Function at 0x140001fb0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov r14, r9
mov r12, r8
mov r13, rdx
lea rax, vtable.CRegistry.0
mov qword [r11 - 0x60], rax
call fcn.1400049b0
mov rdx, rax
xor r15d, r15d
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002013
mov ecx, 0x80004005
call fcn.1400017b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], 0xffffffff80000001
mov dword [rsp + 0x70], 0x2001f
call fcn.1400049b0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002059
mov ecx, 0x80004005
call fcn.1400017b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, dword [rsp + 0xf0]
lea rdx, [0x14002f2b8]
lea rcx, [rsp + 0x58]
call fcn.140004080
mov rbx, qword [r12]
mov qword [rsp + 0x78], r13
lea rcx, [rsp + 0x80]
call fcn.1400015c0
test rbx, rbx
jne 0x1400020a8
mov ecx, r15d
or rsi, 0xffffffffffffffff
jmp 0x1400020bd
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.1400017d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002144
mov eax, dword [rsp + 0x70]
cmp eax, 0x20019
je 0x14000213d
mov dword [rsp + 0x50], 0xffffffff
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140002144
mov rbx, qword [rsp + 0x58]
jmp 0x14000218f
xor eax, eax
mov rcx, rsi
mov rbx, qword [rsp + 0x58]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000218f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], r15
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400021aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rax, vtable.CRegistry.0
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400021cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], r15
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400021ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000220d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140002228
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x14000224c
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret