Function at 0x1401e732f
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, reloc.WS2_32.dll_recv
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1401e734d
sub rsp, 0x28
call fcn.140014470
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140014530
add rsp, 0x10
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140014530
add rsp, 0x10
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.140014530
add rsp, 0x10
mov qword [rsp + 0x48], 0x20006
cmp qword [rsp + 0xe8], 0
je 0x1401e73da
mov r15, qword [rsp + 0x48]
or r15, 0x200
mov qword [rsp + 0x48], r15
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140012a10
add rsp, 0x28
call fcn.140014750
movabs rcx, 0x14018c282
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014770
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400147a0
or rax, rax
je 0x1401e74aa
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012ab0
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140013360
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400143a0
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140013360
add rsp, 0x28
call fcn.140014750
movabs rcx, 0x14018c282
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014770
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400147a0
or rax, rax
je 0x1401e757a
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012ab0
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140012a10
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400143a0
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e7632
movsxd r15, dword [rsp + 0xe0]
cmp r15, 3
je 0x1401e75bf
movabs rax, 0x14018e8f0
mov r8, rax
movabs rdx, gethostname
mov rcx, qword [rsp + 0xf0]
call fcn.1400139f0
jmp 0x1401e7632
mov rbp, qword [rsp + 0xf0]
mov dword [rbp], 0
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 8], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x14018c028
lea rcx, [rbp + 0xc]
call fcn.1400145a0
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 0x14], 0
mov rbp, qword [rsp + 0xf0]
mov qword [rbp + 0x18], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x14018c028
lea rcx, [rbp + 0x28]
call fcn.1400145a0
sub rsp, 8
lea rax, [rsp + 0x78]
push rax
lea rax, [rsp + 0x60]
push rax
push 0
push qword [rsp + 0x68]
push 0
xor rax, rax
mov r9, rax
movabs r8, 0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCreateKeyExW
add rsp, 0x50
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1401e7702
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e76e8
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x50]
sub rsp, 0x20
call fcn.1401e92a7
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.1400143a0
cmp qword [rsp + 0x50], 0
je 0x1401e76fa
mov rcx, qword [rsp + 0x50]
call sub.ADVAPI32.dll_RegCloseKey
xor rax, rax
jmp 0x1401e7d52
movsxd rax, dword [rsp + 0xe0]
push rax
mov r15, 3
cmp r15d, dword [rsp]
jne 0x1401e787d
mov r15, qword [rsp + 0xf8]
and r15, r15
jne 0x1401e778a
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e7768
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffd
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400145a0
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e7d52
mov rbp, qword [rsp + 0xf8]
movsxd rax, dword [rbp + 4]
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0xf8]
push qword [rbp + 0x20]
pop rax
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x60]
and r15, r15
jne 0x1401e7817
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e77f5
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffe
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_No_Pointer_to_BINARY_defined_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400145a0
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e7d52
mov r15, qword [rsp + 0x68]
and r15, r15
jne 0x1401e783c
sub rsp, 8
mov rcx, qword [rsp + 0x68]
sub rsp, 0x20
call fcn.140013ac0
add rsp, 0x28
mov qword [rsp + 0x68], rax
sub rsp, 8
push qword [rsp + 0x70]
push qword [rsp + 0x70]
movabs r9, 3
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e7ccf
mov r15, 4
cmp r15d, dword [rsp]
jne 0x1401e78ee
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140013870
add rsp, 0x28
mov dword [rsp + 0x98], eax
sub rsp, 8
push 4
lea rax, [rsp + 0xa8]
push rax
movabs r9, 4
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e7ccf
mov r15, ntohl
cmp r15d, dword [rsp]
jne 0x1401e7960
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140013870
add rsp, 0x28
mov qword [rsp + 0xa0], rax
sub rsp, 8
push 8
lea rax, [rsp + 0xb0]
push rax
movabs r9, ntohl
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e7ccf
mov r15, 2
cmp r15d, dword [rsp]
je 0x1401e797a
mov r15, 1
cmp r15d, dword [rsp]
jne 0x1401e79d1
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.1400134c0
add rsp, 0x20
add rax, 2
push rax
mov rax, qword [rsp + 0x50]
push rax
movsxd rax, dword [rsp + 0x100]
mov r9, rax
movabs r8, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1401e7ccf
mov r15, 7
cmp r15d, dword [rsp]
jne 0x1401e7ccf
sub rsp, 8
movabs rax, reloc.WS2_32.dll_ioctlsocket
mov rdx, rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012610
add rsp, 0x28
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
jmp 0x1401e7a18
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x1401e7ad5
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
mov rdx, rax
mov rcx, qword [rsp + 0x58]
pop r8
pop r9
sub rsp, 0x20
call fcn.140013560
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.1400143a0
add rsp, 0x28
mov r15, qword [rsp + 0x68]
sub rsp, 8
movabs rdx, 0x19
mov rcx, qword [rsp + 0x90]
sub rsp, 0x20
call fcn.1400134f0
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x68], r15
inc qword [rsp + 0x80]
jno 0x1401e7a18
cmp qword [rsp + 0x68], 0
je 0x1401e7ccf
sub rsp, 8
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call fcn.1400139a0
add rsp, 0x28
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1401e7c6e
mov qword [rsp + 0x80], 0
jmp 0x1401e7b16
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x1401e7c16
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
mov rdx, rax
mov rcx, qword [rsp + 0x58]
pop r8
pop r9
sub rsp, 0x20
call fcn.140013560
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.1400143a0
add rsp, 0x28
sub rsp, 8
push 0x19
push 0xffffffffffffffff
push qword [rsp + 0xa0]
mov r15, qword [rsp + 0x80]
add r15, qword [rsp + 0xb0]
mov rax, r15
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140013d70
add rsp, 0x28
mov r15, qword [rsp + 0x90]
sub rsp, 8
movabs rdx, 0x19
mov rcx, qword [rsp + 0x90]
sub rsp, 0x20
call fcn.1400134f0
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x90], r15
inc qword [rsp + 0x80]
jno 0x1401e7b16
sub rsp, 8
mov rax, qword [rsp + 0x70]
push rax
push qword [rsp + 0x70]
movsxd rax, dword [rsp + 0x100]
push rax
xor rax, rax
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
pop r9
sub rsp, 0x20
call qword [0x1401d1e28]
add rsp, 0x30
add rsp, 8
mov qword [rsp + 0x48], rax
sub rsp, 8
mov rcx, qword [rsp + 0x68]
sub rsp, 0x20
call fcn.140013a70
add rsp, 0x28
jmp 0x1401e7ccf
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1401e7cad
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xffffffff
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Cant_allocate_memory
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400145a0
add rsp, 0x28
sub rsp, 8
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x1401e7d52
pop rax
mov rcx, qword [rsp + 0x50]
call sub.ADVAPI32.dll_RegCloseKey
cmp qword [rsp + 0x40], 0
je 0x1401e7d48
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x1401e7d43
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x50]
sub rsp, 0x20
call fcn.1401e92a7
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.1400143a0
xor rax, rax
jmp 0x1401e7d52
mov rax, qword [rsp + 0x70]
jmp 0x1401e7d52
push rax
mov rcx, qword [rsp + 0x88]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
pop rax
add rsp, 0xa8
pop r15
pop rbp
ret