Function at 0x1400662c0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1b00
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x1b58], rbx
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x1af0], rax
mov rdi, r8
mov r15, rdx
mov rbp, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
lea r9, str.lpszDir_s__lpszUninstallKey_s
lea r8, str.EntryCreatedDirectory
lea rdx, str.CRegistryIF
mov rcx, qword [rcx]
call fcn.140080c70
xor esi, esi
test rdi, rdi
je 0x14006697d
mov r13d, esi
mov r14, rsi
mov ebx, 0x410
mov rdx, rbx
lea rcx, [rsp + 0xab0]
mov r8d, esi
lea rax, [rsp + 0xab0]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140066387
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140066387
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140066363
jmp 0x14006638c
test rdx, rdx
jne 0x140066396
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
test r8d, r8d
jne 0x1400664d3
mov rdx, rbx
lea rcx, [rsp + 0x12d0]
mov r9d, esi
lea r8, [rsp + 0xab0]
lea rax, [rsp + 0x12d0]
sub r8, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x1400663e8
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400663e8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400663c3
jmp 0x1400663ed
test rdx, rdx
jne 0x1400663f7
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], si
test r9d, r9d
jne 0x1400664d3
lea rdx, str.CreatedDirectory
lea rcx, [rsp + 0x12d0]
call fcn.14002ae40
lea rcx, [rsp + 0xab0]
mov r8d, esi
lea rdx, [rsp + 0x12d0]
lea rax, [rsp + 0xab0]
sub rdx, rax
nop
nop
nop
lea rax, [rbx + 0x7ffffbee]
test rax, rax
je 0x140066464
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140066464
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140066440
jmp 0x140066469
test rbx, rbx
jne 0x140066473
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
mov eax, esi
test r8d, r8d
sete al
test eax, eax
je 0x1400664d3
mov edx, 0x400
lea rcx, [rsp + 0x2b0]
lea r8, [rsp + 0xab0]
lea rax, [rsp + 0x2b0]
sub r8, rax
lea rax, [rdx + 0x7ffffbfe]
test rax, rax
je 0x1400664c7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400664c7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400664a2
jmp 0x1400664cc
test rdx, rdx
jne 0x1400664d0
sub rcx, 2
mov word [rcx], si
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081070
mov ebx, esi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
jne 0x140066550
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov ebx, edi
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081270
test ebx, ebx
je 0x1400667b2
lea rcx, [rsp + 0x68]
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rsp + 0x68], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x90], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.140067540
mov r12, rax
test rax, rax
je 0x14006671d
mov r13d, esi
mov rbx, rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jle 0x14006661d
test r13d, r13d
jne 0x14006661d
test rbx, rbx
js 0x1400665f6
cmp rbx, rcx
jge 0x1400665f6
test rbx, rbx
js 0x140066617
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + rbx*8]
jmp 0x1400665f9
mov rcx, rsi
mov rdx, r15
call fcn.1400cdd20
test eax, eax
cmove r13d, edi
add rbx, 1
mov rcx, qword [rsp + 0x78]
cmp rbx, rcx
jge 0x14006661d
jmp 0x1400665d7
call fcn.1400a0610
int3
mov ebp, esi
mov rcx, qword [r12 + 0x10]
mov rdi, rsi
test rcx, rcx
jle 0x140066707
test rdi, rdi
js 0x140066657
cmp rdi, rcx
jge 0x140066657
test rdi, rdi
js 0x140066701
cmp rdi, rcx
jge 0x140066701
mov rax, qword [r12 + 8]
mov rbx, qword [rax + rdi*8]
jmp 0x14006665a
mov rbx, rsi
mov ecx, 0x7fffffff
lea rax, [0x1400fc3a8]
cmp word [rax], 0
je 0x140066678
add rax, 2
sub rcx, 1
jne 0x140066666
jmp 0x140066687
test rcx, rcx
je 0x140066687
mov eax, 0x7fffffff
sub rax, rcx
jmp 0x14006668a
mov rax, rsi
movsxd r8, eax
mov rdx, rbx
lea rcx, [0x1400fc3a8]
call fcn.1400ce2c0
test eax, eax
jne 0x1400666b8
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x98]
mov rcx, rbx
call fcn.1400cf260
mov ebx, eax
jmp 0x1400666c3
mov rcx, rbx
call fcn.1400cf2a0
mov rbx, rax
call fcn.1400cf300
cmp dword [rax], 0x22
je 0x1400666e8
call fcn.1400cf300
cmp dword [rax], 0x16
je 0x1400666e8
cmp ebx, 0x80000000
je 0x1400666e8
cmp rbx, r14
jl 0x1400666e8
lea r14, [rbx + 1]
add ebp, 1
add rdi, 1
mov rcx, qword [r12 + 0x10]
movsxd rax, ebp
cmp rax, rcx
jge 0x140066707
jmp 0x140066630
call fcn.1400a0610
int3
mov rax, qword [r12]
mov edi, 1
mov edx, edi
mov rcx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jle 0x140066790
mov rbx, rsi
test rbx, rbx
js 0x14006678a
cmp rbx, rcx
jge 0x14006678a
mov rax, qword [rsp + 0x70]
mov r8, qword [rax + rbx*8]
test r8, r8
je 0x14006676f
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x78]
add rbx, 1
cmp rbx, rcx
jl 0x140066742
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400aa464
jmp 0x140066790
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0x68]
call fcn.1400aa450
test r13d, r13d
jne 0x14006697d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081070
mov ebx, esi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140066842
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov ebx, edi
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fb428]
lea r8, str.MakeSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081270
test ebx, ebx
je 0x14006697d
mov r9, r14
lea r8, [0x1400fb428]
mov edx, 0xff
lea rcx, [rsp + 0xb0]
call fcn.14000ff40
test r15, r15
je 0x1400668cc
mov edi, 0x3fffffff
mov rcx, rdi
mov rax, r15
mov edx, esi
nop
nop
cmp word [rax], dx
je 0x1400668b1
add rax, 2
sub rcx, 1
jne 0x1400668a0
jmp 0x1400668b6
test rcx, rcx
jne 0x1400668c0
mov edx, 0x80070057
mov rdi, rsi
jmp 0x1400668c3
sub rdi, rcx
test edx, edx
js 0x1400668d1
add rdi, rdi
jmp 0x1400668d4
mov edx, 0x80070057
mov rdi, rsi
test edx, edx
jns 0x1400668dd
mov rdi, rsi
jmp 0x1400668e1
add rdi, 2
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081070
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete sil
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140081270
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.EntryCreatedDirectory
lea rdx, str.CRegistryIF
mov rcx, qword [rbp]
call fcn.140080e70
mov eax, esi
mov rcx, qword [rsp + 0x1af0]
xor rcx, rsp
call fcn.1400cd6e0
mov rbx, qword [rsp + 0x1b58]
add rsp, 0x1b00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret