Function at 0x14000d470
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp], rax
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov bl, 1
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
lea r8d, [r14 + 0x2a]
lea rdx, [0x1400370f0]
lea rcx, [rbp - 0x50]
call fcn.14000c2e0
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], 2
mov byte [rsp + 0x78], r14b
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x74], eax
test eax, eax
jne 0x14000d549
cmp dword [rsp + 0x60], 1
jne 0x14000d54e
mov byte [rsp + 0x78], bl
jmp 0x14000d54e
mov qword [rsp + 0x68], r14
cmp qword [rbp - 0x38], 8
jb 0x14000d58b
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000d58b
cmp qword [0x140045d10], 0
jne 0x14000d57e
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d58b
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [0x140045d10]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
lea rdi, [0x140043f58]
mov rdx, rdi
lea rcx, [r13 + 0x28]
call fcn.140010c30
mov qword [rsp + 0x58], rax
mov rcx, qword [r13 + 0x30]
mov esi, 1
or r15, 0xffffffffffffffff
cmp rax, rcx
je 0x14000d664
lea rdx, [rax + 0x18]
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000d5ed
mov rdx, qword [rdx]
cmp qword [0x140043f70], 8
cmovae rdi, qword [0x140043f58]
mov r8, r9
mov r10, qword [0x140043f68]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x14000d636
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x14000d62a
add rdi, 2
add rdx, 2
dec r8
jne 0x14000d613
jmp 0x14000d636
mov r8d, esi
cmp word [rdi], ax
cmovb r8d, r15d
jmp 0x14000d639
mov r8d, r14d
movsxd rax, r8d
test r8d, r8d
jne 0x14000d654
cmp r10, r9
jae 0x14000d64b
mov eax, r15d
jmp 0x14000d654
mov eax, r14d
cmp r10, r9
setne al
test eax, eax
sets al
test al, al
jne 0x14000d664
lea rax, [rsp + 0x58]
jmp 0x14000d66e
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x50]
mov rax, qword [rax]
cmp rax, qword [r13 + 0x30]
je 0x14000d6c8
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000bb50
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d6c6
mov dword [rsp + 0x28], 0x12
lea rax, str.19728374
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
lea rdx, str.UPDMPA
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x74], eax
test eax, eax
sete bl
jmp 0x14000d6c8
xor bl, bl
lea rdi, [0x140043fa8]
mov rdx, rdi
lea rcx, [r13 + 0x28]
call fcn.140010c30
mov qword [rsp + 0x50], rax
mov rcx, qword [r13 + 0x30]
cmp rax, rcx
je 0x14000d776
lea rdx, [rax + 0x18]
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000d6ff
mov rdx, qword [rdx]
cmp qword [0x140043fc0], 8
cmovae rdi, qword [0x140043fa8]
mov r8, r9
mov r10, qword [0x140043fb8]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x14000d748
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x14000d73c
add rdi, 2
add rdx, 2
dec r8
jne 0x14000d725
jmp 0x14000d748
mov r8d, esi
cmp word [rdi], ax
cmovb r8d, r15d
jmp 0x14000d74b
mov r8d, r14d
movsxd rax, r8d
test r8d, r8d
jne 0x14000d766
cmp r10, r9
jae 0x14000d75d
mov eax, r15d
jmp 0x14000d766
mov eax, r14d
cmp r10, r9
setne al
test eax, eax
sets al
test al, al
jne 0x14000d776
lea rax, [rsp + 0x50]
jmp 0x14000d780
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x58]
mov rax, qword [rax]
cmp rax, qword [r13 + 0x30]
je 0x14000d87e
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000bb50
cmp qword [rbp - 0x68], 0
je 0x14000d87e
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
mov r8d, 6
lea rdx, str.Policy
lea rcx, [rbp - 0x28]
call fcn.14000c2e0
lea r11, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r11, qword [rbp - 0x78]
lea rdx, [rbp - 0x28]
mov rax, qword [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, rax
mov r10, qword [rsp + 0x68]
test r10, r10
je 0x14000d843
xor eax, eax
mov rcx, r15
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
mov r9d, esi
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x74], eax
test eax, eax
sete al
test al, al
je 0x14000d83f
test bl, bl
je 0x14000d83f
movzx ebx, sil
mov rax, qword [rbp - 0x28]
jmp 0x14000d845
mov rax, qword [rbp - 0x28]
xor bl, bl
cmp qword [rbp - 0x10], 8
jb 0x14000d87e
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000d87e
cmp qword [0x140045d10], 0
jne 0x14000d871
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d87e
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x140045d10]
lea rdi, [0x140043f80]
mov rdx, rdi
lea rcx, [r13 + 0x28]
call fcn.140010c30
mov qword [rsp + 0x50], rax
mov rcx, qword [r13 + 0x30]
cmp rax, rcx
je 0x14000d92a
lea rdx, [rax + 0x18]
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000d8b5
mov rdx, qword [rdx]
cmp qword [0x140043f98], 8
cmovae rdi, qword [0x140043f80]
mov r8, r9
mov r10, qword [0x140043f90]
cmp r10, r9
cmovb r8, r10
test r8, r8
je 0x14000d8fd
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x14000d8f7
add rdi, 2
add rdx, 2
dec r8
jne 0x14000d8e0
jmp 0x14000d8fd
cmovb esi, r15d
jmp 0x14000d900
mov esi, r14d
movsxd rax, esi
test esi, esi
jne 0x14000d91a
cmp r10, r9
jae 0x14000d911
mov eax, r15d
jmp 0x14000d91a
mov eax, r14d
cmp r10, r9
setne al
test eax, eax
sets al
test al, al
jne 0x14000d92a
lea rax, [rsp + 0x50]
jmp 0x14000d934
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x58]
mov rax, qword [rax]
cmp rax, qword [r13 + 0x30]
je 0x14000d96a
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000bb50
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d96a
lea rdx, str.UPDMPA
call fcn.1400171e0
mov dword [rsp + 0x74], eax
cmp qword [rbp - 0x60], 8
jb 0x14000d9a7
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000d9a7
cmp qword [0x140045d10], 0
jne 0x14000d99a
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d9a7
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x140045d10]
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d9c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret