Function at 0x140099bd0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r14, r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
lea r15, section..data
mov rcx, qword [section..data]
cmp rcx, r15
je 0x140099c3a
test byte [rcx + 0x1c], 1
je 0x140099c3a
cmp byte [rcx + 0x19], 5
jb 0x140099c3a
mov edx, 0x57
mov qword [rax - 0x60], r9
mov qword [rax - 0x68], r8
mov r9, rbx
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14002a9b8
xor edi, edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140005058
nop
lea rcx, [rbp - 0x30]
call fcn.1400304d8
mov rbx, qword [rbp - 0x30]
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140096824
mov esi, eax
mov r10, qword [section..data]
cmp r10, r15
je 0x140099caa
test byte [r10 + 0x1c], 2
je 0x140099caa
cmp byte [r10 + 0x19], 4
jb 0x140099caa
lea edx, [rdi + 0x58]
mov r9d, eax
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
mov r10, qword [section..data]
test esi, esi
jne 0x140099e74
mov rax, qword [0x1400cce40]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400cce40]
mov rax, qword [rax + 0x18]
call qword [case.0x140071786.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.140091e58
mov r15d, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140099d24
test byte [rcx + 0x1c], 2
je 0x140099d24
cmp byte [rcx + 0x19], 4
jb 0x140099d24
lea edx, [rsi + 0x59]
mov r9d, r15d
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
mov rdi, qword [rbp - 0x28]
xor r9d, r9d
test r15d, r15d
jne 0x140099d55
mov rax, rdi
mov r8, r14
sub r8, rdi
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x140099d4d
add rax, 2
test edx, edx
jne 0x140099d39
test ecx, ecx
je 0x140099e3c
test r14, r14
je 0x140099f49
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r9w
jne 0x140099d62
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140099dd1
test byte [rcx + 0x1c], 2
je 0x140099dd1
cmp byte [rcx + 0x19], 4
jb 0x140099dd1
mov edx, 0x5a
mov r9d, esi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.14000ad20
test r15d, r15d
jne 0x140099e3c
mov rax, qword [r13]
movabs r10, 0x9eac3e3734559970
mov edx, 0x3ec
mov rcx, r13
mov rax, qword [rax + 0x48]
call qword [case.0x140071786.0]
xor r9d, r9d
mov r8, r12
mov rdx, rbx
mov ecx, eax
call fcn.14009b29c
mov rcx, qword [section..data]
lea r15, section..data
cmp rcx, r15
je 0x140099e43
test byte [rcx + 0x1c], 2
je 0x140099e43
cmp byte [rcx + 0x19], 4
jb 0x140099e43
mov edx, 0x5b
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.1400062b0
jmp 0x140099e43
lea r15, section..data
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140099e6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
mov rbx, qword [rbp - 0x30]
jmp 0x140099ea6
cmp esi, 2
jne 0x140099ead
mov esi, 0x490
cmp r10, r15
je 0x140099ee7
test byte [r10 + 0x1c], 2
je 0x140099ead
cmp byte [r10 + 0x19], 4
jb 0x140099ead
mov edx, 0x5c
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.1400062b0
mov r10, qword [section..data]
cmp r10, r15
je 0x140099ee7
test byte [r10 + 0x1c], 1
je 0x140099ee7
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140099ee7
mov edx, 0x5d
mov r9d, esi
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140099f13
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140099f28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400055a0
int3