Function at 0x1400131e8
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11a8
call fcn.14004a0d0
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140061550]
xor rax, rbp
mov qword [rbp + 0x1160], rax
mov r14, r8
mov r15, rdx
mov qword [rbp + 8], rdx
mov r13, rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x20], r9
xor edi, edi
mov word [rbp], di
lea rdx, [rbp + 0x160]
call fcn.14000b12c
cmp eax, edi
jl 0x1400137ce
lea rdx, [rbp]
lea rcx, [rbp + 0x160]
call fcn.14000af2c
cmp eax, edi
jne 0x1400132ad
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x36e
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str._s_Type_not_supported_n
xor r8d, r8d
mov rdx, qword [0x140063140]
lea rcx, [rbp + 0x20]
call fcn.14000a6e8
mov eax, 0x80020009
jmp 0x1400137ce
mov rcx, qword [r13]
cmp byte [rcx], 9
jl 0x1400132d1
cmp byte [rcx], 0xa
jle 0x1400132c5
cmp byte [rcx], 0xd
je 0x1400132c5
cmp byte [rcx], 0x20
jne 0x1400132d1
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r13], rax
jmp 0x1400132ad
lea rdx, [rbp + 0x160]
mov rcx, r13
call fcn.14000b12c
cmp eax, edi
jl 0x1400137ce
movzx eax, word [rbp]
cmp eax, 8
je 0x140013746
cmp eax, 0x11
je 0x1400135db
cmp eax, 0x13
je 0x140013463
cmp eax, 0x4008
jne 0x1400137bb
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x381
lea rcx, str.default
mov rax, r14
cmp r14, rdi
cmove rax, rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x140063140]
lea rcx, [rbp + 8]
call fcn.14000a6e8
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov qword [rbp + 0x50], rdi
movsxd rcx, eax
cmp rcx, rdi
jne 0x140013384
mov rcx, rdi
jmp 0x140013393
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x1400133a2
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.14001072c
nop
jmp 0x1400133bb
mov ecx, 0x80070057
call fcn.14000a738
nop
xor edi, edi
mov r13, qword [rbp + 0x40]
mov r15, qword [rbp + 0x38]
mov r14, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x50]
cmp rbx, rdi
je 0x140013443
lea rsi, [rbp + 0x160]
cmp byte [rbp + 0x160], dil
je 0x140013425
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [rsi]
cmp cl, 0x5c
jne 0x1400133fd
cmp byte [rax], 0x30
jne 0x1400133fd
mov byte [rbx], dil
inc rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rsi, rax
jmp 0x140013420
mov byte [rbx], cl
mov cl, byte [rsi]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
cmp eax, edi
je 0x14001341a
inc rbx
inc rsi
mov al, byte [rsi]
cmp al, dil
je 0x140013425
mov byte [rbx], al
inc rbx
inc rsi
cmp byte [rsi], dil
jne 0x1400133d4
mov byte [rbx], dil
mov byte [rbx + 1], dil
mov r8, qword [rbp + 0x50]
mov rdx, r14
mov rcx, r15
call fcn.14000ad14
mov esi, eax
mov rbx, qword [rbp + 0x50]
jmp 0x140013448
mov esi, 0xe
lea rax, [rbp + 0x58]
cmp rbx, rax
je 0x1400137ae
lea rcx, [rbp + 0x50]
call fcn.14000ded0
jmp 0x1400137ae
mov rbx, rdi
mov qword [rbp + 8], rbx
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r12, eax
add r12, r12
mov eax, 0x80000000
add rax, r12
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1400135bc
cmp r12d, 0x400
jg 0x1400134d4
movsxd rsi, r12d
mov rcx, rsi
call fcn.14000df04
cmp al, dil
je 0x1400134d4
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x1400134c1
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004a0d0
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x140013505
movsxd rsi, r12d
or rax, 0xffffffffffffffff
sub rax, rsi
cmp rax, 0x10
jb 0x1400135b1
lea rcx, [rsi + 0x10]
call fcn.14001f5e0
cmp rax, rdi
jne 0x1400134fb
mov rcx, rdi
jmp 0x140013505
mov qword [rax], rdi
mov rbx, rax
lea rcx, [rax + 0x10]
shr rsi, 1
mov r9d, 3
mov r8d, esi
lea rdx, [rbp + 0x160]
call fcn.14000a528
cmp rax, rdi
je 0x1400135bc
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r8d, dword [rbp]
mov rdx, r14
mov rcx, r15
call fcn.14000ab9c
mov esi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x3be
lea rcx, str.default
cmp r14, rdi
cmove r14, rcx
mov qword [rsp + 0x28], r14
mov eax, dword [rbp]
mov dword [rsp + 0x20], eax
lea r9, str.Setting_Value__d_at__s_n
mov r8d, 2
mov rdx, qword [0x140063140]
lea rcx, [rbp + 8]
call fcn.14000a6e8
nop
cmp rbx, rdi
je 0x1400137ae
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14001e650
cmp rbx, rdi
jne 0x14001359c
jmp 0x1400137ae
mov ecx, 0x80070057
call fcn.14000a738
nop
cmp rbx, rdi
je 0x1400135d1
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14001e650
cmp rbx, rdi
jne 0x1400135c1
mov eax, 0x8007000e
jmp 0x1400137ce
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov dword [rbp + 0x30], eax
test al, 1
je 0x140013627
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x3c6
lea r9, str.Binary_Data_does_not_fall_on_BYTE_boundries_n
xor r8d, r8d
mov rdx, qword [0x140063140]
lea rcx, [rbp + 0x20]
call fcn.14000a6e8
mov eax, 0x80004005
jmp 0x1400137ce
cdq
sub eax, edx
sar eax, 1
movsxd rsi, eax
mov dword [rbp], esi
mov qword [rbp + 0x50], rdi
mov rcx, rsi
cmp rsi, rdi
jne 0x140013643
mov rcx, rdi
jmp 0x140013652
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x140013661
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.14001072c
nop
jmp 0x140013684
mov ecx, 0x80070057
call fcn.14000a738
nop
xor edi, edi
mov ebx, dword [rbp + 0x30]
mov esi, dword [rbp]
mov r13, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 8], rax
mov r14, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x50]
cmp rcx, rdi
jne 0x1400136a9
lea rax, [rbp + 0x58]
cmp rax, rdi
je 0x14001369f
lea rcx, [rbp + 0x50]
call fcn.14000ded0
mov eax, 0x80004005
jmp 0x1400137ce
movsxd r8, esi
xor edx, edx
call fcn.14001dda0
mov r12d, edi
mov r15, rdi
movsxd rax, ebx
cmp rax, rdi
jle 0x140013709
mov rsi, rax
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
add rbx, qword [rbp + 0x50]
mov cl, byte [rbp + r15 + 0x160]
call fcn.14000b020
mov r11b, al
mov ecx, r12d
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
mov cl, al
shl r11b, cl
or byte [rbx], r11b
inc r12d
inc r15
cmp r15, rsi
jl 0x1400136c4
mov esi, dword [rbp]
mov dword [rsp + 0x28], esi
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x1400137ae
lea rcx, [rbp + 0x50]
call fcn.14000ded0
jmp 0x1400137ae
mov r9d, 1
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r15
call fcn.14000ac14
mov esi, eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], 0x37c
lea rcx, str.default
cmp r14, rdi
cmove r14, rcx
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str.Setting_Value__s_at__s_n
mov r8d, 2
mov rdx, qword [0x140063140]
lea rcx, [rbp + 8]
call fcn.14000a6e8
cmp esi, edi
je 0x1400137bb
mov ecx, esi
call fcn.14000a510
jmp 0x1400137ce
mov rdx, qword [rbp + 0x20]
mov rcx, r13
call fcn.14000b12c
cmp eax, edi
cmovl edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x1160]
xor rcx, rbp
call fcn.14001e4a0
lea rsp, [rbp + 0x1178]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret