Function at 0x7d2777c0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x50
call fcn.7d279670
mov rbx, rax
test rax, rax
je 0x7d277823
mov rcx, rax
call fcn.7d27b3d0
mov rcx, rbx
test al, al
jne 0x7d27782b
mov r8d, 0x11
lea rdx, str.clr_optimization_
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x7d277818
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
add rsp, 0x50
pop rbx
ret
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov dl, 1
mov qword [rsp + 0x48], rsi
call fcn.7d2213f2
mov rsi, rax
test rax, rax
jne 0x7d277855
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x50
pop rbx
ret
cmp dword [rsp + 0x68], 0xffffffff
mov qword [rsp + 0x40], rdi
je 0x7d2778a4
lea rdx, str.Type
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d277a57
cmp dword [rsp + 0x70], 0xffffffff
je 0x7d2778ee
lea rdx, str.Start
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d277a57
cmp dword [rsp + 0x78], 0xffffffff
je 0x7d277938
lea rdx, str.ErrorControl
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d277a57
mov rdi, qword [rsp + 0xb0]
or rbx, 0xffffffffffffffff
test rdi, rdi
je 0x7d27799b
lea rdx, str.DisplayName
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, rbx
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d277960
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d277a57
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x7d2779f7
lea rdx, str.ImagePath
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, rbx
nop dword [rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d2779c0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d277a57
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x7d277a7d
lea rdx, str.ObjectName
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop word [rax + rax]
cmp word [rdi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x7d277a20
lea eax, [rbx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
jns 0x7d277a7d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x50
pop rbx
ret
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x50
pop rbx
ret