Function at 0x14001892c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, r8
mov r15, rdx
mov rcx, qword [section..data]
lea rax, section..data
mov r14d, 5
cmp rcx, rax
je 0x140018992
test byte [rcx + 0x1c], 1
je 0x140018992
cmp byte [rcx + 0x19], r14b
jb 0x140018992
mov rax, qword [r8]
mov edx, 0xed
mov r9, qword [r15]
lea r8, [0x1400b4390]
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x78], rax
call fcn.140019374
xor r13d, r13d
mov dword [rsp + 0x28], 0x2011f
lea r8, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Media_Servers
mov qword [rsp + 0x58], r13
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x60], r13
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x68], r13
mov edi, r13d
mov qword [rsp + 0x40], r13
mov ebp, r13d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
call fcn.14000d90c
mov ebx, eax
mov r10, qword [section..data]
lea rax, section..data
lea esi, [r13 + 2]
cmp r10, rax
je 0x140018a28
test byte [r10 + 0x1c], sil
je 0x140018a28
movzx eax, byte [r10 + 0x19]
test ebx, ebx
mov edx, esi
cmove edx, r14d
cmp eax, edx
jb 0x140018a28
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400b4390]
mov edx, 0xee
mov r9d, ebx
call fcn.14000ad20
mov r10, qword [section..data]
mov r14, qword [rsp + 0x58]
test ebx, ebx
jne 0x140018b4b
mov r8, qword [r15]
lea rcx, [rsp + 0x40]
mov rdx, r14
mov dword [rsp + 0x28], 0x2011f
call fcn.14000d90c
mov ebx, eax
mov r10, qword [section..data]
lea rax, section..data
mov r15d, 5
cmp r10, rax
je 0x140018a9e
test byte [r10 + 0x1c], sil
je 0x140018a9e
movzx eax, byte [r10 + 0x19]
test ebx, ebx
mov ecx, esi
cmove ecx, r15d
cmp eax, ecx
jb 0x140018a9e
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400b4390]
mov edx, 0xef
mov r9d, ebx
call fcn.14000ad20
mov r10, qword [section..data]
test ebx, ebx
jne 0x140018b44
mov rcx, qword [r12]
test rcx, rcx
je 0x140018bf4
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140018ab7
mov rbp, qword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.UPnPDeviceID
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r10, qword [section..data]
lea r12, section..data
cmp r10, r12
je 0x140018b3e
test byte [r10 + 0x1c], sil
je 0x140018b3e
test eax, eax
movzx eax, byte [r10 + 0x19]
cmove esi, r15d
cmp eax, esi
jb 0x140018b3e
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400b4390]
mov edx, pe_nt_image_headers64
mov r9d, ebx
call fcn.14000ad20
mov r10, qword [section..data]
test ebx, ebx
je 0x140018b73
jmp 0x140018b58
mov rbp, qword [rsp + 0x40]
jmp 0x140018b51
mov r15d, 5
lea r12, section..data
test ebx, ebx
jg 0x140018b60
mov edi, ebx
jmp 0x140018b69
movzx edi, bx
or edi, 0x80070000
test edi, edi
mov eax, 0x80004005
cmovns edi, eax
cmp r10, r12
je 0x140018bab
test byte [r10 + 0x1c], 1
je 0x140018bab
movzx eax, byte [r10 + 0x19]
mov edx, edi
sar edx, 0x1f
and edx, 0xfffffffd
add edx, r15d
cmp eax, edx
jl 0x140018bab
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400b4390]
mov edx, 0xf1
mov r9d, edi
call fcn.14000637c
test rbp, rbp
je 0x140018bbf
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r14, r14
je 0x140018bd3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400055a0
int3