Function at 0x140017e7c
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rdi
mov rax, qword [0x1400a2318]
xor rax, rbp
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x20], r9
mov r15, r8
mov qword [rbp], r8
mov r13, rdx
mov qword [rbp + 0x18], rdx
mov r12, rcx
mov qword [rbp + 0x30], rcx
xor edi, edi
mov qword [rbp + 0x10], rdi
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140017f63
mov rdx, rax
mov rcx, r12
call fcn.14001bf50
mov ebx, eax
test eax, eax
js 0x1400182da
lea r14, [0x1400629f0]
movsxd rbx, edi
mov rcx, rsi
cmp rbx, 3
jae 0x140018323
mov rdx, qword [r14]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140017f2b
inc edi
add r14, 0x10
jmp 0x140017f00
add rbx, rbx
lea rax, [0x1400629f0]
movzx r14d, word [rax + rbx*8 + 8]
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140017f6d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, 0x8007000e
jmp 0x1400182ea
mov rcx, r12
call fcn.14001ec3c
mov rdx, rdi
mov rcx, r12
call fcn.14001bf50
mov ebx, eax
xor ecx, ecx
test eax, eax
js 0x1400182cb
mov dword [rbp + 8], ecx
cmp r14w, 8
je 0x1400180e7
cmp r14w, 0x11
je 0x140017fed
cmp r14w, 0x13
jne 0x1400182b9
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
nop dword [rax + rax]
mov eax, dword [rbp + 8]
mov dword [rbp], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov rdx, r15
mov rcx, qword [r13]
jmp 0x1400180d3
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x140017ff1
test bl, 1
jne 0x140018110
mov eax, ebx
cdq
mov ecx, 2
idiv ecx
movsxd r13, eax
cmp r13, 0x400
ja 0x14001804b
mov rcx, r13
call fcn.14001f388
test al, al
je 0x14001804b
lea rax, [r13 + 0xf]
cmp rax, r13
ja 0x140018038
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14005d830
sub rsp, rax
lea r15, [rsp + 0x30]
jmp 0x14001805a
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.140018370
mov r15, rax
test r15, r15
je 0x140018110
mov r8, r13
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
xor eax, eax
mov r11d, eax
movsxd rbx, ebx
test rbx, rbx
jle 0x1400180b8
mov r10d, eax
movzx ecx, word [rdi + r10*2]
call fcn.140018b80
movzx r8d, al
mov ecx, r11d
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
mov cl, al
shl r8d, cl
mov ecx, r11d
shr rcx, 1
or byte [rcx + r15], r8b
inc r11d
inc r10
cmp r10, rbx
jl 0x140018080
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
mov r9d, 3
mov rdx, qword [rbp]
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
jmp 0x1400182b9
mov r13, rdi
mov r14, rcx
or rbx, 0xffffffffffffffff
cmp byte [rbp + 0x90], cl
je 0x14001826b
mov rax, rbx
inc rax
cmp word [rdi + rax*2], cx
jne 0x140018100
cmp eax, 0xffe
jle 0x140018138
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, 0x80004005
jmp 0x1400182ea
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
xor eax, eax
test r14, r14
jne 0x140018167
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x140017f54
mov qword [rbp + 0x28], rax
lea rdx, [0x140068d18]
mov rcx, qword [r12 + 8]
call fcn.14001edec
mov r12, rax
test rax, rax
je 0x14001825c
mov rdx, rax
mov rcx, rdi
call fcn.14001eea0
mov r15, rax
test rax, rax
je 0x140018258
cmp rax, qword [rbp + 0x20]
je 0x1400181c1
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevW]
nop dword [rax + rax]
cmp word [rax], 0x22
je 0x140018258
xor r13d, r13d
mov word [r14], r13w
mov r8, r15
sub r8, rdi
sar r8, 1
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
lea r8, [0x140068d28]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov r8, r12
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea r8, [0x140068d28]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rax, rbx
inc rax
cmp word [r12 + rax*2], r13w
jne 0x140018233
lea r8, [r15 + rax*2]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov r13, r14
mov r15, qword [rbp]
lea rcx, [rbp + 0x28]
call fcn.140016cf4
mov r12, qword [rbp + 0x30]
xor ecx, ecx
inc rbx
cmp word [r13 + rbx*2], cx
jne 0x14001826b
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test r14, r14
je 0x1400182b9
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x20]
mov rcx, r12
call fcn.14001bf50
mov ebx, eax
test eax, eax
jns 0x1400182f7
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
lea rcx, [rbp + 0x10]
call fcn.140016cf4
mov eax, ebx
jmp 0x14001833e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
lea rcx, [rbp + 0x10]
call fcn.140016cf4
xor eax, eax
jmp 0x14001833e
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
lea rcx, [rbp + 0x10]
call fcn.140016cf4
mov eax, 0x80020009
mov rcx, qword [rbp + 0x38]
xor rcx, rbp
call fcn.1400149c0
mov rbx, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x80]
lea rsp, [rbp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret