Function at 0x14001c2e8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140074518]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov edx, 0x131
mov rdi, r8
mov r8d, dword [0x140078090]
xor r14d, r14d
mov rsi, r9
mov ecx, r8d
lea r9d, [rdx + 2]
test r8d, r8d
je 0x14001c34b
sub ecx, 2
je 0x14001c344
cmp ecx, 1
jne 0x14001c350
mov edx, r9d
jmp 0x14001c350
mov edx, 0x132
jmp 0x14001c350
mov edx, 0x130
movzx ebx, di
cmp edx, ebx
je 0x14001c714
cmp dword [0x140078b18], 1
mov r11d, 0x12e
mov r13d, 4
lea r10d, [r11 + 9]
jne 0x14001c3ae
movzx eax, bx
sub ax, r11w
cmp ax, r13w
jbe 0x14001c714
cmp bx, r10w
je 0x14001c714
mov ecx, 0x3c5
movzx eax, bx
sub ax, cx
cmp ax, 0xe
ja 0x14001c3ae
mov ecx, 0x4501
bt ecx, eax
jb 0x14001c714
mov ecx, 0x2710
movzx eax, bx
sub ax, cx
mov edx, 3
cmp ax, dx
ja 0x14001c46c
cmp byte [0x140078096], r14b
jne 0x14001c3d5
call fcn.14001c920
mov rcx, qword [0x1400780e0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x3cd
mov dword [rsp + 0x20], r14d
mov rcx, rax
or r9d, 0xffffffff
lea r8d, [rdx + 6]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov rcx, qword [0x1400780e0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x2710
mov dword [rsp + 0x20], r14d
mov rcx, rax
mov r9d, ebx
lea r8d, [rdx + 3]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov rax, qword [0x1400780f0]
mov r9, rsi
mov r8, rdi
mov edx, 0x111
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
lea eax, [rbx - 0x2710]
mov dword [0x140078b1c], eax
call fcn.14001c1d4
jmp 0x14001c714
cmp ebx, r9d
ja 0x14001c5ee
je 0x14001c4a2
sub ebx, r11d
je 0x14001c59f
sub ebx, 1
je 0x14001c4bd
sub ebx, 1
je 0x14001c4b6
sub ebx, 1
je 0x14001c49d
cmp ebx, 1
jne 0x14001c714
lea edx, [rbx + 1]
jmp 0x14001c4a2
mov edx, 1
mov r8d, edx
lea rcx, [0x140077f70]
call fcn.14001b1f8
jmp 0x14001c714
xor r8d, r8d
xor edx, edx
jmp 0x14001c4a5
mov rax, qword [0x140078088]
mov ebx, r14d
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx]
mov edi, dword [rcx + 0x358]
test edi, edi
sete bl
cmp edi, ebx
je 0x14001c4f1
mov dword [rcx + 0x358], ebx
cmp dword [rcx + 0x35c], r14d
jne 0x14001c4f1
call fcn.1400416e0
mov rcx, qword [0x1400780e0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
neg edi
mov edx, 0x12f
mov rcx, rax
sbb r8d, r8d
not r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftCalc
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001c714
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r13d
lea rdx, str.UseSep
mov r9d, r13d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c714
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x200
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 0xd9
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14001c5ca
mov word [rsp + 0x70], r14w
xor ecx, ecx
call fcn.140002e00
mov rcx, qword [0x1400780e0]
lea rdx, [rsp + 0x70]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_ShellAboutW]
jmp 0x14001c714
sub ebx, r10d
je 0x14001c67d
sub ebx, 0x28e
je 0x14001c669
sub ebx, 8
je 0x14001c640
sub ebx, 2
je 0x14001c629
cmp ebx, r13d
jne 0x14001c714
cmp byte [0x140078097], r14b
jne 0x14001c714
call fcn.14001c9e0
jmp 0x14001c714
cmp byte [0x140078095], r14b
jne 0x14001c714
call fcn.14001c860
jmp 0x14001c714
cmp byte [0x140078095], r14b
jne 0x14001c636
cmp byte [0x140078097], r14b
jne 0x14001c61f
cmp byte [0x140078096], r14b
je 0x14001c714
call fcn.14001c920
jmp 0x14001c714
cmp r8d, 1
ja 0x14001c714
call fcn.14001c740
jmp 0x14001c714
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x1400654d8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400654c8]
lea r8d, [rdx + 0x17]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14001c714
xor ecx, ecx
mov dword [rsp + 0x60], 2
lea rax, str.HELP_ENTRY_ID_CALCULATOR_HELP
mov edx, 0x38f
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea r8d, [rcx + 1]
call qword [sym.imp.ntdll.dll_WinSqmAddToStream]
lea rcx, str.mshelp:__windows__idf15f7d3e_ee9c_465a_a7e8_4e6af5cfee5d
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x14001c702
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
mov rdx, rbx
call qword [case.0x14003a69c.0]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14003a69c.0]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14005d960
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret