movzx ecx, word [rsi + rbx]
mov r8d, dword [0x140141f28]
mov edx, 0x60
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rdi, 1
jne 0x1400a9f70
lea r9d, [r15 + r15]
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a9fbf
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
mov r9d, 3
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov al, 1
jmp 0x1400a9fd9
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400a9fd3
mov r8, r12
mov rdx, r13
call fcn.1400a8d80
mov al, 1
jmp 0x1400a9fd9
xor al, al
mov rcx, qword [rbp + 0xa0]
xor rcx, rbp
call fcn.1400b5660
mov rbx, qword [rbp + 0x100]
lea rsp, [rbp + 0xb0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret