Function at 0x1400a76e3
Capabilities:
Set registry value

Disassembly:
jmp 0x1400ca080
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [0x140254140]
xor rax, rbp
mov qword [rbp + 0x160], rax
lea rcx, [0x14026b545]
call fcn.1400a9448
mov rax, qword [rbp + 0x190]
mov rcx, rax
call fcn.1400a5f87
movzx eax, al
test eax, eax
je 0x1400ca0e6
xor al, al
jmp 0x1400ca38d
mov rax, qword [rbp + 0x190]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rbp + 8]
call fcn.1400a52c1
mov qword [rbp + 0x48], 0
lea rcx, [rbp + 8]
call fcn.1400a55e6
mov qword [rsp + 0x40], 0
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400ca172
mov byte [rbp + 0x124], 0
lea rcx, [rbp + 8]
call fcn.1400a5c3a
movzx eax, byte [rbp + 0x124]
jmp 0x1400ca38d
mov rax, qword [rbp + 0x190]
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x190]
add rax, 0x78
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
add rcx, 0x78
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x190]
add rax, 0x28
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
add rcx, 0x28
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x190]
add rax, 0xa0
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
add rcx, 0xa0
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x190]
add rax, 0x50
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
add rcx, 0x50
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x190]
add rax, 0xc8
mov rcx, rax
call fcn.1400a89df
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x190]
add rcx, 0xc8
call fcn.1400a55e6
mov rcx, qword [rbp + 0x158]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x144], 1
lea rcx, [rbp + 8]
call fcn.1400a5c3a
movzx eax, byte [rbp + 0x144]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140204ee0]
call fcn.1400a8836
mov rax, rdi
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.1400a714d
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret