Function at 0x1400a4780
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbx, r9
mov r11, r8
mov edi, edx
mov r15, rcx
test r8, r8
je 0x1400a4a64
lea eax, [rdx + 2]
test eax, 0xfffffffd
je 0x1400a4a64
mov rax, qword [0x1400ff050]
lea r9, [0x1400cc644]
xor r12d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, r11
mov r10d, dword [rax + 0x110]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
or r10d, 0x20006
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a4b18
sub edi, 1
je 0x1400a4ac4
sub edi, 1
je 0x1400a4a9b
sub edi, 1
je 0x1400a4947
sub edi, 1
je 0x1400a4908
cmp edi, 3
je 0x1400a4844
lea ebx, [rax + 0x57]
jmp 0x1400a4b0d
mov rsi, qword [rsp + 0xb8]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r12w
jne 0x1400a4853
lea rcx, [rbx*2 + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400a487b
lea ebx, [rax + 0xe]
jmp 0x1400a4b0d
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rdi + rbx*2], r12d
test rbx, rbx
je 0x1400a48a3
cmp word [rdi + rbx*2 - 2], 0xa
jne 0x1400a48a3
dec rbx
mov word [rdi + rbx*2], r12w
movzx ecx, word [rdi]
mov rax, rdi
test cx, cx
je 0x1400a48c7
nop
cmp cx, 0xa
jne 0x1400a48ba
mov word [rax], r12w
movzx ecx, word [rax + 2]
add rax, 2
test cx, cx
jne 0x1400a48b0
mov rdx, qword [rsp + 0xb0]
lea eax, [rbx + 2]
mov rcx, qword [rsp + 0x58]
test rbx, rbx
mov r9d, 7
cmove eax, r12d
xor r8d, r8d
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400a4b0d
mov rcx, qword [rsp + 0xb8]
cmp word [rcx], r12w
je 0x1400a491d
call fcn.140023750
jmp 0x1400a4920
mov eax, r12d
mov dword [rsp + 0xa0], eax
mov r9d, 4
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x1400a4af5
mov rdi, qword [rsp + 0xb8]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x1400a4956
test bl, 1
je 0x1400a496f
mov ebx, 0x57
jmp 0x1400a4b0d
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd r14, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x1400a4992
lea ebx, [rax + 0xe]
jmp 0x1400a4b0d
movsxd rbx, ebx
mov esi, r12d
mov r11d, r12d
test rbx, rbx
jle 0x1400a4a1b
mov r10, r12
mov rdx, r12
cmp r10, r14
jge 0x1400a4a1b
mov ecx, r12d
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
nop dword [rax]
nop dword [rax + rax]
mov r9d, ecx
movzx ecx, word [rdi + rdx*2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1400a49d8
movzx eax, cx
sub eax, 0x30
jmp 0x1400a49f8
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x1400a49e9
movzx eax, cx
sub eax, 0x37
jmp 0x1400a49f8
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x1400a4a50
movzx eax, cx
sub eax, 0x57
mov ecx, r8d
inc r11d
imul ecx, eax
inc rdx
add ecx, r9d
sub r8d, 0xf
jns 0x1400a49c0
mov byte [r10 + rbp], cl
inc esi
inc r10
cmp rdx, rbx
jl 0x1400a49a6
mov rdx, qword [rsp + 0xb0]
mov r9d, 3
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400a4b0d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400ff050]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r15
call fcn.140047940
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0xb8]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rbx*2 + 2], r12w
lea rbx, [rbx + 1]
jne 0x1400a4ab0
mov r9d, 2
jmp 0x1400a4ae5
mov rcx, qword [rsp + 0xb8]
mov rbx, 0xffffffffffffffff
cmp word [rcx + rbx*2 + 2], r12w
lea rbx, [rbx + 1]
jne 0x1400a4ad3
mov r9d, 1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0xb0]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x1400a4a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1400a4a6b