Function at 0x140015140
Capabilities:
Set registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0xb0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rdi
mov rax, qword [0x14002f220]
xor rax, rbp
mov qword [rbp + 0x40], rax
xor r15d, r15d
lea r9, [rbp + 0x1c]
mov rax, r8
mov dword [rbp + 0x18], r15d
mov r14, rcx
mov dword [rbp + 0x1c], r15d
mov rcx, rax
mov qword [rbp + 0x30], r15
lea r8, [rbp + 0x30]
mov qword [rbp + 0x38], r15
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x28], r15
mov ebx, r15d
mov dword [rbp + 0x14], r15d
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0xc], r15d
mov dword [rbp + 8], r15d
mov dword [rbp + 4], r15d
mov dword [rbp], r15d
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1400151d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400153e4
cmp dword [rbp + 0x18], r15d
je 0x14001520d
mov rcx, qword [rbp + 0x30]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x1400151c0
mov rdx, qword [rbp + 0x28]
lea r9, [rbp + 0x38]
mov ecx, dword [rbp + 0x20]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1400151c0
mov rcx, qword [r14 + 0x10]
lea rax, [rbp + 4]
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x14]
mov qword [rsp + 0x48], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0xc]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
mov eax, dword [rbp + 0x14]
movabs rdi, 0xffffffffffffff0
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001526c
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140019c20
mov eax, dword [rbp + 0x10]
sub rsp, rcx
lea rcx, [rax + 0xf]
lea rsi, [rsp + 0x60]
cmp rcx, rax
ja 0x14001528f
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140019c20
mov eax, dword [rbp + 0xc]
sub rsp, rcx
lea rcx, [rax + 0xf]
lea r9, [rsp + 0x60]
cmp rcx, rax
ja 0x1400152b2
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140019c20
mov eax, dword [rbp + 8]
sub rsp, rcx
lea rcx, [rax + 0xf]
lea r8, [rsp + 0x60]
cmp rcx, rax
ja 0x1400152d5
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140019c20
mov eax, dword [rbp + 4]
sub rsp, rcx
lea rcx, [rax + 0xf]
lea rdx, [rsp + 0x60]
cmp rcx, rax
ja 0x1400152f8
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140019c20
sub rsp, rcx
lea rcx, [rbp + 4]
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x60]
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x38], rdx
mov rdx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
je 0x1400151c0
mov r8, qword [rbp + 0x38]
xor r9d, r9d
mov edx, dword [rbp + 0x18]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1400151c0
lea r8, [rbp]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
mov eax, dword [rbp]
test eax, eax
je 0x1400153df
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400153df
lea r8, [rbp]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
test eax, eax
je 0x1400151c0
mov eax, dword [rbp]
mov r9d, 3
mov rdx, qword [r14 + 0x20]
xor r8d, r8d
mov rcx, qword [r14 + 0x18]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400153e4
jmp 0x1400151c0
mov ebx, 0x8007000e
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400153f3
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x40]
xor rcx, rbp
call fcn.140019330
mov rbx, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x80]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop rbp
ret