Function at 0x140011160
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x60
xor r13d, r13d
mov r12d, r8d
mov r15, rdx
mov qword [rsp + 0x50], r13
mov rdi, rcx
mov qword [rsp + 0xa8], r13
lea r8, str.RegSet_1_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax]
cmp word [rdi + rcx*2 + 2], r13w
lea rcx, [rcx + 1]
jne 0x1400111b0
mov qword [rsp + 0x90], rsi
lea rcx, [rcx*2 + 4]
mov qword [rsp + 0x98], r14
call fcn.14001bda4
mov rbp, rax
test rax, rax
jne 0x140011201
lea r8, [0x1400515c8]
lea rdx, [0x140090f60]
test rdi, rdi
je 0x1400111f9
mov r9, rdi
jmp 0x14001124f
xor r9d, r9d
jmp 0x1400114b6
mov rdx, rbx
inc rdx
cmp word [rdi + rdx*2], r13w
jne 0x140011204
inc rdx
mov r8, rdi
mov rcx, rbp
call fcn.14001b57c
test eax, eax
je 0x140011229
lea r8, [0x1400515d8]
jmp 0x1400111e8
mov edx, 0x5c
mov rcx, rbp
call fcn.14001353c
mov rsi, rax
test rax, rax
jne 0x140011265
lea r8, [0x1400515e8]
mov r9, rbp
lea rdx, [0x140090f60]
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
mov dword [rsp + 0x20], r13d
call fcn.140001030
jmp 0x1400114c2
add rsi, 2
mov edx, 0x5c
mov rcx, rsi
call fcn.140013488
mov r14, rax
test rax, rax
jne 0x14001129a
lea r8, [0x1400515f8]
lea rdx, [0x140090f60]
test rsi, rsi
je 0x1400111f9
mov r9, rsi
jmp 0x14001124f
lea r8, [rsp + 0x50]
mov word [rax], r13w
lea rdx, [0x14003a3d4]
mov rcx, rbp
add r14, 2
call fcn.14001b968
mov rdi, rax
test rax, rax
jne 0x1400112ca
lea r8, [0x140051608]
jmp 0x140011245
lea r8, str.RegSet_2_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
mov r9, rbx
inc r9
cmp word [rdi + r9*2], r13w
jne 0x1400112e5
lea rax, [0x140051630]
mov dword [rsp + 0x28], 4
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140011320
mov ecx, r13d
jmp 0x14001139f
mov r9, rbx
inc r9
cmp word [rdi + r9*2], r13w
jne 0x140011323
lea rax, [0x140051640]
mov dword [rsp + 0x28], 4
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14001135b
lea ecx, [rax - 1]
jmp 0x14001139f
mov r9, rbx
nop
inc r9
cmp word [rdi + r9*2], r13w
jne 0x140011360
lea rax, [0x140051650]
mov dword [rsp + 0x28], 4
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ecx, dword [rsp + 0xa8]
mov edx, 2
cmp eax, edx
cmove ecx, edx
test ecx, ecx
je 0x1400113bf
sub ecx, 1
je 0x1400113b6
cmp ecx, 1
jne 0x14001142c
mov rcx, 0xffffffff80000000
jmp 0x1400113c6
mov rcx, 0xffffffff80000001
jmp 0x1400113c6
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rsi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001142c
lea r8, str.RegCreateKeyEx
lea rdx, [0x140090f60]
test rsi, rsi
je 0x1400114b3
mov r9, rsi
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x1400114c2
lea r8, str.RegSet_3_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
cmp r12d, 4
jne 0x140011454
mov dword [rsp + 0x28], r12d
mov r9d, r12d
jmp 0x14001146e
cmp word [r15 + rbx*2 + 2], r13w
lea rbx, [rbx + 1]
jne 0x140011454
lea eax, [rbx*2 + 2]
mov r9d, r12d
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0xa8]
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400114e9
lea r8, str.RegSetValueEx
lea rdx, [0x140090f60]
test r14, r14
je 0x1400114b3
mov r9, r14
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x1400114c2
mov r9d, eax
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400114d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x1400114e2
mov rcx, rbp
call fcn.14001bd9c
mov eax, 0x65b
jmp 0x140011506
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400114fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.14001bd9c
xor eax, eax
mov r14, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret