Function at 0x140002813
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, 0x10
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140002831
sub rsp, 0x28
call fcn.1400505f0
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140050660
add rsp, 0x10
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140050660
add rsp, 0x10
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.140050660
add rsp, 0x10
mov qword [rsp + 0x48], 0x20006
cmp qword [rsp + 0xe8], 0
je 0x1400028be
mov r15, qword [rsp + 0x48]
or r15, 0x200
mov qword [rsp + 0x48], r15
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14004d6a0
add rsp, 0x28
call fcn.1400504c0
movabs rcx, 0x1400c663a
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400504f0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.140050540
or rax, rax
je 0x14000298f
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14004d740
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14004d760
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140050310
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
push 1
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14004d760
add rsp, 0x28
call fcn.1400504c0
movabs rcx, 0x1400c663a
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400504f0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.140050540
or rax, rax
je 0x140002a60
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14004d740
add rsp, 0x28
mov r15, rax
dec r15
mov rax, r15
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14004d6a0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140050310
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x140002b14
movsxd r15, dword [rsp + 0xe0]
cmp r15, 3
je 0x140002aa1
movabs rax, 0x1400cd868
push rax
push 0x30
push qword [rsp + 0x100]
pop rcx
pop rdx
pop r8
call fcn.14004eb00
jmp 0x140002b14
mov rbp, qword [rsp + 0xf0]
mov dword [rbp], 0
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 8], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x1400c6042
lea rcx, [rbp + 0xc]
call fcn.1400501d0
mov rbp, qword [rsp + 0xf0]
mov dword [rbp + 0x14], 0
mov rbp, qword [rsp + 0xf0]
mov qword [rbp + 0x18], 0
mov rbp, qword [rsp + 0xf0]
movabs rdx, 0x1400c6042
lea rcx, [rbp + 0x28]
call fcn.1400501d0
sub rsp, 8
lea rax, [rsp + 0x78]
mov rax, rax
push rax
lea rax, [rsp + 0x60]
mov rax, rax
push rax
push 0
push qword [rsp + 0x68]
push 0
movabs rax, 0x1400c6042
push rax
push 0
push qword [rsp + 0x68]
push qword [rsp + 0x108]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegCreateKeyExW
add rsp, 0x50
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140002bee
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x140002bd4
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400502c0
add rsp, 0x20
pop rcx
push rax
push qword [rsp + 0x50]
pop rcx
sub rsp, 0x20
call fcn.14000479a
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.140050310
cmp qword [rsp + 0x50], 0
je 0x140002be6
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
xor rax, rax
jmp 0x14000324d
movsxd rax, dword [rsp + 0xe0]
push rax
mov r15, 3
cmp r15, qword [rsp]
jne 0x140002d68
mov r15, qword [rsp + 0xf8]
and r15, r15
jne 0x140002c76
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x140002c54
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffd
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
sub rsp, 8
push qword [rsp + 0x60]
pop rcx
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x14000324d
mov rbp, qword [rsp + 0xf8]
movsxd rax, dword [rbp + 4]
push rax
pop rax
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0xf8]
push qword [rbp + 0x20]
pop rax
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x60]
and r15, r15
jne 0x140002d05
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x140002ce3
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xfffffffe
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_No_Pointer_to_BINARY_defined_
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
sub rsp, 8
push qword [rsp + 0x60]
pop rcx
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x14000324d
mov r15, qword [rsp + 0x68]
and r15, r15
jne 0x140002d2a
sub rsp, 8
push qword [rsp + 0x68]
pop rcx
sub rsp, 0x20
call fcn.14004eb10
add rsp, 0x28
mov qword [rsp + 0x68], rax
sub rsp, 8
push qword [rsp + 0x70]
push qword [rsp + 0x70]
push 3
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1400031ca
mov r15, 4
cmp r15, qword [rsp]
jne 0x140002dde
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14004d870
add rsp, 0x28
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x98], eax
sub rsp, 8
push 4
lea rax, [rsp + 0xa8]
mov rax, rax
push rax
push 4
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1400031ca
mov r15, 0xb
cmp r15, qword [rsp]
jne 0x140002e50
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14004d870
add rsp, 0x28
mov qword [rsp + 0xa0], rax
sub rsp, 8
push 8
lea rax, [rsp + 0xb0]
mov rax, rax
push rax
push 0xb
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1400031ca
mov r15, 2
cmp r15, qword [rsp]
je 0x140002e6a
mov r15, 1
cmp r15, qword [rsp]
jne 0x140002ecd
sub rsp, 8
push qword [rsp + 0x48]
pop rcx
sub rsp, 0x20
call fcn.14004d9a0
add rsp, 0x20
mov r15, rax
add r15, 2
mov rax, r15
push rax
mov rax, qword [rsp + 0x50]
mov rax, rax
push rax
movsxd rax, dword [rsp + 0x100]
mov rax, rax
push rax
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x38
mov qword [rsp + 0x48], rax
jmp 0x1400031ca
mov r15, 7
cmp r15, qword [rsp]
jne 0x1400031ca
sub rsp, 8
movabs rax, 0x1400c6094
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14004d480
add rsp, 0x28
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
jmp 0x140002f13
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x140002fcb
push rcx
sub rsp, 0x20
call fcn.1400502c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x1400c6094
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14004d520
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.140050310
add rsp, 0x28
mov r15, qword [rsp + 0x68]
sub rsp, 8
push 0x19
push qword [rsp + 0x98]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14004d9d0
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x68], r15
inc qword [rsp + 0x80]
jno 0x140002f13
cmp qword [rsp + 0x68], 0
je 0x1400031ca
sub rsp, 8
push qword [rsp + 0x70]
pop rcx
sub rsp, 0x20
call fcn.14004eb30
add rsp, 0x28
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140003169
mov qword [rsp + 0x80], 0
jmp 0x14000300c
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x80]
jl 0x140003106
push rcx
sub rsp, 0x20
call fcn.1400502c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x1400c6094
push rax
mov r15, qword [rsp + 0x98]
inc r15
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14004d520
add rsp, 0x20
lea rcx, [rsp + 0x90]
pop rdx
sub rsp, 0x28
call fcn.140050310
add rsp, 0x28
sub rsp, 8
push 0x19
push 0xffffffffffffffff
push qword [rsp + 0xa0]
mov r15, qword [rsp + 0x80]
add r15, qword [rsp + 0xb0]
mov rax, r15
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14004eb80
add rsp, 0x28
mov r15, qword [rsp + 0x90]
sub rsp, 8
push 0x19
push qword [rsp + 0x98]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14004d9d0
add rsp, 0x28
add r15, rax
add r15, 2
mov qword [rsp + 0x90], r15
inc qword [rsp + 0x80]
jno 0x14000300c
sub rsp, 8
mov rax, qword [rsp + 0x70]
mov rax, rax
push rax
push qword [rsp + 0x70]
movsxd rax, dword [rsp + 0x100]
push rax
xor rax, rax
mov rax, rax
push rax
push qword [rsp + 0x60]
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call qword [0x140a754c0]
add rsp, 0x30
push rax
pop rax
add rsp, 8
mov qword [rsp + 0x48], rax
sub rsp, 8
push qword [rsp + 0x68]
pop rcx
sub rsp, 0x20
call fcn.14004ed10
add rsp, 0x28
jmp 0x1400031ca
mov r15, qword [rsp + 0xf8]
and r15, r15
je 0x1400031a8
mov rbp, qword [rsp + 0xf8]
mov dword [rbp + 8], 0xffffffff
mov rbp, qword [rsp + 0xf8]
movabs rdx, str.Error:_Cant_allocate_memory
lea rcx, [rbp + 0xc]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
sub rsp, 8
push qword [rsp + 0x60]
pop rcx
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegCloseKey
add rsp, 0x28
xor rax, rax
add rsp, 8
jmp 0x14000324d
pop rax
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
cmp qword [rsp + 0x40], 0
je 0x140003243
mov r15, qword [rsp + 0xf0]
and r15, r15
je 0x14000323e
push qword [rsp + 0x40]
mov rbp, qword [rsp + 0xf8]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400502c0
add rsp, 0x20
pop rcx
push rax
push qword [rsp + 0x50]
pop rcx
sub rsp, 0x20
call fcn.14000479a
add rsp, 0x28
mov rbp, qword [rsp + 0xf8]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.140050310
xor rax, rax
jmp 0x14000324d
mov rax, qword [rsp + 0x70]
jmp 0x14000324d
push rax
mov rcx, qword [rsp + 0x88]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
pop rax
add rsp, 0xa8
pop r15
pop rbp
ret