Function at 0x140027844
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov rax, qword [0x14015d3e0]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov r13, rcx
mov qword [rbp + 0x10], rcx
mov edi, 0x2000
mov qword [rbp + 0x28], r9
xor r15d, r15d
mov qword [rbp + 0x18], r8
mov ecx, edi
mov qword [rbp + 0x20], rdx
mov r12, r8
mov qword [rbp + 0x30], r15
mov r14, rdx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140027b70
mov rdx, rax
mov rcx, r13
call fcn.14002a18c
mov ebx, eax
mov rcx, rsi
test eax, eax
js 0x140027d72
lea rdx, [rbp]
call fcn.14002d8ec
test eax, eax
jne 0x1400278fa
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, 0x80020009
jmp 0x140027d9e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140027b61
mov rcx, r13
call fcn.14002ce50
mov rdx, rdi
mov rcx, r13
call fcn.14002a18c
mov ebx, eax
test eax, eax
jns 0x140027936
mov rcx, rdi
jmp 0x140027d63
movzx eax, word [rbp]
mov dword [rbp + 8], r15d
cmp eax, 8
je 0x140027ae4
cmp eax, 0x11
je 0x1400279a4
cmp eax, 0x13
jne 0x140027d4e
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
nop dword [rax + rax]
mov eax, dword [rbp + 8]
mov r9d, 4
mov rcx, qword [r14]
xor r8d, r8d
mov dword [rbp], eax
mov rdx, r12
lea rax, [rbp]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
jmp 0x140027d4e
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x1400279a8
test bl, 1
jne 0x140027b0f
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
movsxd r12, eax
cmp r12, 0x400
ja 0x140027a04
mov rcx, r12
call fcn.14002dc04
test al, al
je 0x140027a04
lea rax, [r12 + 0xf]
cmp rax, r12
ja 0x1400279f1
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140017ef0
sub rsp, rax
lea r15, [rsp + 0x30]
jmp 0x140027a13
mov rdx, r12
lea rcx, [rbp + 0x30]
call fcn.140027de0
mov r15, rax
test r15, r15
je 0x140027b0f
mov r8, r12
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
xor eax, eax
movsxd r11, ebx
mov r10d, eax
test ebx, ebx
jle 0x140027ab3
xor r13d, r13d
lea ebx, [rax + 2]
mov r9d, r13d
movzx r8d, word [rdi + r9*2]
cmp r8w, 0x30
jb 0x140027a7f
cmp r8w, 0x39
jbe 0x140027a79
cmp r8w, 0x40
jbe 0x140027a7f
cmp r8w, 0x46
jbe 0x140027a73
cmp r8w, 0x60
jbe 0x140027a7f
cmp r8w, 0x66
ja 0x140027a7f
sub r8b, 0x57
jmp 0x140027a82
sub r8b, 0x37
jmp 0x140027a82
sub r8b, 0x30
jmp 0x140027a82
mov r8b, r13b
mov eax, r10d
mov ecx, r10d
cdq
and ecx, 1
idiv ebx
shl ecx, 2
inc r10d
movsxd rdx, eax
inc r9
mov eax, 4
sub eax, ecx
mov cl, al
shl r8b, cl
or byte [rdx + r15], r8b
cmp r9, r11
jl 0x140027a3e
mov r13, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rcx, r14
mov dword [rsp + 0x28], r12d
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor r15d, r15d
jmp 0x140027d4e
xor ecx, ecx
or rbx, 0xffffffffffffffff
mov r15, rdi
mov r14d, ecx
cmp byte [rbp + 0xa0], cl
je 0x140027cfe
mov rax, rbx
inc rax
cmp word [rdi + rax*2], cx
jne 0x140027aff
cmp eax, 0xffe
jle 0x140027b37
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, 0x80004005
jmp 0x140027d9e
mov ecx, 0x2000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
xor eax, eax
test r14, r14
jne 0x140027b7a
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, 0x8007000e
jmp 0x140027d9e
mov r15, qword [r13 + 8]
mov qword [rbp + 0x40], rax
lea rax, [r15 + 0x10]
mov rcx, rax
mov qword [rbp + 0x38], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r13d, r13d
mov r12d, r13d
mov qword [rbp], r13
cmp dword [r15 + 8], r13d
jle 0x140027bde
mov rax, qword [r15]
lea rdx, [0x140104870]
mov rcx, qword [rax + r13]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140027cd2
inc r12d
add r13, 8
cmp r12d, dword [r15 + 8]
jl 0x140027ba9
xor r13d, r13d
mov r15, r13
lea rcx, [rbp]
call fcn.140026d14
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
test r15, r15
je 0x140027ce8
mov rdx, r15
mov rcx, rdi
call fcn.14002cf90
mov r12, rax
test rax, rax
je 0x140027ce8
cmp rax, qword [rbp + 0x28]
je 0x140027c3c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharPrevW]
nop dword [rax + rax]
cmp word [rax], 0x22
je 0x140027ce8
mov r8, r12
mov word [r14], r13w
sub r8, rdi
mov rdx, rdi
sar r8, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
lea r8, [0x140104974]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov r8, r15
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea r8, [0x140104974]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rax, rbx
inc rax
cmp word [r15 + rax*2], r13w
jne 0x140027cab
lea r8, [r12 + rax*2]
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov r15, r14
jmp 0x140027ceb
mov rax, qword [r15]
xor r13d, r13d
movsxd rcx, r12d
mov rcx, qword [rax + rcx*8]
mov r15, qword [rcx + 8]
jmp 0x140027be1
mov r15, rdi
lea rcx, [rbp + 0x40]
call fcn.140026d14
mov r13, qword [rbp + 0x10]
xor ecx, ecx
mov r12, qword [rbp + 0x18]
inc rbx
cmp word [r15 + rbx*2], cx
jne 0x140027cfe
mov rcx, qword [rbp + 0x20]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r12
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor r15d, r15d
test r14, r14
je 0x140027d4e
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x28]
mov rcx, r13
call fcn.14002a18c
mov ebx, eax
mov rcx, rdi
test eax, eax
jns 0x140027d80
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x140027d9e
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebx, r15d
lea rcx, [rbp + 0x30]
call fcn.140026d14
mov eax, ebx
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.1400164a0
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret