Function at 0x140003860
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x808]
sub rsp, 0x8e0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402388b0]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
movzx r15d, r8b
mov esi, edx
mov rdi, rcx
xor r12d, r12d
mov qword [rsp + 0x50], r12
call fcn.140003d60
cmp eax, 1
jne 0x1400038c0
lea eax, [r12 + 4]
jmp 0x140003b6f
lea eax, [rsi - 1]
cmp eax, 1
ja 0x1400038d0
mov rcx, rdi
call fcn.140004a60
mov ecx, esi
dec ecx
je 0x1400038fd
dec ecx
je 0x1400038f4
dec ecx
je 0x1400038eb
dec ecx
jne 0x1400038fd
lea rcx, [rdi + 0x1f8]
jmp 0x140003900
lea rcx, [rdi + 0x150]
jmp 0x140003900
lea rcx, [rdi + 0xa8]
jmp 0x140003900
mov rcx, rdi
lea rdx, [rsp + 0x68]
call fcn.1400034c0
nop
mov eax, 0x20006
mov r14d, 0x20206
cmp byte [rdi + 0x2a0], 0
cmove r14d, eax
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rbx, qword [rsp + 0x68]
mov word [rbp - 0x30], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x2e]
call fcn.1401793b0
mov r9, rbx
lea r8, str.Try_to_create_Key:__s
mov edx, 0x400
lea rcx, [rbp - 0x30]
call fcn.140178534
lea rcx, [rbp - 0x30]
call fcn.140006670
test r15b, r15b
je 0x140003982
lea rcx, str.In_HKEY_LOCAL_MACHINE
call fcn.140006670
mov rcx, 0xffffffff80000002
jmp 0x140003995
lea rcx, str.In_HKEY_CURRENT_USER
call fcn.140006670
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
mov dword [rsp + 0x28], r14d
cmovae rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 3
test eax, eax
jne 0x140003b4f
mov dword [rsp + 0x58], ebx
mov ecx, esi
dec ecx
je 0x140003a0d
dec ecx
je 0x140003a04
dec ecx
je 0x1400039fb
dec ecx
jne 0x140003a0d
lea rcx, [rdi + 0x1f8]
jmp 0x140003a10
lea rcx, [rdi + 0x150]
jmp 0x140003a10
lea rcx, [rdi + 0xa8]
jmp 0x140003a10
mov rcx, rdi
lea rdx, [rbp - 0x58]
call fcn.140003580
nop
dec esi
je 0x140003a43
dec esi
je 0x140003a3c
dec esi
je 0x140003a33
dec esi
jne 0x140003a43
add rdi, 0x1f8
jmp 0x140003a43
add rdi, 0x150
jmp 0x140003a43
add rdi, 0xa8
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.1400035c0
mov eax, dword [rbp - 0x48]
lea ecx, [rax*2 + 2]
mov eax, dword [rbp - 0x68]
lea edi, [rax*2 + 2]
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rax, qword [rbp - 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.FriendlyName
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003b05
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003b05
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LoadBehavior
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003b05
lea ebx, [rax + 5]
jmp 0x140003b11
lea rcx, str.Error_create_values:_FriendlyName_Description_LoadBehavior
call fcn.140006670
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 0x60], 8
jb 0x140003b2c
mov rcx, qword [rbp - 0x78]
call fcn.14000682c
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r12
mov word [rbp - 0x78], r12w
cmp qword [rbp - 0x40], 8
jb 0x140003b5c
mov rcx, qword [rbp - 0x58]
call fcn.14000682c
jmp 0x140003b5c
lea rcx, str.Error_create_key
call fcn.140006670
nop
cmp qword [rbp - 0x80], 8
jb 0x140003b6d
mov rcx, qword [rsp + 0x68]
call fcn.14000682c
mov eax, ebx
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.140176ca0
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret