Function at 0x140017288
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13d, r9d
mov rdi, rdx
mov r14, rcx
xor r15d, r15d
mov ebx, r15d
mov dword [rbp + 0x110], ebx
test rdx, rdx
je 0x14001777e
mov r12d, dword [rbp + 0x120]
mov rcx, r14
call fcn.140017a30
mov esi, eax
test eax, eax
js 0x140017783
lea rcx, [rdi + 0x48]
call fcn.140019a38
test al, al
je 0x140017359
call fcn.140018f54
test eax, eax
jne 0x140017359
call fcn.140015f1c
test al, al
je 0x14001732a
lea rdx, str.SystemSetting
mov rcx, qword [rdi + 0x28]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14001732a
mov rdx, rdi
mov rcx, r14
call fcn.140017034
mov rcx, qword [rdi + 0x48]
call fcn.14001a1fc
mov rdi, rax
xor r15d, r15d
test rax, rax
je 0x14001734f
mov r12d, r15d
mov r13d, r15d
mov ebx, r15d
mov dword [rbp + 0x110], ebx
jmp 0x1400172da
mov eax, 0x8007000e
jmp 0x140017783
mov r15, qword [rdi + 0x18]
lea rdx, str.SystemSetting
mov rcx, qword [rdi + 0x28]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400174d6
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wtoi]
cmp eax, 0x16
jae 0x14001777a
mov r9d, dword [r14 + 0xf4]
xor r8d, r8d
mov edx, eax
mov rcx, rdi
call fcn.14001aafc
mov esi, eax
xor r13d, r13d
test eax, eax
js 0x14001777a
call fcn.140018f54
test eax, eax
je 0x1400173e1
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000342c
lea r11, [rax + 0x18]
mov qword [rbp + 0x108], r11
lea ebx, [r13 + 1]
mov rdx, r11
mov rcx, r14
call fcn.140019e1c
test rax, rax
je 0x1400173e8
mov r12b, bl
jmp 0x1400173eb
mov r11, qword [rbp + 0x108]
mov r12b, r13b
or r15d, 0xffffffff
test bl, 1
je 0x140017417
lea rdx, [r11 - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140017417
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
test r12b, r12b
je 0x1400174b9
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000342c
lea r11, [rax + 0x18]
mov rdx, r11
lea rcx, [r14 + 0x30]
call fcn.140019e1c
mov rbx, rax
lea rdx, [r11 - 0x18]
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x140017462
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400200f0]
test rbx, rbx
jne 0x1400174ac
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000342c
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
mov rdx, rbx
lea rcx, [r14 + 0x30]
call fcn.140019c48
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400174ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
mov rcx, r14
call fcn.140018394
jmp 0x14001777a
call fcn.140015f1c
test al, al
je 0x14001777a
mov rdx, rdi
mov rcx, r14
call fcn.140017034
jmp 0x14001777a
test r15, r15
jne 0x1400174e5
mov eax, 0x80004005
jmp 0x140017783
test r12d, r12d
jne 0x140017615
lea rdx, [0x140021f00]
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
xor r12d, r12d
test eax, eax
je 0x140017618
call fcn.140018f54
test eax, eax
je 0x1400175ea
call fcn.140015ddc
test eax, eax
jne 0x1400175ea
cmp dword [rdi + 0x40], r12d
jne 0x14001754f
test r13d, r13d
je 0x14001753f
lea r8d, [r12 + 1]
mov rdx, rdi
call fcn.140018aec
jmp 0x1400175e3
mov r8, rdi
mov rdx, r15
call fcn.140018878
jmp 0x1400175e3
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 1
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionAccessibilityTemp
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x58]
call fcn.140010e4c
test eax, eax
je 0x14001759b
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400175de
jmp 0x1400175d8
mov dword [rbp + 0x110], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rdi]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400175de
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140019f64
xor eax, eax
jmp 0x140017783
cmp dword [rdi + 0x40], r12d
jne 0x140017606
call fcn.140018f54
test eax, eax
je 0x140017606
xor r8d, r8d
mov rdx, rdi
call fcn.140018aec
jmp 0x140017611
mov r8, rdi
mov rdx, r15
call fcn.140018878
mov esi, eax
jmp 0x140017630
xor r12d, r12d
lea rdx, [0x140021f00]
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140017630
call fcn.14001b76c
test esi, esi
js 0x14001777a
call qword [sym.imp.ntdll.dll_WinSqmIsOptedIn]
test eax, eax
je 0x1400176a0
mov rbx, qword [rdi + 0x18]
test rbx, rbx
je 0x1400176a0
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea rcx, [rax + 2]
test rax, rax
cmovne rbx, rcx
test rbx, rbx
je 0x140017676
cmp word [rbx], r12w
je 0x140017676
mov qword [rsp + 0x50], rbx
jmp 0x140017682
lea rax, str._null_
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 2
lea r9, [rsp + 0x48]
mov edx, 0x107d
xor ecx, ecx
lea r8d, [rcx + 1]
call qword [sym.imp.ntdll.dll_WinSqmAddToStream]
call fcn.140018f54
test eax, eax
je 0x14001777a
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000342c
lea r11, [rax + 0x18]
mov rdx, r11
lea rcx, [r14 + 0x30]
call fcn.140019e1c
mov rbx, rax
lea rdx, [r11 - 0x18]
or r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
xor r13d, r13d
test ecx, ecx
jg 0x1400176f6
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400200f0]
test rbx, rbx
jne 0x14001773f
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000342c
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
mov rdx, rbx
lea rcx, [r14 + 0x30]
call fcn.140019c48
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001773f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
mov rcx, r14
call fcn.140018394
cmp dword [rdi + 0x44], r13d
jne 0x140017753
cmp dword [rdi + 0x40], r13d
jne 0x14001777a
lea rcx, [rbp - 0x70]
call fcn.1400169bc
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14001ca38
nop
lea rcx, [rbp - 0x70]
call fcn.140016a04
mov eax, esi
jmp 0x140017783
mov eax, 0x80070057
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret