Function at 0x1402d1968
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov r13, rdx
mov r12, rcx
lea rdx, str.CLSID645FF040_5081_101B_9F08_00AA002F954EShell
lea rcx, [rbp - 0x40]
call fcn.14000cb18
nop
lea r8, [0x140352420]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.14001c3e0
nop
mov r8, r13
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140004278
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or r14d, 0xffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d19ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor ebx, ebx
mov ecx, 0x2001f
call fcn.140223ed8
mov edi, eax
mov r9d, eax
mov r8, qword [rbp + 0x48]
test esi, esi
mov rsi, 0xffffffff80000000
mov rdx, rsi
je 0x1402d1bbb
add r12, 8
mov rcx, r12
call fcn.1400114d4
test eax, eax
je 0x1402d1a40
mov r9d, edi
mov r8, qword [rbp + 0x48]
mov rdx, rsi
mov rcx, r12
call fcn.140010dd0
mov ebx, eax
test eax, eax
jne 0x1402d1c0b
mov r13d, 1
mov dword [rbp + 0x40], r13d
lea r9d, [r13 + 3]
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CCRBType
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1402d1c0b
lea r8, [0x140366628]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x28]
call fcn.14001c3e0
mov r9d, edi
mov r8, qword [rax]
mov rdx, rsi
mov rcx, r12
call fcn.1400114d4
mov ebx, eax
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x1402d1ac2
mov rcx, qword [rdx]
mov r9, qword [rcx]
call qword [r9 + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x1402d1b15
lea r8, [0x140366628]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14001c3e0
mov r9d, edi
mov r8, qword [rax]
mov rdx, rsi
mov rcx, r12
call fcn.140010dd0
mov ebx, eax
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1b0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x1402d1c0b
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.1402d1758
nop
lea r8, str.__AUTO
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.14001c3e0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1b55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rbp - 0x38]
xor eax, eax
test rdi, rdi
setne al
test eax, eax
jne 0x1402d1b6a
lea ebx, [rax + 0xd]
jmp 0x1402d1b9d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x140330de8]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rdi, qword [rbp - 0x38]
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1c0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1402d1c0b
lea rcx, [r12 + 8]
call fcn.1400114d4
test eax, eax
jne 0x1402d1c0b
mov r8d, edi
lea rdx, str.command
mov rcx, qword [r12 + 8]
call fcn.140223e38
test eax, eax
jne 0x1402d1c0b
mov r9d, edi
mov r8, qword [rbp - 0x40]
mov rdx, rsi
lea rcx, [r12 + 8]
call fcn.1400114d4
test eax, eax
jne 0x1402d1c0b
mov r8d, edi
mov rdx, qword [r13]
mov rcx, qword [r12 + 8]
call fcn.140223e38
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1c2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402d1c4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret