Function at 0x14002edd0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov eax, dword [0x140065e58]
xor r13d, r13d
mov qword [rsp + 0x38], rdx
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
mov rbx, rdx
mov qword [rsp + 0x40], r13
mov r12d, esi
test rcx, rcx
jne 0x14002f112
movaps xmm0, xmmword [0x14005e5b0]
lea rcx, [rbp - 0x6f]
movaps xmm1, xmmword [0x14005e5c0]
xor edx, edx
movzx eax, byte [0x14005e5f0]
mov r8d, 0xc3
movaps xmmword [rsp + 0x50], xmm0
mov r14d, r13d
movaps xmm0, xmmword [0x14005e5d0]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x14005e5e0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rbp - 0x80], xmm1
mov byte [rbp - 0x70], al
call fcn.1400376d0
movaps xmm0, xmmword [0x14005e600]
lea rcx, [rbp + 0x95]
movaps xmm1, xmmword [0x14005e610]
xor edx, edx
movzx eax, byte [0x14005e640]
mov r8d, 0xc3
movups xmmword [rbp + 0x54], xmm0
mov byte [rbp + 0x94], al
movaps xmm0, xmmword [0x14005e620]
movups xmmword [rbp + 0x64], xmm1
movaps xmm1, xmmword [0x14005e630]
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm1
call fcn.1400376d0
movaps xmm0, xmmword [0x14005e650]
lea rcx, [rbp + 0x199]
movaps xmm1, xmmword [0x14005e660]
xor edx, edx
movzx eax, byte [0x14005e690]
mov r8d, 0xc3
movups xmmword [rbp + 0x158], xmm0
mov byte [rbp + 0x198], al
movaps xmm0, xmmword [0x14005e670]
movups xmmword [rbp + 0x168], xmm1
movaps xmm1, xmmword [0x14005e680]
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm1
call fcn.1400376d0
movaps xmm0, xmmword [0x14005e6a0]
lea rcx, [rbp + 0x29d]
movaps xmm1, xmmword [0x14005e6b0]
xor edx, edx
movzx eax, byte [0x14005e6e0]
mov r8d, 0xc3
movups xmmword [rbp + 0x25c], xmm0
mov byte [rbp + 0x29c], al
movaps xmm0, xmmword [0x14005e6c0]
movups xmmword [rbp + 0x26c], xmm1
movaps xmm1, xmmword [0x14005e6d0]
movups xmmword [rbp + 0x27c], xmm0
movups xmmword [rbp + 0x28c], xmm1
call fcn.1400376d0
movaps xmm0, xmmword [0x14005e6f0]
lea rcx, [rbp + 0x3a1]
movaps xmm1, xmmword [0x14005e700]
xor edx, edx
movzx eax, byte [0x14005e730]
mov r8d, 0xc3
movaps xmmword [rbp + 0x360], xmm0
movaps xmm0, xmmword [0x14005e710]
movaps xmmword [rbp + 0x370], xmm1
movaps xmm1, xmmword [0x14005e720]
movaps xmmword [rbp + 0x380], xmm0
movaps xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x3a0], al
call fcn.1400376d0
mov r15d, r13d
nop dword [rax + rax]
cmp r15d, 5
jge 0x14002f079
movsxd rax, r15d
lea rdx, [rsp + 0x30]
imul rcx, rax, 0x104
lea rax, [rsp + 0x50]
add rcx, rax
call fcn.14002a0e0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
test eax, eax
jne 0x14002f06b
mov rbx, rsi
nop dword [rax + rax]
cmp byte [rdi + rbx + 1], r13b
lea rbx, [rbx + 1]
jne 0x14002f040
mov edx, 1
lea rcx, [rbx + 1]
call fcn.14003853c
mov r8, rdi
lea rdx, [rbx + 1]
mov rcx, rax
mov r14, rax
call fcn.140038690
inc r15d
test r12d, r12d
jne 0x14002efe0
jmp 0x14002f07e
test r12d, r12d
jne 0x14002f0de
test r14, r14
je 0x14002f0de
cmp qword [rsp + 0x40], r13
je 0x14002f0de
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], r13b
jne 0x14002f090
add rcx, 1
mov edx, 1
cmovb rcx, rsi
call fcn.14003853c
test rax, rax
je 0x14002f0ca
cmp byte [r14 + rsi + 1], r13b
lea rsi, [rsi + 1]
jne 0x14002f0b0
lea rdx, [rsi + 1]
mov r8, r14
mov rcx, rax
call fcn.140038690
mov rcx, r14
call fcn.140038520
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
jmp 0x14002f146
mov rcx, r14
call fcn.140038520
mov eax, esi
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x5d0]
add rsp, 0x580
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x40]
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
test eax, eax
jne 0x14002f0e6
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002f0e6
cmp dword [rsp + 0x48], 0xffffffff
je 0x14002f190
test r12d, r12d
jne 0x14002f190
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea r9d, [r12 + 4]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
setne r13b
mov eax, r13d
jmp 0x14002f0e8
mov eax, 1
jmp 0x14002f0e8