Function at 0x14002da40
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rdi, r9
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1400a9028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x3c], r8d
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], 0
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x70]
cmp rax, 7
ja 0x14002dabc
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x70], 0
jmp 0x14002dac7
mov rdx, rsi
mov r9, rbx
call fcn.14005c1a0
movzx eax, word [rsp + 0x70]
mov rcx, qword [rsp + 0x72]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x66], rcx
movups xmm0, xmmword [rsp + 0x80]
mov word [rsp + 0x70], ax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x66]
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x78], rcx
movups xmmword [rsp + 0x80], xmm0
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rbx
call fcn.14005c1a0
test rdi, rdi
je 0x14002dbc8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x14002dcbc
lea rdx, [rax + 1]
mov qword [rsp + 0x50], rdx
cmp rcx, 8
jb 0x14002db67
mov rbx, qword [rsp + 0x40]
mov word [rbx + rax*2], 0x5c
mov word [rbx + rax*2 + 2], 0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
sub rdx, rcx
cmp rdx, rax
jb 0x14002dce0
lea rsi, [rcx + rax]
mov qword [rsp + 0x50], rsi
cmp rbx, 8
jb 0x14002dbab
mov rbx, qword [rsp + 0x40]
jmp 0x14002dbb0
lea rbx, [rsp + 0x40]
lea rcx, [rbx + rcx*2]
add rax, rax
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2], 0
cmp qword [rsp + 0x88], 8
jb 0x14002dbda
mov r8, qword [rsp + 0x70]
jmp 0x14002dbdf
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x58], 8
jb 0x14002dbee
mov rdx, qword [rsp + 0x40]
jmp 0x14002dbf3
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, 0xffffffff80000001
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14002dc40
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rdx, str.RegistrySetValueDword
mov ecx, esi
mov r8d, 0x127
call fcn.14002fad0
jmp 0x14002dc42
xor esi, esi
mov dword [r14], esi
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14002dc6f
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002dcfa
call fcn.140058840
mov rax, qword [rsp + 0x88]
cmp rax, 8
jb 0x14002dc9c
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002dd1d
call fcn.140058840
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140059960
mov rax, r14
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 1
lea r9, [0x1400a19f2]
lea rcx, [rsp + 0x40]
mov edx, 1
call fcn.14005c050
jmp 0x14002db74
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
mov rdx, rax
mov r9, rdi
call fcn.14005c050
jmp 0x14002dbc8
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002dd40
add rax, rax
add rax, 0x29
mov rdx, rax
jmp 0x14002dc6a
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002dd40
add rax, rax
add rax, 0x29
mov rdx, rax
jmp 0x14002dc97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3