Function at 0x140057210
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov r14, r9
mov qword [rsp + 0x48], r9
mov r12, r8
mov r15, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x68], rsi
xor r10d, r10d
mov dword [rsp + 0x30], r10d
mov r8, qword [r8]
test r8, r8
je 0x1400575c4
mov r9, qword [rsi]
mov rax, r9
sub r8, r9
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140057284
add rax, 2
test ecx, ecx
jne 0x140057270
test edx, edx
jne 0x1400572fc
mov rdx, qword [r12]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400572b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400572d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140057598
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
jmp 0x140057592
mov rdi, 0xffffffffffffffff
cmp dword [r9 - 0x10], 0
je 0x1400574af
mov qword [rsp + 0x38], r10
mov rax, qword [r14]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140057334
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x140057355
call fcn.140019590
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x1400575ae
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
lea rcx, str._bak
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140057380
mov r13, qword [r14]
movsxd r14, dword [r13 - 0x10]
lea ebp, [r14 + rsi]
test ebp, ebp
js 0x1400575b9
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400573bf
mov edx, ebp
lea rcx, [rsp + 0x38]
call fcn.140018ea0
mov rbx, qword [rsp + 0x38]
add r14, r14
je 0x1400573f5
test rbx, rbx
je 0x1400573e5
mov r8, r14
mov rcx, rbx
test r13, r13
je 0x1400573de
mov rdx, r13
call fcn.14022e460
jmp 0x1400573f5
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
movsxd r8, esi
add r8, r8
lea rcx, [r14 + rbx]
je 0x140057424
test rcx, rcx
jne 0x140057418
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x140057424
lea rdx, str._bak
call fcn.14022e460
cmp ebp, dword [rbx - 0xc]
jg 0x1400575b9
mov dword [rbx - 0x10], ebp
movsxd rax, ebp
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rsi, qword [rsp + 0x40]
mov rsi, qword [rsi]
cmp qword [r15], rcx
je 0x140057474
test rsi, rsi
je 0x140057474
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400574a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [r12]
cmp qword [r15], 0
je 0x1400574eb
test rbx, rbx
je 0x1400574eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140267540]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rbp + 0x38]
cmp dword [rbx - 0x10], 0
je 0x14005752e
cmp qword [r15], 0
je 0x14005752e
test rbx, rbx
je 0x14005752e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.PerceivedType
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140057553
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140057577
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140057598
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
mov eax, 1
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3