Function at 0x1400551e0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov r14, r9
mov qword [rsp + 0x48], r9
mov r12, r8
mov r15, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x68], rsi
xor r10d, r10d
mov dword [rsp + 0x30], r10d
mov r8, qword [r8]
test r8, r8
je 0x140055594
mov r9, qword [rsi]
mov rax, r9
sub r8, r9
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140055254
add rax, 2
test ecx, ecx
jne 0x140055240
test edx, edx
jne 0x1400552cc
mov rdx, qword [r12]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055284
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400552a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140055568
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
jmp 0x140055562
mov rdi, 0xffffffffffffffff
cmp dword [r9 - 0x10], 0
je 0x14005547f
mov qword [rsp + 0x38], r10
mov rax, qword [r14]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140055304
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x140055325
call fcn.1400195b0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x14005557e
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
lea rcx, str._bak
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140055350
mov r13, qword [r14]
movsxd r14, dword [r13 - 0x10]
lea ebp, [r14 + rsi]
test ebp, ebp
js 0x140055589
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, ebp
or eax, ecx
jge 0x14005538f
mov edx, ebp
lea rcx, [rsp + 0x38]
call fcn.140018ec0
mov rbx, qword [rsp + 0x38]
add r14, r14
je 0x1400553c5
test rbx, rbx
je 0x1400553b5
mov r8, r14
mov rcx, rbx
test r13, r13
je 0x1400553ae
mov rdx, r13
call fcn.1401f61a0
jmp 0x1400553c5
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
movsxd r8, esi
add r8, r8
lea rcx, [r14 + rbx]
je 0x1400553f4
test rcx, rcx
jne 0x1400553e8
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x1400553f4
lea rdx, str._bak
call fcn.1401f61a0
cmp ebp, dword [rbx - 0xc]
jg 0x140055589
mov dword [rbx - 0x10], ebp
movsxd rax, ebp
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rsi, qword [rsp + 0x40]
mov rsi, qword [rsi]
cmp qword [r15], rcx
je 0x140055444
test rsi, rsi
je 0x140055444
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055470
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [r12]
cmp qword [r15], 0
je 0x1400554bb
test rbx, rbx
je 0x1400554bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140262520]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rbp + 0x38]
cmp dword [rbx - 0x10], 0
je 0x1400554fe
cmp qword [r15], 0
je 0x1400554fe
test rbx, rbx
je 0x1400554fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.PerceivedType
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055523
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140055547
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140055568
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038716.0]
mov eax, 1
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140019320
int3
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3