Function at 0x140119860
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov r9, qword [rcx + 0xa8]
cmp dword [r9 + 4], 0
je 0x14011a11f
mov rbx, qword [r9 + 0x10]
add rbx, r9
mov rcx, rbx
call fcn.140117e80
test rax, rax
je 0x14011a11f
cmp byte [rbx + 0x18], 0
jne 0x14011a11f
mov rcx, rbx
call fcn.140117e80
test rax, rax
je 0x14011a11f
mov rcx, qword [rdi]
mov qword [rbp - 0x48], rcx
mov eax, dword [rcx]
inc eax
cmp eax, 1
jbe 0x1401198f3
mov eax, 1
lock xadd dword [rcx], eax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x38]
call fcn.140117b30
nop
mov edi, dword [r14 + 0xb4]
mov eax, 0x5c
mov word [rbp + 0x78], ax
mov esi, 0xffffffff
lea r9d, [rax - 0x5b]
mov r8d, esi
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140040d00
lea r15, [0x1401a1e20]
cmp eax, esi
jne 0x14011993d
mov qword [rsp + 0x50], r15
jmp 0x140119951
lea r8d, [rax + 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140041340
nop
mov rcx, qword [r14 + 0xa8]
xor r13d, r13d
cmp dword [rcx + 4], r13d
je 0x140119985
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.140117e80
test rax, rax
je 0x140119985
cmp byte [rbx + 0x18], r13b
jne 0x140119985
mov rcx, rbx
call fcn.140117e80
jmp 0x140119988
mov rax, r13
mov r9d, edi
lea r8, [rsp + 0x50]
mov edx, 0x2001f
mov rcx, rax
call fcn.140117700
mov rbx, rax
mov qword [rbp - 0x38], rax
mov rcx, qword [rsp + 0x50]
mov edx, dword [rcx]
test edx, edx
je 0x1401199c7
cmp edx, 0xffffffff
je 0x1401199da
mov r8d, esi
mov rcx, qword [rsp + 0x50]
lock xadd dword [rcx], r8d
cmp r8d, 1
jne 0x1401199da
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x50]
call fcn.140049bf0
test rbx, rbx
jne 0x1401199ef
lea edx, [rbx + 1]
mov rcx, r14
call fcn.140103f10
jmp 0x14011a0ec
mov qword [rsp + 0x30], r15
mov rcx, r12
call fcn.140082240
add eax, 0xfffffffe
cmp eax, 0xa
ja case.0x140119a1b.6
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x11a148]
add rcx, rdx
jmp rcx
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.140081a70
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140105a70
nop
mov rax, qword [rsp + 0x78]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119a59
cmp ecx, 0xffffffff
je 0x140119aaf
mov ecx, esi
mov rax, qword [rsp + 0x78]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119aaf
mov r15, qword [rsp + 0x78]
movsxd r14, dword [r15 + 8]
add r14, 2
lea r14, [r15 + r14*8]
movsxd rbx, dword [r15 + 0xc]
add rbx, 2
lea rbx, [r15 + rbx*8]
cmp rbx, r14
je 0x140119aa6
nop dword [rax + rax]
sub rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
je 0x140119aa1
mov rcx, rdi
call fcn.14007da90
mov edx, 0x10
mov rcx, rdi
call fcn.140121cec
cmp rbx, r14
jne 0x140119a80
mov rcx, r15
call fcn.14003a040
nop
mov rax, qword [rsp + 0x40]
movsxd rbx, dword [rax + 8]
add rbx, 2
lea rbx, [rax + rbx*8]
movsxd rdx, dword [rax + 0xc]
add rdx, 2
lea rdx, [rax + rdx*8]
cmp rbx, rdx
je 0x140119b16
mov rax, qword [rbx]
cmp dword [rax + 4], 0
je 0x140119c65
mov r9d, 1
xor r8d, r8d
movzx edx, r13w
mov rcx, rbx
call fcn.1400406d0
cmp eax, 0xffffffff
jne 0x140119c65
add rbx, 8
mov rax, qword [rsp + 0x40]
movsxd rdx, dword [rax + 0xc]
add rdx, 2
lea rdx, [rax + rdx*8]
cmp rbx, rdx
jne 0x140119ad1
movsxd rbx, dword [rax + 8]
add rbx, 2
lea rbx, [rax + rbx*8]
movsxd rdx, dword [rax + 0xc]
add rdx, 2
lea rdx, [rax + rdx*8]
cmp rbx, rdx
je 0x140119bbd
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, dword [rax + 4]
lea edi, [rcx*2 + 2]
mov rcx, rbx
call fcn.140046630
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14002fd60
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140030230
nop
mov rax, qword [rbp - 0x78]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119b91
cmp ecx, 0xffffffff
je 0x140119ba3
mov ecx, esi
mov rax, qword [rbp - 0x78]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119ba3
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rbp - 0x78]
call fcn.140049bf0
add rbx, 8
mov rax, qword [rsp + 0x40]
movsxd rdx, dword [rax + 0xc]
add rdx, 2
lea rdx, [rax + rdx*8]
cmp rbx, rdx
jne 0x140119b40
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030310
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140030310
mov r15d, 7
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119bfb
cmp ecx, 0xffffffff
je 0x140119c5c
mov ecx, esi
mov rax, qword [rsp + 0x40]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119c5c
mov r14, qword [rsp + 0x40]
movsxd rbx, dword [r14 + 0xc]
add rbx, 2
lea rbx, [r14 + rbx*8]
movsxd rdi, dword [r14 + 8]
add rdi, 2
lea rdi, [r14 + rdi*8]
cmp rdi, rbx
je 0x140119c53
nop dword [rax]
sub rbx, 8
mov rcx, qword [rbx]
mov eax, dword [rcx]
test eax, eax
je 0x140119c3d
cmp eax, 0xffffffff
je 0x140119c4e
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140119c4e
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbx]
call fcn.140049bf0
cmp rbx, rdi
jne 0x140119c20
mov rcx, r14
call fcn.14003a040
nop
mov r14, qword [rbp + 0x60]
jmp 0x140119ee2
mov r15d, 3
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140105b70
nop
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 4]
lea ebx, [rcx + rcx]
lea rcx, [rsp + 0x58]
call fcn.140046630
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14002fd60
mov rdx, qword [rsp + 0x30]
mov qword [rbp - 8], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x80]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119ccf
cmp ecx, 0xffffffff
je 0x140119ce2
mov ecx, esi
mov rax, qword [rbp - 0x80]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119ce2
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rbp - 0x80]
call fcn.140049bf0
nop
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119d0a
cmp ecx, 0xffffffff
je 0x140119bdb
mov ecx, esi
mov rax, qword [rsp + 0x58]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119bdb
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x58]
call fcn.140049bf0
jmp 0x140119bdb
xor edx, edx
mov rcx, r12
call fcn.140081540
mov dword [rsp + 0x70], eax
mov r8d, 4
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14002fd60
mov rdx, qword [rsp + 0x30]
mov qword [rbp], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x70]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119d76
cmp ecx, 0xffffffff
je 0x140119d88
mov ecx, esi
mov rax, qword [rbp - 0x70]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119d88
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rbp - 0x70]
call fcn.140049bf0
mov r15d, 4
jmp 0x140119ee2
xor edx, edx
lea r15d, [rdx + 0xb]
mov rcx, r12
call fcn.140081aa0
mov qword [rbp - 0x40], rax
lea r8d, [r15 - 3]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.14002fd60
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 8], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x68]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119df0
cmp ecx, 0xffffffff
je 0x140119ee2
mov ecx, esi
mov rax, qword [rbp - 0x68]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119ee2
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rbp - 0x68]
call fcn.140049bf0
jmp 0x140119ee2
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140105b70
nop
mov r9d, 1
xor r8d, r8d
movzx edx, r13w
lea rcx, [rsp + 0x48]
call fcn.1400406d0
mov ecx, 1
mov edx, 3
cmp eax, 0xffffffff
cmovne ecx, edx
mov dword [rbp + 0x60], ecx
mov rcx, qword [rsp + 0x48]
mov ebx, dword [rcx + 4]
jne 0x140119e4b
inc ebx
add ebx, ebx
lea rcx, [rsp + 0x48]
call fcn.140046630
mov rdx, rax
mov r8d, ebx
lea rcx, [rbp - 0x60]
call fcn.14002fd60
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 0x10], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x60]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119e98
cmp ecx, 0xffffffff
je 0x140119eab
mov ecx, esi
mov rax, qword [rbp - 0x60]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119eab
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rbp - 0x60]
call fcn.140049bf0
nop
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
test ecx, ecx
je 0x140119ecb
cmp ecx, 0xffffffff
je 0x140119ede
mov ecx, esi
mov rax, qword [rsp + 0x48]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140119ede
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x48]
call fcn.140049bf0
mov r15d, dword [rbp + 0x60]
mov rax, qword [rsp + 0x30]
mov edi, dword [rax + 4]
mov rbx, qword [rax + 0x10]
add rbx, rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x58]
call fcn.140117fe0
nop
mov rcx, rax
call fcn.140046630
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, r15d
xor r8d, r8d
mov rdx, rax
mov rdi, qword [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x58]
mov eax, dword [rcx]
test eax, eax
je 0x140119f47
cmp eax, 0xffffffff
je 0x140119f59
mov edx, esi
mov rcx, qword [rbp - 0x58]
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140119f59
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbp - 0x58]
call fcn.140049bf0
test ebx, ebx
jne 0x140119f69
mov byte [r14 + 0xb0], bl
jmp 0x14011a0ae
mov qword [rbp - 0x30], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
lea rax, [0x1402d77f0]
mov qword [rbp - 0x18], rax
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.14009f5f0
nop
mov rcx, qword [rax]
mov r8d, dword [rcx + 4]
lea r15, [0x1401a1e20]
cmp rcx, r15
jne 0x140119fa8
mov rdx, r13
jmp 0x140119faf
mov rdx, qword [rcx + 0x10]
add rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140045600
nop
mov rax, qword [rsp + 0x68]
mov rbx, qword [rax + 0x10]
add rbx, rax
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax + 4]
cmp rax, r15
je 0x140119fdb
mov r13, qword [rax + 0x10]
add r13, rax
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.140045600
nop
mov rax, qword [rsp + 0x60]
mov r8, qword [rax + 0x10]
add r8, rax
mov r9, rbx
lea rdx, [0x1402ac080]
lea rcx, [rbp - 0x30]
call fcn.140035f50
nop
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011a029
cmp ecx, 0xffffffff
je 0x14011a03d
mov ecx, esi
mov rax, qword [rsp + 0x60]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14011a03d
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rsp + 0x60]
call fcn.140049bf0
nop
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011a05d
cmp ecx, 0xffffffff
je 0x14011a071
mov ecx, esi
mov rax, qword [rsp + 0x68]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14011a071
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rsp + 0x68]
call fcn.140049bf0
nop
mov rax, qword [rbp - 0x50]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011a08f
cmp ecx, 0xffffffff
je 0x14011a0a1
mov ecx, esi
mov rax, qword [rbp - 0x50]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14011a0a1
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbp - 0x50]
call fcn.140049bf0
mov edx, 1
mov rcx, r14
call fcn.140103f10
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011a0d8
cmp ecx, 0xffffffff
je 0x14011a0ec
mov ecx, esi
mov rax, qword [rsp + 0x30]
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14011a0ec
mov edx, 1
lea r8d, [rdx + 7]
mov rcx, qword [rsp + 0x30]
call fcn.140049bf0
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011a10a
cmp ecx, 0xffffffff
je 0x14011a12c
mov rax, qword [rsp + 0x38]
lock xadd dword [rax], esi
cmp esi, 1
jne 0x14011a12c
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x38]
call fcn.140049bf0
jmp 0x14011a12c
mov edx, 1
mov rcx, r14
call fcn.140103f10
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret