Function at 0x140099990
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r14, r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
lea r15, section..data
mov rcx, qword [section..data]
cmp rcx, r15
je 0x1400999fa
test byte [rcx + 0x1c], 1
je 0x1400999fa
cmp byte [rcx + 0x19], 5
jb 0x1400999fa
mov edx, 0x57
mov qword [rax - 0x60], r9
mov qword [rax - 0x68], r8
mov r9, rbx
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14002a9b8
xor edi, edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140005058
nop
lea rcx, [rbp - 0x30]
call fcn.1400304d8
mov rbx, qword [rbp - 0x30]
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.1400965e4
mov esi, eax
mov r10, qword [section..data]
cmp r10, r15
je 0x140099a6a
test byte [r10 + 0x1c], 2
je 0x140099a6a
cmp byte [r10 + 0x19], 4
jb 0x140099a6a
lea edx, [rdi + 0x58]
mov r9d, eax
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test esi, esi
jne 0x140099c34
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400cce40]
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.140091bc8
mov r15d, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140099ae4
test byte [rcx + 0x1c], 2
je 0x140099ae4
cmp byte [rcx + 0x19], 4
jb 0x140099ae4
lea edx, [rsi + 0x59]
mov r9d, r15d
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rdi, qword [rbp - 0x28]
xor r9d, r9d
test r15d, r15d
jne 0x140099b15
mov rax, rdi
mov r8, r14
sub r8, rdi
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x140099b0d
add rax, 2
test edx, edx
jne 0x140099af9
test ecx, ecx
je 0x140099bfc
test r14, r14
je 0x140099d09
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r9w
jne 0x140099b22
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140099b91
test byte [rcx + 0x1c], 2
je 0x140099b91
cmp byte [rcx + 0x19], 4
jb 0x140099b91
mov edx, 0x5a
mov r9d, esi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test r15d, r15d
jne 0x140099bfc
mov rax, qword [r13]
movabs r10, 0x9eac3e3734559970
mov edx, 0x3ec
mov rcx, r13
mov rax, qword [rax + 0x48]
call qword [case.0x140071786.0]
xor r9d, r9d
mov r8, r12
mov rdx, rbx
mov ecx, eax
call fcn.14009b05c
mov rcx, qword [section..data]
lea r15, section..data
cmp rcx, r15
je 0x140099c03
test byte [rcx + 0x1c], 2
je 0x140099c03
cmp byte [rcx + 0x19], 4
jb 0x140099c03
mov edx, 0x5b
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
jmp 0x140099c03
lea r15, section..data
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140099c2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov rbx, qword [rbp - 0x30]
jmp 0x140099c66
cmp esi, 2
jne 0x140099c6d
mov esi, 0x490
cmp r10, r15
je 0x140099ca7
test byte [r10 + 0x1c], 2
je 0x140099c6d
cmp byte [r10 + 0x19], 4
jb 0x140099c6d
mov edx, 0x5c
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.1400062b0
mov r10, qword [section..data]
cmp r10, r15
je 0x140099ca7
test byte [r10 + 0x1c], 1
je 0x140099ca7
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140099ca7
mov edx, 0x5d
mov r9d, esi
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140099cd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140099ce8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400055a0
int3