Function at 0x140073830
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12, r9
mov rbx, r8
mov rdi, rdx
xor r15d, r15d
mov qword [rbp - 0x28], r15
mov r14, qword [rbp + 0x58]
mov dword [r14], r15d
cmp qword [r8 + 0x18], 8
jb 0x140073875
mov rdx, qword [r8]
jmp 0x140073878
mov rdx, rbx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov dword [r14], eax
cmp eax, 2
jne 0x1400738f3
cmp qword [rbx + 0x18], 8
jb 0x1400738ab
mov rbx, qword [rbx]
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2011b
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov dword [r14], eax
test eax, eax
sete bl
test eax, eax
jne 0x140073ae7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov r8, r15
mov qword [rbp - 0x10], r15
mov r13, qword [rbp + 0x50]
mov rax, qword [r13]
mov rdi, qword [rax]
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
cmp rdi, rax
je 0x140073a34
mov word [rbp - 0x30], r15w
lea r14, [rdi + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140073933
mov rbx, qword [r14]
jmp 0x140073936
mov rbx, r14
cmp qword [r14 + 0x18], 8
jb 0x140073942
mov rcx, qword [r14]
jmp 0x140073945
mov rcx, r14
mov rax, qword [r14 + 0x10]
lea rcx, [rcx + rax*2]
cmp rbx, rcx
je 0x1400739b4
cmp rbx, rdx
jae 0x140073986
cmp rsi, rbx
ja 0x140073986
mov r15, rbx
sub r15, rsi
sar r15, 1
cmp rdx, r8
jne 0x14007397f
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
movzx eax, word [rsi + r15*2]
jmp 0x1400739a3
cmp rdx, r8
jne 0x1400739a0
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
movzx eax, word [rbx]
mov word [rdx], ax
add rdx, 2
mov qword [rbp - 0x18], rdx
add rbx, 2
jmp 0x140073936
lea rax, [rbp - 0x30]
cmp rax, rdx
jae 0x1400739fa
lea rax, [rbp - 0x30]
cmp rsi, rax
ja 0x1400739fa
lea rbx, [rbp - 0x30]
sub rbx, rsi
sar rbx, 1
cmp rdx, r8
jne 0x1400739ea
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
movzx eax, word [rsi + rbx*2]
mov word [rdx], ax
add rdx, 2
xor r15d, r15d
jmp 0x140073a1f
cmp rdx, r8
jne 0x140073a14
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
xor r15d, r15d
mov word [rdx], r15w
add rdx, 2
mov qword [rbp - 0x18], rdx
mov rdi, qword [rdi]
cmp rdi, qword [r13]
jne 0x140073923
mov r14, qword [rbp + 0x58]
mov word [rbp + 0x58], r15w
lea rax, [rbp + 0x58]
cmp rax, rdx
jae 0x140073a74
lea rax, [rbp + 0x58]
cmp rsi, rax
ja 0x140073a74
lea rbx, [rbp + 0x58]
sub rbx, rsi
sar rbx, 1
cmp rdx, r8
jne 0x140073a6b
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
movzx eax, word [rsi + rbx*2]
mov word [rdx], ax
jmp 0x140073a8e
cmp rdx, r8
jne 0x140073a8a
lea rcx, [rbp - 0x20]
call fcn.140077f38
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
mov word [rdx], r15w
add rdx, 2
sub rdx, rsi
sar rdx, 1
lea eax, [rdx + rdx]
cmp qword [r12 + 0x18], 8
jb 0x140073aa7
mov r12, qword [r12]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 7
mov r8, r12
xor edx, edx
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
nop dword [rax + rax]
mov dword [r14], eax
test eax, eax
sete bl
test rsi, rsi
je 0x140073ae7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140073afc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret