Function at 0x140006620
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov rax, qword [0x140018060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
lea rcx, [0x140002ff8]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x140006699
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
lea rdx, [0x140003020]
movzx ebx, ax
lea rcx, [0x140003080]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000b738
jmp 0x140006702
lea rdx, [0x1400030a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x80070000
mov rbx, rax
test rax, rax
jne 0x1400066d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003020]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
jmp 0x1400066ed
mov rcx, rax
call qword [fcn.140004970]
call rbx
mov ebx, eax
test eax, eax
jns 0x1400066f9
mov r8d, eax
lea rdx, [0x1400030c0]
lea rcx, [0x140003080]
call fcn.14000b738
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
js 0x140006a3c
lea rdx, [rsp + 0x60]
lea rcx, [0x140002b08]
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x14000673e
lea rdx, [0x140003130]
lea rcx, [0x140003180]
call fcn.14000b738
mov ebx, 0x80004005
test ebx, ebx
js 0x140006a3c
mov esi, 0x104
lea r8, [0x140003868]
lea rcx, [rbp - 0x50]
mov edx, esi
call fcn.140004fec
mov ebx, eax
test eax, eax
js 0x140006a21
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140004f08
mov ebx, eax
test eax, eax
js 0x140006a21
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000685c
mov rcx, qword [rsp + 0x50]
lea rax, str.Internet_Explorer_ETW_Collector_Service
lea rdx, [0x140003860]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x50
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006832
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, [0x140002850]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x4e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000684f
lea rcx, [0x1400031a0]
jmp 0x140006839
lea rcx, [0x140003220]
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000b738
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006879
movzx ebx, ax
lea rdx, [rbp - 0x50]
lea rcx, [0x1400032a0]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000b738
test ebx, ebx
js 0x140006a21
lea r8, [0x140003310]
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140004fec
mov ebx, eax
test eax, eax
js 0x140006a21
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140004f08
mov ebx, eax
test eax, eax
js 0x140006a21
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006a00
mov rcx, qword [rsp + 0x50]
lea rax, str.IEEtwCollectorService
lea rdx, [0x140003320]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x2c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400069f7
mov rcx, qword [rsp + 0x50]
lea rax, [0x140019490]
mov esi, 0x90
lea rdx, [0x140003340]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400069ee
mov rcx, qword [rsp + 0x50]
lea rax, [0x140019400]
lea rdx, [0x140003368]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400069e5
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x28], r9d
lea rdx, [0x140003390]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400069d7
lea rcx, [0x1400033c0]
jmp 0x140006a07
lea rcx, [0x140003460]
call fcn.14000b738
jmp 0x140006a1d
lea rcx, [0x1400034d0]
jmp 0x140006a07
lea rcx, [0x140003570]
jmp 0x140006a07
lea rcx, [0x140003610]
jmp 0x140006a07
lea rcx, [0x1400032a0]
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.14000b738
test ebx, ebx
jns 0x140006a3c
lea rdx, [0x1400036a0]
lea rcx, [0x140003080]
mov r8d, ebx
call fcn.14000b738
call fcn.140006a6c
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000b200
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret