Function at 0x10006e118
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x4f0
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rax, qword [0x1000a1180]
xor r12d, r12d
lea rcx, [rsp + 0x40]
mov rbp, r8
mov esi, edx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
call fcn.100065ec4
cmp eax, r12d
mov edi, eax
jge 0x10006e1a2
mov rcx, qword [rsp + 0x40]
lea rbx, [0x1000a1170]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e19b
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, r12d
jg 0x10006e19b
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, edi
jmp 0x10006e486
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov rdx, 0xffffffff80000001
mov r8, rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call fcn.10001474c
cmp eax, r12d
mov edi, eax
jge 0x10006e211
lea rcx, [rbx - 0xc]
lea rbx, [0x1000a1170]
cmp rcx, rbx
je 0x10006e1ff
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, r12d
jg 0x10006e1ff
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x10006e19b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006e19b
mov rax, qword [0x1000a1180]
lea rdx, [0x100006620]
lea rcx, [rsp + 0x48]
mov r8d, esi
mov qword [rsp + 0x48], rax
call fcn.10001646c
mov rdx, qword [rbp]
mov r11d, 0x5c
lea rcx, [rsp + 0x70]
mov word [rsp + 0x4c8], r11w
mov qword [rsp + 0x4d0], r12
mov dword [rsp + 0x4d8], r12d
call fcn.100017cc4
cmp eax, r12d
jne 0x10006e2f3
mov rcx, qword [rsp + 0x4d0]
mov dword [rsp + 0x4d8], r12d
cmp rcx, r12
je 0x10006e290
cmp rcx, 0xffffffffffffffff
je 0x10006e290
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x4d0], r12
mov rcx, qword [rsp + 0x48]
lea rbx, [0x1000a1170]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e2b8
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e2b8
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e2d9
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e2d9
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x10006e2e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x10006e486
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.100017ac8
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r12d
mov edi, eax
lea rbx, [0x1000a1170]
jge 0x10006e3df
mov rdx, qword [rsp + 0x50]
add rdx, 0xfffffffffffffff4
cmp rdx, rbx
je 0x10006e372
or ecx, 0xffffffff
lock xadd dword [rdx], ecx
dec ecx
cmp ecx, r12d
jg 0x10006e372
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x4d0]
mov dword [rsp + 0x4d8], r12d
cmp rcx, r12
je 0x10006e39b
cmp rcx, 0xffffffffffffffff
je 0x10006e39b
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x4d0], r12
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e3bc
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e3bc
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e1ff
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jmp 0x10006e1f8
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e409
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e409
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x4d0]
mov dword [rsp + 0x4d8], r12d
cmp rcx, r12
je 0x10006e432
cmp rcx, 0xffffffffffffffff
je 0x10006e432
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x4d0], r12
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e453
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e453
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x10006e474
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e474
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x10006e484
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.10007a3b0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret