Function at 0x1400c44bc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, r9
mov r15, r8
mov rbx, rdx
mov r12, rcx
lea rsi, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rsi
je 0x1400c452e
test byte [rcx + 0x1c], 1
je 0x1400c452e
cmp byte [rcx + 0x19], 5
jb 0x1400c452e
mov edx, 0x61
mov qword [rax - 0x60], r9
mov qword [rax - 0x68], r8
mov r9, rbx
lea r8, [0x1401275f0]
mov rcx, qword [rcx + 0x10]
call fcn.140025b48
xor r13d, r13d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140004d1c
nop
lea rcx, [rbp - 0x30]
call fcn.140036144
mov r8, qword [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, r12
call fcn.1400c4cac
mov r14d, eax
mov r10, qword [0x14014dd40]
cmp r10, rsi
je 0x1400c459e
test byte [r10 + 0x1c], 2
je 0x1400c459e
cmp byte [r10 + 0x19], 4
jb 0x1400c459e
lea edx, [r13 + 0x62]
mov r9d, eax
lea r8, [0x1401275f0]
mov rcx, qword [r10 + 0x10]
call fcn.1400036d4
mov r10, qword [0x14014dd40]
test r14d, r14d
jne 0x1400c4764
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.1400bdba4
mov esi, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400c4614
test byte [rcx + 0x1c], 2
je 0x1400c4614
cmp byte [rcx + 0x19], 4
jb 0x1400c4614
lea edx, [r14 + 0x63]
mov r9d, esi
lea r8, [0x1401275f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
mov rbx, qword [rbp - 0x28]
test esi, esi
jne 0x1400c4641
mov rax, rbx
mov r8, rdi
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400c4639
add rax, 2
test edx, edx
jne 0x1400c4625
test ecx, ecx
je 0x1400c472f
mov eax, r13d
test rdi, rdi
setne al
test eax, eax
jne 0x1400c4659
mov ecx, 0x80004005
call fcn.140005300
int3
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r13w
jne 0x1400c465d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400c46c7
test byte [rcx + 0x1c], 2
je 0x1400c46c7
cmp byte [rcx + 0x19], 4
jb 0x1400c46c7
mov edx, 0x64
mov r9d, r14d
lea r8, [0x1401275f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
test esi, esi
jne 0x1400c472f
mov rsi, qword [rbp - 0x30]
mov rax, qword [r12]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [fcn.140009050]
mov edx, 0x3ec
mov rcx, r12
call rdi
mov ecx, eax
xor r9d, r9d
mov r8, r15
mov rdx, rsi
call fcn.1400c73ac
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400c472f
test byte [rcx + 0x1c], 2
je 0x1400c472f
cmp byte [rcx + 0x19], 4
jb 0x1400c472f
mov edx, 0x65
lea r8, [0x1401275f0]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
nop
lea rsi, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1400c475b
mov rdi, qword [rsi]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
mov rdx, rsi
mov rcx, rdi
call rbx
lea rsi, [0x14014dd40]
jmp 0x1400c4798
cmp r14d, 2
jne 0x1400c479f
mov r14d, 0x490
cmp r10, rsi
je 0x1400c47da
test byte [r10 + 0x1c], 2
je 0x1400c479f
cmp byte [r10 + 0x19], 4
jb 0x1400c479f
mov edx, 0x66
lea r8, [0x1401275f0]
mov rcx, qword [r10 + 0x10]
call fcn.140003614
mov r10, qword [0x14014dd40]
cmp r10, rsi
je 0x1400c47da
test byte [r10 + 0x1c], 1
je 0x1400c47da
movzx edx, byte [r10 + 0x19]
mov eax, r14d
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400c47da
mov edx, 0x67
mov r9d, r14d
lea r8, [0x1401275f0]
mov rcx, qword [r10 + 0x10]
call fcn.1400036d4
nop
mov rsi, qword [rbp - 0x30]
or eax, 0xffffffff
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x1400c4809
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400c4818
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r14d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret