Function at 0x14005e2fc
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov rax, qword [0x14016b400]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov r13, rcx
mov qword [rbp + 0x10], rcx
xor r15d, r15d
mov qword [rbp + 0x28], r9
mov ecx, 0x2000
mov qword [rbp + 0x30], r15
mov r12, r8
mov qword [rbp + 0x18], r8
mov r14, rdx
mov qword [rbp + 0x20], rdx
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14005e5de
mov rdx, rax
mov rcx, r13
call fcn.1400602e4
mov ebx, eax
mov rcx, rsi
test eax, eax
js 0x14005e3dc
lea rdx, [rbp]
call fcn.1400630e0
test eax, eax
jne 0x14005e3a0
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov ebx, 0x80020009
jmp 0x14005e7b1
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14005e5d5
mov rcx, r13
call fcn.140062880
mov rdx, rdi
mov rcx, r13
call fcn.1400602e4
mov ebx, eax
test eax, eax
jns 0x14005e3e7
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14005e7b1
movzx eax, word [rbp]
mov dword [rbp + 8], r15d
cmp eax, 8
je 0x14005e572
cmp eax, 0x11
je 0x14005e449
cmp eax, 0x13
jne 0x14005e786
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [rbp + 8]
mov r9d, 4
mov rcx, qword [r14]
xor r8d, r8d
mov dword [rbp], eax
mov rdx, r12
lea rax, [rbp]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
jmp 0x14005e786
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x14005e44d
test bl, 1
jne 0x14005e59d
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
cmp r12, 0x400
ja 0x14005e4a6
mov rcx, r12
call fcn.14006315c
test al, al
je 0x14005e4a6
lea rax, [r12 + 0xf]
cmp rax, r12
ja 0x14005e493
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400332f0
sub rsp, rax
lea r15, [rsp + 0x30]
jmp 0x14005e4b5
mov rdx, r12
lea rcx, [rbp + 0x30]
call fcn.14005e834
mov r15, rax
test r15, r15
je 0x14005e59d
mov r8, r12
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
xor eax, eax
movsxd r11, ebx
mov r10d, eax
test ebx, ebx
jle 0x14005e54a
mov r9d, eax
lea rbx, [0x140000000]
movzx r8d, word [rdi + r9*2]
lea eax, [r8 - 0x30]
cmp eax, 0x36
ja case.0x14005e503.51
cdqe
movzx eax, byte [rbx + rax + 0x5e7fc]
mov ecx, dword [rbx + rax*4 + 0x5e7ec]
add rcx, rbx
jmp rcx
sub r8b, 0x30
jmp 0x14005e51a
sub r8b, 0x37
jmp 0x14005e51a
sub r8b, 0x57
jmp 0x14005e51a
xor r8b, r8b
mov eax, r10d
mov ecx, r10d
cdq
and ecx, 1
sub eax, edx
shl ecx, 2
sar eax, 1
inc r10d
movsxd rdx, eax
inc r9
mov eax, 4
sub eax, ecx
movzx ecx, al
shl r8b, cl
or byte [rdx + r15], r8b
cmp r9, r11
jl 0x14005e4e1
mov rdx, qword [rbp + 0x18]
mov rcx, r14
mov dword [rsp + 0x28], r12d
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
jmp 0x14005e783
xor r14d, r14d
or rbx, 0xffffffffffffffff
mov r15, rdi
cmp byte [rbp + 0xa0], r14b
je 0x14005e73f
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r14w
jne 0x14005e58c
cmp eax, 0xffe
jle 0x14005e5b9
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov ebx, 0x80004005
jmp 0x14005e7b1
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
mov r14, rax
test rax, rax
jne 0x14005e5e8
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov ebx, 0x8007000e
jmp 0x14005e7b1
mov r15, qword [r13 + 8]
mov qword [rbp + 0x40], 0
lea rax, [r15 + 0x10]
mov rcx, rax
mov qword [rbp + 0x38], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
xor eax, eax
mov r12d, eax
mov qword [rbp], rax
cmp dword [r15 + 8], eax
jle 0x14005e649
mov r13d, eax
mov rax, qword [r15]
lea rdx, [0x14010c360]
mov rcx, qword [rax + r13]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x14005e718
inc r12d
add r13, 8
cmp r12d, dword [r15 + 8]
jl 0x14005e617
mov r13, qword [rbp + 0x10]
xor eax, eax
mov r15, rax
lea rcx, [rbp]
call fcn.14005db24
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test r15, r15
je 0x14005e72f
mov rdx, r15
mov rcx, rdi
call fcn.140062998
mov r12, rax
test rax, rax
je 0x14005e72f
cmp rax, qword [rbp + 0x28]
je 0x14005e69b
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharPrevW]
cmp word [rax], 0x22
je 0x14005e72f
xor eax, eax
mov r8, r12
sub r8, rdi
mov word [r14], ax
sar r8, 1
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
lea r8, [0x14010c464]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov r8, r15
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
lea r8, [0x14010c464]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov rax, rbx
cmp word [r15 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14005e6f4
lea r8, [r12 + rax*2]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov r15, r14
jmp 0x14005e732
mov rax, qword [r15]
mov r13, qword [rbp + 0x10]
movsxd rcx, r12d
mov rcx, qword [rax + rcx*8]
mov r15, qword [rcx + 8]
jmp 0x14005e64c
mov r15, rdi
lea rcx, [rbp + 0x40]
call fcn.14005db24
mov r12, qword [rbp + 0x18]
cmp word [r15 + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x14005e73f
mov rcx, qword [rbp + 0x20]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r12
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test r14, r14
je 0x14005e783
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
xor r15d, r15d
mov rdx, qword [rbp + 0x28]
mov rcx, r13
call fcn.1400602e4
mov ebx, eax
mov rcx, rdi
test eax, eax
js 0x14005e3d3
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov ebx, r15d
lea rcx, [rbp + 0x30]
call fcn.14005db24
mov eax, ebx
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.1400321c0
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret