Function at 0x1400a24c0
Capabilities:
Check if file exists
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
movzx r14d, r9b
mov r15, rdx
mov r12, rcx
mov dword [rbp - 0x71], r8d
xor edi, edi
mov r8d, edi
mov dword [rbp - 0x79], edi
test r9b, r9b
je 0x1400a2549
lea rcx, [rbp - 0x41]
call fcn.14000c2c0
lea r8d, [rdi + 1]
mov rdx, qword [rax]
mov ecx, edi
lea r9, [0x1400f51c0]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x1400a253a
cmp rcx, 4
jne 0x1400a2521
mov eax, edi
jmp 0x1400a253f
sbb eax, eax
or eax, r8d
test eax, eax
jne 0x1400a2549
movzx ebx, r8b
jmp 0x1400a254b
xor bl, bl
or esi, 0xffffffff
test r8b, 1
je 0x1400a2571
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a2571
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
test bl, bl
je 0x1400a27ff
xor edx, edx
lea rcx, [rbp - 1]
call fcn.14009d070
nop
lea r8, str._settings.ini
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.14009f7a0
nop
cmp qword [rax + 0x18], 8
jb 0x1400a25a3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.14000c2c0
nop
mov r8, qword [rbp - 9]
cmp r8, 8
jb 0x1400a25ca
inc r8
mov rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x21]
call fcn.1400a5a00
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
mov r8, qword [rbp + 0x17]
cmp r8, 8
jb 0x1400a25f4
inc r8
mov rdx, qword [rbp - 1]
lea rcx, [rbp - 1]
call fcn.1400a5a00
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400a266d
mov eax, 0xfeff
mov word [rbp - 0x79], ax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x49]
mov r8d, 2
lea rdx, [rbp - 0x79]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140004650
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400a268c
mov ecx, 0x80004005
call fcn.140003970
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x61], rax
mov r8d, dword [rbp - 0x71]
lea rdx, [0x1400de2a0]
lea rcx, [rbp - 0x61]
call fcn.140012950
mov rdx, r15
lea rcx, [rbp - 0x39]
call fcn.14000c2c0
nop
mov rax, qword [rax]
movzx eax, word [rax]
cmp ax, word [0x1400dd1f0]
jne 0x1400a26d1
mov eax, edi
jmp 0x1400a26d6
sbb eax, eax
or eax, 1
test eax, eax
lea rbx, str.Default
cmove r15, rbx
mov rdx, r15
lea rcx, [rbp - 0x51]
call fcn.14000c2c0
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a270d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
mov rdx, r12
lea rcx, [rbp - 0x31]
call fcn.14000c2c0
nop
mov rax, qword [rax]
movzx eax, word [rax]
cmp ax, word [0x1400dd1f0]
je 0x1400a272e
sbb edi, edi
or edi, 1
test edi, edi
cmove r12, rbx
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.14000c2c0
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a275e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x61]
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov rcx, qword [rbp - 0x69]
call fcn.14009d440
test ebx, ebx
setne bl
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a27a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a27c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a27de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
nop
mov rax, qword [rbp - 0x69]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400a27fa
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.imgengine.dll_Ordinal_8 + 8]
movzx eax, bl
jmp 0x1400a2876
mov r8b, 1
movzx edx, r14b
mov rcx, r15
call fcn.1400a1ff0
mov rbx, rax
test rax, rax
je 0x1400a2857
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp rbx, qword [0x1401331c8]
je 0x1400a2857
cmp rbx, qword [0x1401331c0]
je 0x1400a2857
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14b, r14b
je 0x1400a2870
mov rcx, qword [0x1401331c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [0x1401331c8], rdi
test rbx, rbx
setne al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret