Function at 0x14005ab20
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xe8
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp - 1], rax
mov rsi, r9
mov qword [rbp - 0x79], r9
mov rbx, r8
mov qword [rbp - 0x71], rbx
mov r12, rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], r9
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x51], rax
xor r14d, r14d
mov dword [rsp + 0x50], r14d
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x29], r14
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005ab96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005acee
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005abd7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14005acee
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005ac30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
mov rdx, qword [rdi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005ac5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005ac84
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005aca8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005acc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, 1
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005acfd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005adde
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005ad3e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], r14
mov rdx, qword [rdi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005ad6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005ad92
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005adb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005add7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor eax, eax
jmp 0x14005acce
mov qword [rbp - 0x69], r14
mov rax, qword [r12]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14005ae04
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x14005ae28
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x14005b3c6
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x69], rbx
mov dword [rsp + 0x50], 4
lea rcx, str.Capabilities
mov rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x14005ae56
mov r13, qword [r12]
movsxd r15, dword [r13 - 0x10]
lea r14d, [r15 + rsi]
test r14d, r14d
js 0x14005b3d1
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x14005ae97
mov edx, r14d
lea rcx, [rbp - 0x69]
call fcn.140018ea0
mov rbx, qword [rbp - 0x69]
add r15, r15
je 0x14005aecd
test rbx, rbx
je 0x14005aebd
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x14005aeb6
mov rdx, r13
call fcn.14022e460
jmp 0x14005aecd
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rbx]
je 0x14005aefc
test rcx, rcx
jne 0x14005aef0
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14005aefc
lea rdx, str.Capabilities
call fcn.14022e460
cmp r14d, dword [rbx - 0xc]
jg 0x14005b3d1
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r15d, r15d
mov word [rbx + rax*2], r15w
mov r13, qword [rbp - 0x11]
mov rsi, qword [r13]
cmp qword [rbp - 0x29], r15
je 0x14005af53
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9d, [r15 + 1]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
setne sil
jmp 0x14005af56
mov sil, 1
mov eax, 4
and eax, 0xfffffffb
mov dword [rsp + 0x50], eax
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005af82
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test sil, sil
jne 0x14005b188
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x19], r15
lea r8, str.Capabilities
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.1400179b0
nop
mov ebx, dword [rsp + 0x50]
or ebx, 1
mov dword [rsp + 0x50], ebx
mov rsi, qword [rax]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005afcc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005b04b
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005b005
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
lea rax, [rbp - 5]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14005b0f3
lea r8, str.CapabilitiesFileAssociations
mov rdx, r12
lea rcx, [rbp - 0x61]
call fcn.1400179b0
nop
or ebx, 2
mov dword [rsp + 0x50], ebx
mov rsi, qword [rax]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b078
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005b0f8
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b0b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14005b0f8
mov sil, 1
jmp 0x14005b0fb
xor sil, sil
test bl, 2
je 0x14005b12f
and ebx, 0xfffffffd
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005b12b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rsp + 0x50]
test bl, 1
je 0x14005b15d
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005b15d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test sil, sil
je 0x14005b1d1
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b171
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005b184
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005b197
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp - 0x71]
mov r15, qword [rbp - 0x79]
mov qword [rbp - 0x29], 0
mov rcx, r13
call fcn.1400192b0
nop
mov rcx, r12
call fcn.1400192b0
nop
mov rcx, r14
call fcn.1400192b0
nop
mov rcx, r15
call fcn.1400192b0
xor eax, eax
jmp 0x14005acce
mov r14, qword [rbp - 0x71]
mov rbx, qword [r14]
cmp qword [rbp - 0x21], 0
je 0x14005b388
test rbx, rbx
je 0x14005b388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ApplicationDescription
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005b388
mov r15, qword [rbp - 0x79]
mov rbx, qword [r15]
cmp qword [rbp - 0x21], 0
je 0x14005b342
test rbx, rbx
je 0x14005b342
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ApplicationName
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005b342
mov rbx, qword [rbp - 0x51]
mov rbx, qword [rbx]
test rbx, rbx
je 0x14005b2d5
nop
lea rax, [rbx]
mov rbx, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
cmp qword [rbp - 0x19], 0
je 0x14005b342
test rdi, rdi
je 0x14005b342
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005b342
test rbx, rbx
jne 0x14005b280
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b2e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005b2fb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], 0
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005b312
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], 0
mov rcx, r13
call fcn.1400192b0
nop
mov rcx, r12
call fcn.1400192b0
nop
mov rcx, r14
call fcn.1400192b0
nop
mov rcx, r15
call fcn.1400192b0
jmp 0x14005acc9
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b351
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005b368
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], 0
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005b19f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005b19f
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005b397
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14005b3aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], r15
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14005b19b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005b19b
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80070057
call fcn.140019300
int3