Function at 0x1400b90ac
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
call fcn.1400b0298
mov rcx, qword [0x14021c740]
mov edx, eax
call fcn.14007d0e0
mov r10, qword [rdi]
mov rbp, rax
mov r11b, byte [r10 + 0x1610]
add r10, 0x1608
neg r11b
sbb rcx, rcx
xor r12d, r12d
and rcx, r10
mov rbx, rcx
jne 0x1400b9161
mov rdx, qword [rdi + 0x3d20]
test rdx, rdx
je 0x1400b911f
cmp word [rdx], r12w
jne 0x1400b9134
cmp byte [rax + 0x19], r12b
je 0x1400b9170
lea rdx, [rax + 0x1a]
cmp word [rdx], r12w
je 0x1400b9170
test rdx, rdx
je 0x1400b9170
mov rbx, rcx
cmp word [rdx], r12w
je 0x1400b9170
mov rcx, qword [0x14021c740]
call fcn.140083418
mov rbx, r12
test eax, eax
js 0x1400b9170
mov rcx, qword [0x14021c740]
mov edx, eax
call fcn.1400833f0
mov rbx, rax
test rbx, rbx
je 0x1400b9170
mov al, byte [rbx + 9]
mov byte [rsi], al
mov al, byte [rbx + 0xa]
jmp 0x1400b9182
mov rcx, rbp
call fcn.1400cb634
mov rcx, rbp
mov byte [rsi], al
call fcn.1400cb1ac
mov byte [r14], al
mov cl, byte [rsi]
cmp cl, 0xf
jbe 0x1400b91a0
cmp al, 0xf
jbe 0x1400b91a0
mov byte [r14], 0x10
mov al, r12b
mov byte [rsi], 0x10
mov byte [rdi + 0x21], 7
jmp 0x1400b91fc
cmp cl, 0x10
jb 0x1400b91ad
mov byte [rsi], 7
mov cl, 7
mov al, byte [r14]
cmp al, 0x10
jb 0x1400b91b9
mov byte [r14], r12b
mov al, r12b
mov cl, byte [rsi]
cmp cl, al
jne 0x1400b91f4
mov rdx, qword [rdi]
mov rcx, qword [0x14021c748]
call fcn.14008c2d0
test al, al
je 0x1400b91e6
mov rax, qword [0x14021c740]
movzx edx, byte [r14]
mov ecx, dword [rax + 0xef0]
bt ecx, edx
jb 0x1400b91f4
mov al, byte [r14]
neg al
sbb cl, cl
not cl
and cl, 7
mov byte [rsi], cl
mov al, byte [rsi]
mov byte [rdi + 0x21], al
mov al, byte [r14]
mov byte [rdi + 0x22], al
test rbx, rbx
je 0x1400b920f
mov al, byte [rbx + 0xb]
mov byte [r15], al
mov al, byte [rbx + 0xc]
jmp 0x1400b9222
mov rcx, rbp
call fcn.1400cb4f0
mov rcx, rbp
mov byte [r15], al
call fcn.1400cb4cc
mov rbx, qword [rsp + 0x90]
mov byte [rbx], al
mov cl, byte [r15]
cmp cl, 0xf
jbe 0x1400b9248
cmp al, 0xf
jbe 0x1400b9248
mov byte [rbx], 0x10
mov cl, 5
mov byte [r15], 0x10
mov al, 0xf
mov byte [rdi + 0x23], cl
jmp 0x1400b9276
cmp cl, 0x10
jb 0x1400b9254
mov cl, 5
mov byte [r15], cl
mov al, byte [rbx]
cmp al, 0x10
jb 0x1400b9260
mov byte [rbx], 0xf
mov al, 0xf
mov cl, byte [r15]
cmp cl, al
jne 0x1400b9271
neg cl
sbb al, al
not al
and al, 0xf
mov byte [rbx], al
mov cl, byte [r15]
mov byte [rdi + 0x23], cl
mov al, byte [rbx]
mov byte [rdi + 0x24], al
cmp byte [rsp + 0x98], r12b
je 0x1400b93de
mov r10, qword [rsp + 0xa0]
mov bpl, r12b
test r10, r10
jne 0x1400b930a
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
lea rdx, str.ConsoleConEmu
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400b92ff
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, str.Failed_to_create_open_registry_key_HKCUConsoleConEmu
mov edx, eax
call fcn.14011f550
mov r10, r12
mov qword [rsp + 0xa0], r12
jmp 0x1400b930a
mov r10, qword [rsp + 0xa0]
mov bpl, 1
mov cl, byte [rsi]
cmp cl, 0xf
jbe 0x1400b9319
mov cl, byte [rdi + 0x21]
and cl, 0xf
mov byte [rsi], cl
mov al, byte [r14]
cmp al, 0xf
jbe 0x1400b932a
mov al, byte [rdi + 0x22]
and al, 0xf
mov byte [r14], al
mov cl, byte [rsi]
shl al, 4
mov esi, 4
movzx edx, al
movzx eax, cl
and eax, 0xf
or edx, eax
mov dword [rsp + 0x98], edx
test r10, r10
je 0x1400b9378
lea rax, [rsp + 0x98]
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ScreenColors
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r10, qword [rsp + 0xa0]
cmp byte [r15], 0xf
jbe 0x1400b9383
cmp byte [rbx], 0xf
ja 0x1400b93d0
test r10, r10
je 0x1400b93d0
mov al, byte [rdi + 0x24]
lea rdx, str.PopupColors
shl al, 4
mov r9d, esi
movzx ecx, al
xor r8d, r8d
movzx eax, byte [rdi + 0x23]
and eax, 0xf
mov dword [rsp + 0x28], esi
or ecx, eax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x90], ecx
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r10, qword [rsp + 0xa0]
test bpl, bpl
je 0x1400b93de
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret