Function at 0x7fff25d6b61c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
xor ecx, ecx
mov r14, r9
mov qword [rbp - 0x20], rcx
mov r13d, r8d
mov qword [rbp - 8], rcx
mov r15d, ecx
mov qword [rbp - 0x10], rcx
mov r12d, ecx
lea edx, [rcx + 2]
test rbx, rbx
je 0x7fff25d6b79e
movzx eax, word [rbx]
test al, 1
jne 0x7fff25d6b79e
test ax, ax
je 0x7fff25d6b683
cmp qword [rbx + 8], rcx
je 0x7fff25d6b79e
mov qword [rbp - 0x18], rdi
mov rsi, rdi
test ax, ax
je 0x7fff25d6b695
sub ax, dx
mov word [rbx], ax
cmp rdi, 0xffffffff80000004
je 0x7fff25de5799
cmp rdi, 0xffffffff80000050
je 0x7fff25de5799
cmp rdi, 0xffffffff80000060
je 0x7fff25de5799
call fcn.7fff25dd0fbc
test al, al
je 0x7fff25de5691
call fcn.7fff25dd0fbc
test al, al
je 0x7fff25de5691
lea r9, [rbp - 0x20]
mov r8d, r13d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ext_ms_win_kernel32_registry_l1_1_0.dll_TermsrvGetPreSetValue]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25de567c
and qword [rbp - 0x20], r12
mov r13d, dword [rbp + 0x60]
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ext_ms_win_kernel32_registry_l1_1_0.dll_TermsrvSetValueKey]
nop dword [rax + rax]
cmp qword [rbp - 0x20], r12
jne 0x7fff25de569a
mov eax, edi
and eax, 2
mov dword [rbp + 0x48], eax
jne 0x7fff25d6b7bc
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov r14d, eax
test r15, r15
jne 0x7fff25de56f5
test byte [0x7fff25fd28b0], 1
jne 0x7fff25de571b
mov ecx, r14d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rbx + 8], rcx
jne 0x7fff25d6b7b5
cmp word [rbx], dx
jne 0x7fff25d6b7b5
mov eax, edx
cmp word [rbx + 2], cx
je 0x7fff25d6b683
mov eax, 0x57
jmp 0x7fff25d6b785
lea rax, [rbp - 8]
mov r8d, 0x2000000
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rdi
xor ecx, ecx
call fcn.7fff25da7558
test eax, eax
js 0x7fff25d6b7f3
mov r15, qword [rbp - 8]
mov r12, qword [rbp - 0x10]
test r15, r15
je 0x7fff25d6b73a
jmp 0x7fff25de56e5
mov ecx, eax
jmp 0x7fff25d6b779
mov rax, qword [rbp - 0x20]
mov r13d, dword [rax + 8]
lea r14, [rax + 0xc]
mov qword [rbp + 0x58], r14
jmp 0x7fff25d6b6ff
mov r13d, dword [rbp + 0x60]
jmp 0x7fff25d6b722
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x20]
mov ebx, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebx
jmp 0x7fff25d6b779
test r12, r12
cmovne rsi, r15
mov qword [rbp - 0x18], rsi
jmp 0x7fff25d6b73a
test r12, r12
je 0x7fff25d6b769
mov rcx, r15
cmp r15, rdi
jne 0x7fff25de5709
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d6b769
cmp r14d, 0xc0000022
jne 0x7fff25d6b776
cmp rsi, r12
jne 0x7fff25d6b776
cmp dword [rbp + 0x48], 0
je 0x7fff25d6b776
lea rdx, [rbp - 0x18]
mov rcx, rdi
call 0x7fff25e5187c
test eax, eax
js 0x7fff25de578f
mov rax, qword [rbp + 0x58]
xor r8d, r8d
mov r9d, dword [rbp + 0x50]
mov rdx, rbx
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x18]
mov r14d, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test r14d, r14d
jns 0x7fff25d6b776
mov eax, 5
jmp 0x7fff25d6b785
call fcn.7fff25dcefc8
test al, al
je 0x7fff25de57cd
mov eax, dword [rbp + 0x60]
mov r9d, r13d
mov rdx, qword [rbx + 8]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ext_ms_win_advapi32_registry_l1_1_0.dll_PerfRegSetValue]
nop dword [rax + rax]
nop
jmp 0x7fff25d6b785
mov eax, 6
jmp 0x7fff25d6b785