Function at 0x140065670
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
movabs rax, 0x26a726834db62fb8
mov dword [rbp + 0x40], 1
mov qword [rbp - 0x70], rax
lea r8, [rbp + 0x48]
movabs rax, 0x64b5ada47c740990
mov qword [rbp + 0x48], 0
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x70]
movdqa xmm0, xmmword [rbp - 0x70]
movabs rax, 0x35a92df566829a4e
mov qword [rbp - 0x60], rax
movabs rbx, 0x63f567d419f060eb
movabs rax, 0x3df23368baabc451
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x58], rax
movabs rdi, 0x1dccecd101b59cc
movdqa xmm1, xmmword [rbp - 0x60]
movabs rax, 0xc0d90fc9f0d5d410
mov qword [rbp - 0x50], rax
movabs rsi, 0x46c65f960fcfc63d
movabs rax, 0x9bbe40f57212031f
mov qword [rsp + 0x38], rdi
pxor xmm0, xmmword [rsp + 0x30]
movabs r14, 0x599c5a3fe6dfa23e
mov qword [rbp - 0x48], rax
movabs r15, 0x83a97f88aca6a37f
movdqa xmmword [rbp - 0x70], xmm0
movabs r12, 0x9bbe408113626e70
movdqa xmm0, xmmword [rbp - 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
pxor xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x140065932
movabs rax, 0x63a1679219bf60b8
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x48]
movabs rax, 0x199ce9f105a599b
mov qword [rbp - 0x68], rdi
movdqa xmm0, xmmword [rbp - 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
pxor xmm0, xmmword [rsp + 0x30]
movabs rax, 0x46aa5ff90f9fc661
mov qword [rsp + 0x40], rax
movabs rax, 0x59f95a56e6bca257
mov qword [rsp + 0x48], rax
movabs rax, 0x83c07fc5acfaa30c
movdqa xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x9bcd40ee13106e13
mov qword [rsp + 0x58], rax
movabs rax, 0x91e8c01eeb49fc8e
mov qword [rsp + 0x60], rax
movabs rax, 0x1f6f3e5d24f09a15
mov qword [rsp + 0x68], rax
movabs rax, 0xecb0d6bfa806595c
mov qword [rsp + 0x70], rax
movabs rax, 0x1c66a2156b6e6c75
mov qword [rsp + 0x78], rax
movabs rax, 0xbfa9211e77314faa
mov qword [rbp - 0x80], rax
movabs rax, 0xdce5ad77c45a0552
mov qword [rbp - 0x78], rax
movabs rax, 0x91b4c06aeb2ffce1
mov qword [rbp - 0x40], rax
movabs rax, 0x1f0b3e3324999a42
mov qword [rbp - 0x38], rax
movabs rax, 0xececd6cca8715933
mov qword [rbp - 0x30], rax
movabs rax, 0x1c25a2656b1e6c34
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x28], rax
movabs rax, 0xbfc8216e775c4fc5
mov qword [rbp - 0x20], rax
movabs rax, 0xdce5ad77c45a0526
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r14
pxor xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [rbp - 0x80]
pxor xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x140065997
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp - 0x10]
movabs rax, 0x26900bb6788309af
mov qword [rbp], rbx
mov qword [rbp - 0x10], rax
mov r9d, 4
movabs rax, 0x1dccea87e723ea2
mov qword [rbp + 8], rdi
mov qword [rbp - 8], rax
xor r8d, r8d
movdqa xmm0, xmmword [rbp - 0x10]
lea rax, [rbp + 0x40]
pxor xmm0, xmmword [rbp]
mov dword [rsp + 0x28], 4
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret