Function at 0x140069260
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
lea r9, str.hKey_x__pAry_x
lea r8, str.EntryInstalledFilesForCompatible
lea rdx, str.CRegistryIF
mov rcx, qword [rcx]
call fcn.140081070
xor r15d, r15d
mov rbx, r15
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], r15
call fcn.14009d5e8
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400692ee
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x108]
cmp dword [r8 - 0x10], 0
cmove r8, r15
lea r9, [0x1400fc394]
lea rdx, str._s_s
lea rcx, [rsp + 0x58]
call fcn.14000a800
lea r8, str.Installed_Files
mov rdx, rdi
mov rcx, rsi
call fcn.1400678e0
mov rdi, rax
test rax, rax
je 0x1400693ba
xor r9d, r9d
mov r8w, 0x2c
mov rdx, rax
mov rcx, qword [rsi + 8]
call fcn.140010520
mov r14, rax
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x68], rax
mov edx, 0x7fffffff
mov rcx, rdi
nop
cmp word [rcx], 0
je 0x140069382
add rcx, 2
sub rdx, 1
jne 0x140069370
jmp 0x140069396
test rdx, rdx
je 0x140069396
mov eax, 0x7fffffff
sub rax, rdx
mov qword [rsp + 0x70], rax
jmp 0x14006939e
mov rax, r15
mov qword [rsp + 0x70], rax
movsxd rbx, eax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsi + 8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400693fd
mov ecx, 0x30
call fcn.140091360
mov r14, rax
mov qword [rsp + 0x108], rax
test rax, rax
je 0x1400693fa
mov rcx, rax
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [r14], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [r14 + 0x28], rax
jmp 0x1400693fd
mov r14, r15
mov r13, r15
mov rax, qword [rbp + 0x10]
or r12, 0xffffffffffffffff
lea edi, [r12 + 2]
test rax, rax
jle 0x1400697ba
test r13, r13
js 0x14006943c
cmp r13, rax
jge 0x14006943c
test r13, r13
js 0x14006977e
cmp r13, rax
jge 0x14006977e
mov rax, qword [rbp + 8]
mov rsi, qword [rax + r13*8]
jmp 0x14006943f
mov rsi, r15
call fcn.14009d5e8
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x1400697af
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x108], rbx
test rsi, rsi
je 0x140069558
test rsi, 0xffffffffffff0000
jne 0x1400694a7
movzx edi, si
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x1400695ad
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.14000a990
jmp 0x1400695ad
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x140069558
mov ebp, dword [rbx - 0x10]
mov r12, rsi
sub r12, rbx
sar r12, 1
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, edx
jge 0x1400694f8
mov edx, ecx
lea rcx, [rsp + 0x108]
call fcn.140003510
mov rbx, qword [rsp + 0x108]
cmp r12, rbp
ja 0x140069518
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.1400cd640
jmp 0x140069530
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.1400cd500
test edi, edi
js 0x140069784
cmp edi, dword [rbx - 0xc]
jg 0x140069784
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
mov rbp, qword [rsp + 0x100]
or r12, 0xffffffffffffffff
jmp 0x1400695ad
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400695ad
cmp dword [rdx + 0x10], 0
jge 0x140069580
cmp dword [rbx - 0xc], 0
jl 0x14006978f
mov dword [rbx - 0x10], r15d
mov word [rbx], 0
jmp 0x1400695ad
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140069598
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x20], r15d
lea r9, [0x140104764]
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x108]
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax + 8]
call fcn.140010dd0
mov esi, r15d
mov rbx, r15
mov rax, qword [r14 + 0x10]
mov rdi, qword [rsp + 0x108]
test rax, rax
jle 0x140069647
nop
test esi, esi
jne 0x140069744
test rbx, rbx
js 0x14006961e
cmp rbx, rax
jge 0x14006961e
test rbx, rbx
js 0x14006979a
cmp rbx, rax
jge 0x14006979a
mov rax, qword [r14 + 8]
mov rcx, qword [rax + rbx*8]
jmp 0x140069621
mov rcx, r15
mov rdx, rdi
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove esi, eax
add rbx, rax
mov rax, qword [r14 + 0x10]
cmp rbx, rax
jl 0x1400695f0
test esi, esi
jne 0x14006974b
test rdi, rdi
je 0x140069720
mov ecx, 0x3fffffff
mov rax, rdi
cmp word [rax], 0
je 0x14006966a
add rax, 2
sub rcx, 1
jne 0x140069658
jmp 0x1400696dd
test rcx, rcx
je 0x1400696dd
mov eax, 0x3fffffff
sub rax, rcx
mov qword [rsp + 0x90], rax
lea rbx, [rax + rax + 2]
mov qword [rsp + 0x78], rbx
test rbx, rbx
jle 0x1400696dd
mov r8, rbx
mov edx, 8
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400696dd
mov r9, rbx
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x1400696ce
mov r8, rsi
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.1400aa678
jmp 0x1400696dd
mov r8, rsi
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x7fffffff
mov rax, rdi
mov edx, r15d
cmp word [rax], dx
je 0x1400696f9
add rax, 2
sub rcx, 1
jne 0x1400696e8
jmp 0x1400696fe
test rcx, rcx
jne 0x14006970d
mov edx, 0x80070057
mov rax, r15
mov qword [rsp + 0x60], rax
jmp 0x14006971a
mov eax, 0x7fffffff
sub rax, rcx
mov qword [rsp + 0x60], rax
test edx, edx
jns 0x140069733
jmp 0x140069725
mov edx, 0x80070057
mov rax, r15
test edx, edx
cmovs rax, r15
mov qword [rsp + 0x60], rax
cdqe
mov rbx, qword [rsp + 0x50]
add rbx, rax
mov qword [rsp + 0x50], rbx
jmp 0x140069750
mov rbx, qword [rsp + 0x50]
jmp 0x140069750
mov rbx, qword [rsp + 0x50]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006976c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r13, 1
mov rax, qword [rbp + 0x10]
cmp r13, rax
jge 0x1400697a0
jmp 0x140069416
call fcn.1400a0610
nop
mov ecx, 0x80070057
call fcn.1400034f0
int3
mov ecx, 0x80070057
call fcn.1400034f0
nop
call fcn.1400a0610
nop
mov rsi, qword [rsp + 0xf0]
mov edi, 1
jmp 0x1400697ba
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rcx, qword [r14 + 0x10]
mov rax, rcx
mov rdx, qword [rsp + 0x68]
sub rax, rdx
test rax, rax
jle 0x140069a88
sub rcx, rdx
lea rbx, [rbx + rcx + 1]
lea r8, [rbx + rbx]
mov rcx, qword [rsi + 8]
mov rsi, r15
test r8, r8
je 0x1400697fb
mov edx, 8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov rcx, qword [r14 + 0x10]
test rcx, rcx
jle 0x140069818
test rcx, rcx
jg 0x14006980f
call fcn.1400a0610
int3
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
jmp 0x14006981b
mov rdi, r15
test rbx, rbx
je 0x14006986f
cmp rbx, 0x7fffffff
ja 0x14006986f
mov rdx, rbx
mov rcx, rsi
mov r8d, 0x7ffffffe
sub r8, rbx
sub rdi, rsi
nop
nop
lea rax, [r8 + rdx]
test rax, rax
je 0x140069861
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140069861
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140069840
jmp 0x140069866
test rdx, rdx
jne 0x14006986a
sub rcx, 2
mov word [rcx], 0
mov r10d, 1
mov r9, r10
cmp r10, qword [r14 + 0x10]
jge 0x1400699da
test rbx, rbx
je 0x140069916
cmp rbx, 0x7fffffff
ja 0x140069916
mov rcx, rbx
mov rax, rsi
nop
cmp word [rax], 0
je 0x1400698b1
add rax, 2
sub rcx, r10
jne 0x1400698a0
jmp 0x140069916
test rcx, rcx
je 0x140069916
mov rdi, rbx
sub rdi, rcx
mov qword [rsp + 0x88], rdi
mov rdx, rbx
sub rdx, rdi
lea rcx, [rsi + rdi*2]
je 0x14006990d
mov rax, rdx
sub rax, rbx
lea rax, [rax + rdi + 0x7fffffff]
lea r8, [0x140104020]
sub r8, rcx
test rax, rax
je 0x140069908
movzx edi, word [r8 + rcx]
test di, di
je 0x140069908
mov word [rcx], di
add rcx, 2
sub rax, r10
sub rdx, r10
jne 0x1400698e8
jmp 0x14006990d
test rdx, rdx
jne 0x140069911
sub rcx, 2
mov word [rcx], 0
test r9, r9
js 0x140069940
mov rax, qword [r14 + 0x10]
cmp r9, rax
jge 0x140069940
test r9, r9
js 0x1400699d4
cmp r9, rax
jge 0x1400699d4
mov rax, qword [r14 + 8]
mov r8, qword [rax + r9*8]
jmp 0x140069943
mov r8, r15
test rbx, rbx
je 0x1400699c6
cmp rbx, 0x7fffffff
ja 0x1400699c6
mov rcx, rbx
mov rax, rsi
cmp word [rax], 0
je 0x140069968
add rax, 2
sub rcx, r10
jne 0x140069957
jmp 0x1400699c6
test rcx, rcx
je 0x1400699c6
mov rdi, rbx
sub rdi, rcx
mov qword [rsp + 0x98], rdi
mov rdx, rbx
sub rdx, rdi
lea rcx, [rsi + rdi*2]
je 0x1400699bd
mov rax, rdx
sub rax, rbx
lea rax, [rax + rdi + 0x7fffffff]
sub r8, rcx
test rax, rax
je 0x1400699b8
movzx edi, word [r8 + rcx]
test di, di
je 0x1400699b8
mov word [rcx], di
add rcx, 2
sub rax, r10
sub rdx, r10
jne 0x140069998
jmp 0x1400699bd
test rdx, rdx
jne 0x1400699c1
sub rcx, 2
mov word [rcx], 0
add r9, r10
cmp r9, qword [r14 + 0x10]
jge 0x1400699da
jmp 0x140069882
call fcn.1400a0610
int3
lea edi, [rbx + rbx]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r10d
lea r13, str.Installed_Files
mov qword [rsp + 0x28], r13
mov rbp, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rbp
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rbx]
call fcn.140081070
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov edi, 1
mov r9d, edi
xor r8d, r8d
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r15b
mov dword [rsp + 0x20], r15d
lea r9, [0x1400fb428]
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov rcx, qword [rbx]
call fcn.140081270
mov rcx, qword [rbx + 8]
test rsi, rsi
je 0x140069a88
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r14]
mov edx, edi
mov rcx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140069ab5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret