Function at 0x140064f30
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
mov eax, 0x2190
call fcn.1400961d0
sub rsp, rax
mov rax, qword [0x1401786a0]
xor rax, rsp
mov qword [rsp + 0x2160], rax
mov r12, rdx
mov qword [rsp + 0x48], rdx
mov rbx, r9
lea rdx, [rsp + 0x160]
xor esi, esi
mov r13, r8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r8
mov rbp, rcx
mov word [rsp + 0x30], si
call fcn.140062f80
test eax, eax
js 0x140065311
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x160]
call fcn.140062ca0
test eax, eax
jne 0x140064fb0
mov eax, 0x80020009
jmp 0x140065311
mov rcx, qword [rbp]
movzx eax, word [rcx]
cmp eax, 9
jl 0x140064fd7
cmp eax, 0xa
jle 0x140064fcb
cmp eax, 0xd
je 0x140064fcb
cmp eax, 0x20
jne 0x140064fd7
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp], rax
jmp 0x140064fb0
lea rdx, [rsp + 0x160]
mov rcx, rbp
call fcn.140062f80
test eax, eax
js 0x140065311
movzx eax, word [rsp + 0x30]
mov qword [rsp + 0x2188], rdi
mov qword [rsp + 0x2178], r15
cmp eax, 8
je 0x140065299
cmp eax, 0x11
je 0x140065150
cmp eax, 0x13
je 0x140065121
cmp eax, 0x4008
jne 0x1400652ef
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x50], rsi
add eax, 2
movsxd rcx, eax
je 0x140065088
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14006507d
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x140065088
lea rcx, [rsp + 0x50]
call fcn.1400635b0
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x140065092
lea edi, [rbx + 0xe]
jmp 0x1400650ff
mov ecx, 0x80070057
call fcn.1400014f0
int3
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
lea rdi, [rsp + 0x160]
cmp word [rsp + 0x160], si
je 0x1400650e1
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rdi]
cmp cx, 0x5c
jne 0x1400650d1
cmp word [rax], 0x30
jne 0x1400650d1
mov word [rbx], si
mov rcx, rax
add rbx, 2
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
jmp 0x1400650dc
mov word [rbx], cx
add rbx, 2
add rdi, 2
cmp word [rdi], si
jne 0x1400650a4
mov word [rbx], si
mov word [rbx + 2], si
mov r8, qword [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call fcn.1400629d0
mov rbx, qword [rsp + 0x50]
mov edi, eax
lea rax, [rsp + 0x58]
cmp rbx, rax
je 0x1400652dd
lea rcx, [rsp + 0x50]
call fcn.140063560
mov rbx, qword [rsp + 0x38]
jmp 0x1400652e2
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x160]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r8d, dword [rsp + 0x30]
mov rdx, r13
mov rcx, r12
call fcn.140062920
mov edi, eax
jmp 0x1400652e2
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
test dil, 1
jne 0x1400651c9
mov eax, edi
mov qword [rsp + 0x50], rsi
cdq
sub eax, edx
sar eax, 1
movsxd r15, eax
mov rbx, r15
je 0x1400651d3
xor edx, edx
or rax, 0xffffffffffffffff
div rbx
cmp rax, 1
jae 0x140065195
mov ecx, 0x80070057
call fcn.1400014f0
int3
cmp rbx, 0x100
jbe 0x1400651d3
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400635e0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400651dd
lea rax, [rsp + 0x58]
test rax, rax
je 0x1400651c9
lea rcx, [rsp + 0x50]
call fcn.140063570
mov eax, 0x80004005
jmp 0x140065301
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x2180], r14
call fcn.140076300
mov r12d, esi
mov r13, rsi
mov r14, rdi
test edi, edi
jle 0x140065247
nop dword [rax]
movzx ecx, word [rsp + r13*2 + 0x160]
mov rbx, qword [rsp + 0x50]
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
movsxd rdi, eax
call fcn.140062da0
mov ecx, r12d
and ecx, 1
movzx r11d, al
mov eax, 4
shl ecx, 2
inc r13
inc r12d
sub eax, ecx
movzx ecx, al
shl r11b, cl
or byte [rdi + rbx], r11b
cmp r13, r14
jl 0x140065200
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14, qword [rsp + 0x2180]
mov edi, eax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1400652d6
lea rcx, [rsp + 0x50]
call fcn.140063570
mov rbx, qword [rsp + 0x38]
jmp 0x1400652e2
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [r12]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x1400652e2
mov rbx, qword [rsp + 0x38]
jmp 0x1400652e2
mov rbx, qword [rsp + 0x38]
test edi, edi
je 0x1400652ef
mov ecx, edi
call fcn.140062570
jmp 0x140065301
mov rdx, rbx
mov rcx, rbp
call fcn.140062f80
test eax, eax
cmovs esi, eax
mov eax, esi
mov rdi, qword [rsp + 0x2188]
mov r15, qword [rsp + 0x2178]
mov rcx, qword [rsp + 0x2160]
xor rcx, rsp
call fcn.1400762d0
add rsp, 0x2190
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret