Function at 0x14000caf0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov rsi, rcx
lea r13, vtable.TString_wchar_t__8_.0
mov qword [rsp + 0x70], r13
xor r12d, r12d
mov qword [rbp - 0x7c], r12
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], r12d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x64], r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov r8, rcx
lea rdx, str.HKLMSoftware_sCapabilitiesApplicationDescription
lea rcx, [rsp + 0x70]
call fcn.1400074b0
lea r14, [0x140075940]
mov rcx, r14
mov rax, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
xor r9d, r9d
lea r8d, [r12 + 1]
mov rdx, rbx
call fcn.14000ef50
mov r9, r15
mov r8, rsi
mov rdx, rdi
lea rcx, [0x14000d570]
call fcn.14000d840
mov r8, rsi
lea rdx, str.HKLMSoftwareRegisteredApplications_s
lea rcx, [rsp + 0x70]
call fcn.1400074b0
mov r8, rsi
lea rdx, str.Software_sCapabilities
lea rcx, [rsp + 0x50]
call fcn.1400074b0
mov rdx, r14
mov rax, qword [rsp + 0x58]
test rax, rax
cmovne rdx, rax
mov rcx, r14
mov rax, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
xor r9d, r9d
lea r8d, [r12 + 1]
call fcn.14000ef50
mov qword [rsp + 0x44], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
lea rax, vtable.CModulePathStr.0
mov qword [rsp + 0x30], rax
mov dl, 1
lea rcx, [rbp - 0x60]
call fcn.14000a190
xor r9d, r9d
lea r8, [rbp - 0x60]
mov edx, 0x105
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
nop
mov rcx, rsi
call fcn.140001e80
mov edi, eax
mov edx, dword [rsp + 0x40]
inc edx
add edx, eax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r10, qword [rsp + 0x30]
call qword [r10 + 0x10]
movsxd r8, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rcx, [rcx + r8*2]
mov rdx, rsi
call fcn.140001d20
mov ebx, dword [rsp + 0x40]
add ebx, edi
mov dword [rsp + 0x40], ebx
lea rcx, str..exe.FriendlyAppName
call fcn.140001e80
mov edi, eax
lea edx, [rax + 1]
add edx, ebx
xor r9d, r9d
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r10, qword [rsp + 0x30]
call qword [r10 + 0x10]
movsxd r8, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rcx, [rcx + r8*2]
lea rdx, str..exe.FriendlyAppName
call fcn.140001d20
add dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x38]
test rax, rax
cmovne r14, rax
mov rcx, r15
call fcn.140001e80
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
lea r9d, [r12 + 1]
mov r8, r14
lea rdx, str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
mov qword [rsp + 0x30], r13
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000cd38
cmp dword [rsp + 0x44], r12d
je 0x14000cd33
lea edx, [r12 + 2]
call fcn.140016274
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r13
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cd62
cmp dword [rsp + 0x64], 0
je 0x14000cd5d
mov edx, 2
call fcn.140016274
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000cd86
cmp dword [rbp - 0x7c], 0
je 0x14000cd86
mov edx, 2
call fcn.140016274
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140015a80
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret