Function at 0x140076a00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbx, r9
mov r11, r8
mov edi, edx
mov r12, rcx
test r8, r8
je 0x140076ccc
lea eax, [rdx + 2]
test eax, 0xfffffffd
je 0x140076ccc
mov rax, qword [0x1400edaa8]
lea r9, [0x1400bdf7c]
xor ebp, ebp
xor r8d, r8d
mov rdx, rbx
mov rcx, r11
mov r10d, dword [rax + 0x108]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
or r10d, 0x20006
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140076d74
sub edi, 1
je 0x140076d23
sub edi, 1
je 0x140076d03
sub edi, 1
je 0x140076bbb
sub edi, 1
je 0x140076b79
cmp edi, 3
je 0x140076ac2
lea ebx, [rbp + 0x57]
jmp 0x140076d69
mov rsi, qword [rsp + 0xb8]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], bp
jne 0x140076ad0
lea rcx, [rbx*2 + 4]
call fcn.1400997a8
mov rdi, rax
test rax, rax
jne 0x140076af6
lea ebx, [rax + 0xe]
jmp 0x140076d69
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400a2664
mov dword [rdi + rbx*2], ebp
test rbx, rbx
je 0x140076b1b
cmp word [rdi + rbx*2 - 2], 0xa
jne 0x140076b1b
dec rbx
mov word [rdi + rbx*2], bp
mov rax, rdi
cmp word [rdi], bp
je 0x140076b35
cmp word [rax], 0xa
jne 0x140076b2c
mov word [rax], bp
add rax, 2
cmp word [rax], bp
jne 0x140076b23
test rbx, rbx
je 0x140076b3e
lea rbp, [rbx + 2]
mov rdx, qword [rsp + 0xb0]
lea eax, [rbp*2]
mov rcx, qword [rsp + 0x58]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call fcn.14009d6d0
jmp 0x140076d69
mov rcx, qword [rsp + 0xb8]
cmp word [rcx], bp
je 0x140076b94
call fcn.140014270
mov dword [rsp + 0xa0], eax
jmp 0x140076b9b
mov dword [rsp + 0xa0], ebp
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
jmp 0x140076d51
mov rdi, qword [rsp + 0xb8]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], bp
jne 0x140076bc7
mov eax, ebx
and eax, 0x80000001
jge 0x140076be0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140076bee
mov ebx, 0x57
jmp 0x140076d69
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd r15, eax
mov rcx, r15
call fcn.1400997a8
mov r14, rax
test rax, rax
jne 0x140076c10
lea ebx, [rax + 0xe]
jmp 0x140076d69
movsxd rbx, ebx
mov esi, ebp
mov r10d, ebp
mov r9, rbp
test rbx, rbx
jle 0x140076c85
mov r11, rbp
cmp r11, r15
jge 0x140076c85
mov r8d, ebp
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
movzx ecx, word [rdi + r9*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x140076c46
movzx eax, cx
sub eax, 0x30
jmp 0x140076c66
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x140076c57
movzx eax, cx
sub eax, 0x37
jmp 0x140076c66
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x140076cb9
movzx eax, cx
sub eax, 0x57
imul eax, edx
inc r10d
inc r9
add r8d, eax
sub edx, 0xf
jns 0x140076c30
mov byte [r11 + r14], r8b
inc esi
inc r11
cmp r9, rbx
jl 0x140076c23
mov rdx, qword [rsp + 0xb0]
mov r9d, 3
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r14
mov ebx, eax
call fcn.14009d6d0
jmp 0x140076d69
mov rcx, r14
call fcn.14009d6d0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400edaa8]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r12
call fcn.140030e80
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0xb8]
or rbx, 0xffffffffffffffff
nop
cmp word [rcx + rbx*2 + 2], bp
lea rbx, [rbx + 1]
jne 0x140076d10
mov r9d, 2
jmp 0x140076d41
mov rcx, qword [rsp + 0xb8]
or rbx, 0xffffffffffffffff
nop
cmp word [rcx + rbx*2 + 2], bp
lea rbx, [rbx + 1]
jne 0x140076d30
mov r9d, 1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0xb0]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x140076cd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140076cd3