Function at 0x140058ae0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xe8
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp - 1], rax
mov rsi, r9
mov qword [rbp - 0x79], r9
mov rbx, r8
mov qword [rbp - 0x71], rbx
mov r12, rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], r9
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x51], rax
xor r14d, r14d
mov dword [rsp + 0x50], r14d
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x29], r14
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140058b56
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140058cae
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140058b97
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140058cae
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140058bf0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
mov rdx, qword [rdi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058c1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058c44
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058c68
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140058c89
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov eax, 1
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140058cbd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140058d9e
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140058cfe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
mov rdx, qword [rdi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d52
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d76
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140058d97
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
jmp 0x140058c8e
mov qword [rbp - 0x69], r14
mov rax, qword [r12]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140058dc4
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x140058de8
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x140059378
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x69], rbx
mov dword [rsp + 0x50], 4
lea rcx, str.Capabilities
mov rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140058e16
mov r13, qword [r12]
movsxd r15, dword [r13 - 0x10]
lea r14d, [r15 + rsi]
test r14d, r14d
js 0x140059383
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x140058e57
mov edx, r14d
lea rcx, [rbp - 0x69]
call fcn.140018ec0
mov rbx, qword [rbp - 0x69]
add r15, r15
je 0x140058e8d
test rbx, rbx
je 0x140058e7d
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x140058e76
mov rdx, r13
call fcn.1401f61a0
jmp 0x140058e8d
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rbx]
je 0x140058ebc
test rcx, rcx
jne 0x140058eb0
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140058ebc
lea rdx, str.Capabilities
call fcn.1401f61a0
cmp r14d, dword [rbx - 0xc]
jg 0x140059383
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r15d, r15d
mov word [rbx + rax*2], r15w
mov r13, qword [rbp - 0x11]
mov rsi, qword [r13]
cmp qword [rbp - 0x29], r15
je 0x140058f13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9d, [r15 + 1]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
setne sil
jmp 0x140058f16
mov sil, 1
mov eax, 4
and eax, 0xfffffffb
mov dword [rsp + 0x50], eax
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058f42
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
test sil, sil
jne 0x140059148
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x19], r15
lea r8, str.Capabilities
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.1400179d0
nop
mov ebx, dword [rsp + 0x50]
or ebx, 1
mov dword [rsp + 0x50], ebx
mov rsi, qword [rax]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140058f8c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005900b
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140058fc5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
lea rax, [rbp - 5]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400590b3
lea r8, str.CapabilitiesFileAssociations
mov rdx, r12
lea rcx, [rbp - 0x61]
call fcn.1400179d0
nop
or ebx, 2
mov dword [rsp + 0x50], ebx
mov rsi, qword [rax]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140059038
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400590b8
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140059071
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400590b8
mov sil, 1
jmp 0x1400590bb
xor sil, sil
test bl, 2
je 0x1400590ef
and ebx, 0xfffffffd
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400590eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rsp + 0x50]
test bl, 1
je 0x14005911d
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005911d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
test sil, sil
je 0x140059191
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140059131
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140059144
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140059157
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp - 0x71]
mov r15, qword [rbp - 0x79]
mov qword [rbp - 0x29], 0
mov rcx, r13
call fcn.1400192d0
nop
mov rcx, r12
call fcn.1400192d0
nop
mov rcx, r14
call fcn.1400192d0
nop
mov rcx, r15
call fcn.1400192d0
xor eax, eax
jmp 0x140058c8e
mov r14, qword [rbp - 0x71]
mov rbx, qword [r14]
cmp qword [rbp - 0x21], 0
je 0x14005933a
test rbx, rbx
je 0x14005933a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ApplicationDescription
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005933a
mov r15, qword [rbp - 0x79]
mov rbx, qword [r15]
cmp qword [rbp - 0x21], 0
je 0x140059287
test rbx, rbx
je 0x140059287
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ApplicationName
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140059287
mov rbx, qword [rbp - 0x51]
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400592cd
lea rax, [rbx]
mov rbx, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
cmp qword [rbp - 0x19], 0
je 0x140059287
test rdi, rdi
je 0x140059287
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140059236
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140059296
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400592ad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], 0
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005915f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005915f
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400592dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400592f3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], 0
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005930a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], 0
mov rcx, r13
call fcn.1400192d0
nop
mov rcx, r12
call fcn.1400192d0
nop
mov rcx, r14
call fcn.1400192d0
nop
mov rcx, r15
call fcn.1400192d0
jmp 0x140058c89
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140059349
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005935c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005915b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005915b
mov ecx, 0x80004005
call fcn.140019320
int3
mov ecx, 0x80070057
call fcn.140019320
int3