Function at 0x14001491d
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x78], r9
mov dword [rbp - 0x5c], r8d
mov qword [rbp - 0x70], rdx
mov eax, dword [0x140098bf4]
mov edx, dword [0x14008cfb8]
mov r8d, dword [0x14008cfbc]
shrd r8d, edx, 0x12
xor r8d, eax
xor r8d, 0xf019ec0f
imul r8d, eax
mov eax, dword [0x14008cfc0]
mov edx, dword [0x14008cfc4]
shrd edx, eax, 8
xor edx, 0xa5333f88
and edx, r8d
mov eax, dword [0x14008cfc8]
mov r8d, dword [0x14008cfcc]
shrd r8d, eax, 0xe
imul eax, dword [0x14008cfd0], 0xad1ccf0e
imul r9d, dword [0x14008cfd4], 0x94b9a064
imul r10d, dword [0x14008cfd8], 0x36b96512
imul r11d, dword [0x14008cfdc], 0x9985f2f
xor r8d, 0x2292222e
mov esi, dword [0x14008cfe0]
mov edi, dword [0x14008cfe4]
shrd edi, esi, 3
xor edi, 0x2177d656
cmp edx, r8d
mov edx, r9d
lea eax, [rax + rdx + 0x388a7222]
mov edx, r11d
mov r8d, r10d
lea edx, [r8 + rdx - 0x7b0eb538]
cmove edi, edx
cmp dword [0x140098bf8], eax
mov qword [rbp - 0x68], rcx
cmovl edi, edx
mov dword [rbp - 0x60], edi
xorps xmm6, xmm6
mov r15d, 0x821c56e5
mov r10d, r15d
mov edi, ebx
mov qword [rbp - 0x20], r13
mov rbx, r11
mov r13, r9
mov r11, r8
mov r15, rcx
cmp r10d, 0xd012e25
jg 0x140014bdb
cmp r10d, 0xca2180b5
jg 0x140014dc8
cmp r10d, 0x8fde0d49
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], r13
jg 0x140014ecc
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x28], r15
mov r8, r11
mov r9, r13
mov rax, r11
mov r11, rbx
mov r15d, edi
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov byte [rbp - 0x50], dil
mov r15d, dword [rbp - 0x60]
cmp r10d, 0x821c56e5
je 0x140014a18
mov edi, r14d
mov r12, rax
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x58]
mov r8, rax
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x48]
mov r13, qword [rbp - 0x20]
mov bl, byte [rbp - 0x50]
mov r15d, r10d
cmp r10d, 0x8de19a84
jne 0x140014a18
mov al, byte [0x14008d12c]
mov cl, byte [0x14008d12d]
shr cl, 5
shl al, 3
or al, cl
xor al, 0x95
mov r13, qword [rbp - 0x48]
mov byte [r13], al
imul eax, dword [0x14008d130], 0xe7412146
imul ecx, dword [0x14008d134], 0xc8c32426
mov edx, dword [0x140098bf4]
add eax, ecx
add eax, 0x20d27f1
xor eax, edx
mov ecx, dword [0x14008d138]
mov r8d, dword [0x14008d13c]
shrd r8d, ecx, 2
imul eax, edx
xor r8d, 0xeeeeda06
imul ecx, dword [0x14008d140], 0xa4d906f5
imul edx, dword [0x14008d144], 0xbc7a7930
and r8d, eax
mov eax, edx
add eax, ecx
add eax, 0xb39ba0b3
imul ecx, dword [0x14008d148], 0x9a4056b5
imul edx, dword [0x14008d14c], 0x22b49e26
imul r9d, dword [0x14008d150], 0x97ba3f7
imul r10d, dword [0x14008d154], 0x117d8c11
imul r11d, dword [0x14008d158], 0xcff443e5
imul ebx, dword [0x14008d15c], 0xa22aed20
cmp r8d, eax
mov eax, r10d
mov r8d, r9d
lea eax, [r8 + rax - 0x71a81712]
mov r8d, ebx
mov r9d, r11d
lea r15d, [r9 + r8 + 0x4022998e]
cmove r15d, eax
add ecx, edx
add ecx, 0xbeb7fe0a
cmp dword [0x140098bf8], ecx
cmovl r15d, eax
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x58]
mov r8, r12
mov r9, qword [rbp - 0x38]
mov r11, r13
mov r13, qword [rbp - 0x20]
mov bl, byte [rbp - 0x50]
mov r14d, edi
jmp 0x140014a18
cmp r10d, 0x647d3e81
jg 0x140014e4a
cmp r10d, 0x168dd759
jg 0x14001537c
cmp r10d, 0xd012e26
je 0x14001582d
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x28], r15
mov r8, r11
mov r9, r13
mov qword [rbp - 0x40], r11
mov r11, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], r13
mov r12, qword [rbp - 0x20]
mov r13, r12
mov ebx, edi
mov r15d, r10d
cmp r10d, 0x125312ad
jne 0x140014a18
mov byte [rbp - 0x11], r14b
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov r14, qword [rbp - 0x40]
mov rdx, qword [r14]
mov rbx, qword [rbp - 0x58]
mov r9d, dword [rbx]
mov rcx, qword [r12]
mov r8d, dword [0x14008d0c0]
mov r10d, dword [0x14008d0c4]
shrd r10d, r8d, 0x11
mov r8d, r10d
xor r8d, 0xab3f74a9
sub rsp, 0x30
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov byte [rbp - 0x50], dil
mov rdi, qword [rbp - 0x28]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x30
mov rsi, qword [rbp - 0x30]
mov dword [rsi], eax
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
add rsp, 0x20
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
movzx eax, byte [0x14008d0c8]
movzx ecx, byte [0x14008d0c9]
imul eax, eax, 0xffffffb1
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
add cl, al
add cl, 0xde
mov r13, qword [rbp - 0x48]
mov byte [r13], cl
imul eax, dword [0x14008d0cc], 0x9389deb6
imul ecx, dword [0x14008d0d0], 0xafe218be
mov edx, dword [0x140098bf4]
add eax, ecx
add eax, 0x74222a07
xor eax, edx
mov ecx, dword [0x14008d0d4]
mov r8d, dword [0x14008d0d8]
shrd r8d, ecx, 0xc
imul eax, edx
xor r8d, 0xfaf3c882
and r8d, eax
mov eax, dword [0x14008d0dc]
mov ecx, dword [0x14008d0e0]
shrd ecx, eax, 0x19
imul eax, dword [0x14008d0e4], 0x6bd2f447
mov edx, dword [0x14008d0f4]
mov r15d, dword [0x14008d0f8]
shrd r15d, edx, 0xf
imul edx, dword [0x14008d0e8], 0x2193fe62
xor ecx, 0xbfafcbb5
imul r10d, dword [0x14008d0ec], 0x77a2f21f
xor r15d, 0x6b74ec8f
imul r11d, dword [0x14008d0f0], 0xea3c1030
cmp r8d, ecx
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx - 0x2e64cdaa]
cmove r15d, ecx
add eax, edx
add eax, 0xd3f08e64
cmp dword [0x140098bf8], eax
cmovl r15d, ecx
mov rcx, rdi
mov rdx, rbx
mov r8, r14
mov r9, qword [rbp - 0x38]
mov r11, r13
mov r13, r12
mov bl, byte [rbp - 0x50]
mov r14b, byte [rbp - 0x11]
jmp 0x140014a18
cmp r10d, 0xf1292f4e
jg 0x140014fcb
cmp r10d, 0xca2180b6
mov qword [rbp - 0x40], r11
mov qword [rbp - 0x28], r15
je 0x140015502
mov r12, qword [rbp - 0x20]
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov r8, r11
mov r9, r13
mov r11, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], r13
mov r13, r12
mov ebx, edi
mov byte [rbp - 0x50], dil
mov r15d, r10d
cmp r10d, 0xd3f06247
jne 0x140014a18
mov rax, rdx
mov edi, r14d
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x48]
mov r13, r12
mov bl, byte [rbp - 0x50]
mov r15d, 0x7b937758
jmp 0x140014a18
cmp r10d, 0x7689a248
mov qword [rbp - 0x28], r15
jg 0x140015431
cmp r10d, 0x647d3e82
mov qword [rbp - 0x40], r11
je 0x140015754
mov r12, qword [rbp - 0x20]
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov r8, r11
mov r9, r13
mov r11, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], r13
mov r13, r12
mov ebx, edi
mov byte [rbp - 0x50], dil
mov r15d, r10d
cmp r10d, 0x71b77d0f
jne 0x140014a18
mov rax, rdx
mov edi, r14d
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x48]
mov r13, r12
mov bl, byte [rbp - 0x50]
mov r15d, 0x168dd75a
jmp 0x140014a18
cmp r10d, 0x8fde0d4a
mov qword [rbp - 0x40], r11
je 0x1400155d3
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov qword [rbp - 0x28], r15
mov r8, r11
mov r9, r13
mov r11, rbx
mov r12, qword [rbp - 0x20]
mov r13, r12
mov ebx, edi
mov byte [rbp - 0x50], dil
mov r15d, r10d
cmp r10d, 0xa45e9414
jne 0x140014a18
mov edi, r14d
mov rbx, rdx
mov r13, qword [rbp - 0x38]
mov eax, dword [r13]
mov r14, qword [rbp - 0x40]
mov rdx, qword [r14]
mov r9d, dword [rbx]
mov rcx, qword [r12]
mov r8d, dword [0x14008d1f8]
mov r10d, dword [0x14008d1fc]
shrd r10d, r8d, 0xd
mov r8d, r10d
xor r8d, 0xe24c1400
sub rsp, 0x30
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r15, qword [rbp - 0x28]
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x30
mov rsi, qword [rbp - 0x30]
mov dword [rsi], eax
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
add rsp, 0x20
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
mov al, byte [0x14008d200]
mov cl, byte [0x14008d201]
shr cl, 7
add al, al
or al, cl
xor al, 0xe9
mov r11, qword [rbp - 0x48]
mov byte [r11], al
mov rcx, r15
mov rdx, rbx
mov r8, r14
mov r9, r13
mov r13, r12
mov bl, byte [rbp - 0x50]
mov r14d, edi
mov r15d, 0x125312ad
jmp 0x140014a18
mov rcx, r15
mov r8, r11
mov r9, r13
mov r11, rbx
cmp r10d, 0xf1292f4f
je 0x140015743
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov r15d, r10d
cmp r10d, 0xf26acf7c
jne 0x140014a18
mov byte [rbp - 0x11], r14b
mov eax, dword [0x14008cfe8]
mov ecx, dword [0x14008cfec]
shrd ecx, eax, 0x17
xor ecx, 0x8a130e63
mov eax, ecx
add rax, 0xf
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
imul eax, dword [0x14008cff0], 0x63abfab8
imul ecx, dword [0x14008cff4], 0x410fc403
add eax, ecx
add eax, 0xf336d854
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x28], rcx
mov eax, dword [0x14008cff8]
mov edx, dword [0x14008cffc]
shrd edx, eax, 0x17
xor edx, 0x669f7f3f
mov eax, edx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x38], rdx
mov eax, dword [0x14008d000]
mov r8d, dword [0x14008d004]
shrd r8d, eax, 0x18
xor r8d, 0xaf1df3d8
mov eax, r8d
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x48], r8
imul eax, dword [0x14008d008], 0x365704a4
imul r9d, dword [0x14008d00c], 0xe9279d9
add eax, r9d
add eax, 0x73cca372
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r12, rsp
imul eax, dword [0x14008d010], 0x469d6cd6
imul r9d, dword [0x14008d014], 0x7382342b
add eax, r9d
add eax, 0x6a6c8afc
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rbx, rsp
mov eax, dword [0x14008d018]
mov r9d, dword [0x14008d01c]
shrd r9d, eax, 3
xor r9d, 0xb7e870dc
mov eax, r9d
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rsi, rsp
mov qword [rbp - 0x40], rsi
mov eax, dword [0x14008d020]
mov r9d, dword [0x14008d024]
shrd r9d, eax, 0x13
xor r9d, 0x7d53ff20
mov eax, r9d
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r15, rsp
mov qword [rbp - 0x30], r15
mov eax, dword [0x14008d028]
mov r9d, dword [0x14008d02c]
shrd r9d, eax, 0x15
xor r9d, 0xf52fc3eb
mov eax, r9d
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov r14, rdi
mov eax, dword [rbp + 0x70]
mov dword [rcx], eax
mov rax, qword [rbp - 0x78]
mov qword [rdx], rax
mov eax, dword [rbp - 0x5c]
mov dword [r8], eax
sub rsp, 0x20
mov rcx, rbx
mov rdx, qword [rbp - 0x68]
mov r13, qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call r13
mov rcx, rsi
mov rdx, qword [rbp - 0x70]
call r13
add rsp, 0x20
imul eax, dword [0x14008d030], 0x72a96e92
imul ecx, dword [0x14008d034], 0x2a0a3a43
add eax, ecx
add eax, 0xbb576038
mov dword [r12], eax
mov qword [r12 + 8], 0
mov eax, dword [0x14008d038]
mov ecx, dword [0x14008d03c]
shrd ecx, eax, 0x16
xor ecx, 0x22bbbb36
mov dword [r12 + 0x18], ecx
mov qword [r12 + 0x10], rbx
imul eax, dword [0x14008d040], 0x5ab71989
imul ecx, dword [0x14008d044], 0xb973223f
movups xmmword [r12 + 0x20], xmm6
lea edx, [rax + rcx]
add edx, 0x27abdd52
sub rsp, 0x20
mov rcx, rdi
mov r8, r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
add rsp, 0x20
mov dword [r15], eax
mov ecx, dword [0x14008d048]
mov edx, dword [0x14008d04c]
shrd edx, ecx, 0x18
xor edx, 0x65a16519
cmp eax, edx
setg bl
imul eax, dword [0x14008d050], 0xd6824419
imul ecx, dword [0x14008d054], 0x96497d83
mov edx, dword [0x140098bf4]
add eax, ecx
add eax, 0x756d9565
xor eax, edx
mov ecx, dword [0x14008d058]
mov r8d, dword [0x14008d05c]
shrd r8d, ecx, 0x17
imul eax, edx
xor r8d, 0xa8b7f8fb
imul ecx, dword [0x14008d060], 0xc8aa2494
imul edx, dword [0x14008d064], 0x88a974e5
and r8d, eax
mov eax, edx
mov edx, dword [0x14008d070]
mov r9d, dword [0x14008d074]
shrd r9d, edx, 0x18
add eax, ecx
add eax, 0xf3c15520
mov ecx, dword [0x14008d078]
mov r15d, dword [0x14008d07c]
shrd r15d, ecx, 0x1a
imul ecx, dword [str.j_v_t], 0x183b429e
xor r9d, 0xcdcc1a23
xor r15d, 0x550186f1
imul r11d, dword [0x14008d06c], 0xa00de947
cmp r8d, eax
mov eax, r11d
cmove r15d, r9d
add eax, ecx
add eax, 0x8631fe1e
cmp dword [0x140098bf8], eax
cmovl r15d, r9d
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11, qword [rbp - 0x20]
mov r13, rdi
mov r14b, byte [rbp - 0x11]
jmp 0x140014a18
cmp r10d, 0x168dd75a
mov qword [rbp - 0x28], r15
je 0x140015862
mov qword [rbp - 0x30], rsi
mov rcx, r15
mov qword [rbp - 0x58], rdx
mov r8, r11
mov r9, r13
mov qword [rbp - 0x40], r11
mov r11, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], r13
mov rax, qword [rbp - 0x20]
mov r13, rax
mov ebx, edi
mov r15d, r10d
cmp r10d, 0x366256a0
jne 0x140014a18
mov r12d, edi
mov edi, r14d
mov r13, rax
imul eax, dword [str.k__p], 0x2a992474
imul ecx, dword [0x14008d084], 0x52e4e092
imul edx, dword [0x14008d088], 0x14cac639
add eax, ecx
add eax, 0xc3fbdcbe
imul ecx, dword [0x14008d08c], 0xb41899ad
lea r15d, [rdx + rcx]
add r15d, 0xc5d6c756
test r12b, 1
cmovne r15d, eax
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x48]
mov ebx, r12d
jmp 0x140014a18
cmp r10d, 0x7b937758
jne 0x140015944
mov eax, dword [0x140098bf4]
mov ecx, dword [0x14008d190]
mov r12, rdx
mov edx, dword [0x14008d194]
shrd edx, ecx, 0xa
xor edx, eax
xor edx, 0x10d746af
imul edx, eax
mov eax, dword [0x14008d198]
mov ecx, dword [0x14008d19c]
shrd ecx, eax, 0x1c
xor ecx, 0xbb9ad4ab
and ecx, edx
imul eax, dword [0x14008d1a0], 0xc4fb2200
imul edx, dword [0x14008d1a4], 0x2f6c3f8c
add eax, edx
add eax, 0xc8c959c4
mov edx, dword [0x14008d1a8]
mov r8d, dword [0x14008d1ac]
shrd r8d, edx, 9
mov edx, dword [0x14008d1b0]
mov r9d, dword [0x14008d1b4]
shrd r9d, edx, 0x18
xor r8d, 0xc8629ea2
imul edx, dword [0x14008d1b8], 0xaa5c1d59
xor r9d, 0xd9a28418
imul r10d, dword [0x14008d1bc], 0x41ad1456
cmp ecx, eax
mov eax, r10d
mov ecx, edx
lea r15d, [rcx + rax - 0x15009e5f]
cmove r15d, r9d
cmp dword [0x140098bf8], r8d
cmovl r15d, r9d
mov r14b, byte [rbx]
jmp 0x140015929
mov eax, dword [0x14008d090]
mov ecx, dword [0x14008d094]
shrd ecx, eax, 6
mov eax, dword [0x140098bf4]
xor ecx, eax
xor ecx, 0x3a706fe5
mov r12, rdx
imul edx, dword [0x14008d098], 0xf214bb9
imul ecx, eax
imul eax, dword [0x14008d09c], 0x7de89656
add eax, edx
add eax, 0xb262e4e9
and eax, ecx
imul ecx, dword [0x14008d0a0], 0x4909e696
imul edx, dword [0x14008d0a4], 0xb5c5365f
add ecx, edx
add ecx, 0xca88eef3
mov edx, dword [str._f3_]
mov r8d, dword [0x14008d0ac]
shrd r8d, edx, 0xb
xor r8d, 0x2181460a
imul edx, dword [0x14008d0b0], 0x363b9cd4
imul r9d, dword [0x14008d0b4], 0xcd07d630
imul r10d, dword [0x14008d0b8], 0xdd77d886
imul r11d, dword [0x14008d0bc], 0xbe4be1c2
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax - 0x367581f]
mov ecx, r11d
mov edx, r10d
lea r15d, [rdx + rcx + 0x45910470]
cmove r15d, eax
cmp dword [0x140098bf8], r8d
cmovl r15d, eax
jmp 0x14001581d
mov eax, dword [str.Q__q]
mov ecx, dword [0x14008d1c4]
shrd ecx, eax, 0xa
xor ecx, 0x147b003e
mov eax, ecx
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r13, rsp
mov eax, dword [0x14008d1c8]
mov ecx, dword [0x14008d1cc]
shrd ecx, eax, 0x11
xor ecx, 0x78fe98a8
mov eax, ecx
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r12, rsp
mov eax, dword [0x14008d1d0]
mov ecx, dword [0x14008d1d4]
shrd ecx, eax, 0x1b
xor ecx, 0xf70f7278
mov eax, ecx
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, dword [0x14008d1d8]
mov ecx, dword [0x14008d1dc]
shrd ecx, eax, 0x1c
xor ecx, 0x622e625f
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x30], rsp
sub rsp, 0x20
mov rcx, r12
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp - 0x68]
mov rbx, qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call rbx
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x70]
call rbx
add rsp, 0x20
imul eax, dword [0x14008d1e0], 0xbd5da14a
imul ecx, dword [0x14008d1e4], 0x1207dfdc
add eax, ecx
add eax, 0x8b6ad988
mov dword [r13], eax
imul eax, dword [0x14008d1e8], 0xecb994f8
mov qword [r13 + 8], 0
imul ecx, dword [0x14008d1ec], 0xb8b1b10d
add eax, ecx
add eax, 0x3bf9fe1b
mov dword [r13 + 0x18], eax
mov qword [r13 + 0x10], r12
movups xmmword [r13 + 0x20], xmm6
mov eax, dword [0x14008d1f0]
mov ecx, dword [0x14008d1f4]
shrd ecx, eax, 0xb
mov edx, ecx
xor edx, 0xbcc1fb35
sub rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov r8, r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
add rsp, 0x20
mov rcx, r15
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x48]
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov r15d, 0xf26acf7c
jmp 0x140014a18
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov r15d, 0x168dd75a
jmp 0x140014a18
imul eax, dword [0x14008d0fc], 0xd0b967f8
imul ecx, dword [0x14008d100], 0x99b09725
mov r12, rdx
mov edx, dword [0x140098bf4]
add eax, ecx
add eax, 0x131690b3
xor eax, edx
imul eax, edx
imul ecx, dword [0x14008d104], 0x436dbdc9
imul edx, dword [0x14008d108], 0x63ec582e
add ecx, edx
add ecx, 0xc72de4e2
and ecx, eax
mov eax, dword [0x14008d10c]
mov edx, dword [0x14008d110]
shrd edx, eax, 0xf
imul eax, dword [0x14008d114], 0xb12a6b41
mov r8d, dword [0x14008d124]
mov r15d, dword [0x14008d128]
shrd r15d, r8d, 9
imul r8d, dword [0x14008d118], 0x70dc73c2
xor edx, 0x353793db
imul r10d, dword [0x14008d11c], 0xc8a1ca3e
xor r15d, 0x3648a861
imul r11d, dword [0x14008d120], 0xc2fa0ba5
cmp ecx, edx
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x7c3e7906]
mov edx, r8d
cmove r15d, ecx
add eax, edx
add eax, 0x4f566dae
cmp dword [0x140098bf8], eax
cmovl r15d, ecx
mov rcx, qword [rbp - 0x28]
mov rdx, r12
mov r8, qword [rbp - 0x40]
jmp 0x140015933
mov al, byte [0x14008d202]
mov cl, byte [0x14008d203]
shr cl, 3
shl al, 5
or al, cl
xor al, 0xb9
mov byte [rbx], al
mov rcx, r15
mov r8, r11
mov r9, r13
mov r11, rbx
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov r15d, 0x8de19a84
jmp 0x140014a18
mov eax, dword [0x140098bf4]
imul ecx, dword [0x14008d160], 0xfae59a91
mov r12, rdx
imul edx, dword [0x14008d164], 0xa420777
add ecx, edx
add ecx, 0xa22bcd5c
xor ecx, eax
imul edx, dword [0x14008d168], 0x234fc66d
imul ecx, eax
imul eax, dword [0x14008d16c], 0x8fbe55ea
add eax, edx
add eax, 0x60ce07fd
and eax, ecx
imul ecx, dword [0x14008d170], 0xcd084ad0
imul edx, dword [0x14008d174], 0xbebb73fd
add ecx, edx
add ecx, 0x603f426
mov edx, dword [0x14008d178]
mov r8d, dword [0x14008d17c]
shrd r8d, edx, 0x1a
mov edx, dword [0x14008d188]
mov r15d, dword [0x14008d18c]
shrd r15d, edx, 8
imul edx, dword [0x14008d180], 0x8e0b555d
xor r8d, 0xb9e66eb9
imul r10d, dword [0x14008d184], 0xdd65a35e
xor r15d, 0x2c7c3b25
cmp eax, ecx
mov eax, r10d
mov ecx, edx
lea eax, [rcx + rax - 0x4bb5390d]
cmove r15d, eax
cmp dword [0x140098bf8], r8d
cmovl r15d, eax
mov rcx, qword [rbp - 0x28]
mov rdx, r12
mov r8, r11
mov r9, r13
mov r11, rbx
mov r13, qword [rbp - 0x20]
mov ebx, edi
jmp 0x140014a18
mov rcx, r15
mov r8, r11
mov r9, r13
mov r11, rbx
mov r13, qword [rbp - 0x20]
mov ebx, edi
mov r15d, r10d
cmp r10d, 0x7689a249
jne 0x140014a18
mov eax, r14d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret