Function at 0x14005a0f0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm7
movaps xmmword [rsp + 0x100], xmm6
mov byte [rsp + 0x88], 0x10
movabs rax, 0x5c6c616d696e694d
mov qword [rsp + 0x89], rax
mov byte [rsp + 0x91], 0
lea r12, [rsp + 0x72]
lea r15, [rsp + 0x59]
mov al, 1
mov dword [rsp + 0x54], eax
lea rbp, [rsp + 0xa1]
movabs r14, 0x73006600650064
lea rsi, [rsp + 0xc0]
xorps xmm6, xmm6
movdqa xmm7, xmmword [0x1401fe130]
jmp 0x14005a178
mov dword [rsp + 0x54], 0
mov byte [rsp + 0x70], 0xc
mov qword [r12], r14
mov dword [r12 + 8], 0x720065
mov word [rsp + 0x7e], 0
mov ecx, 0x30
call fcn.14006fb50
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc0], 0x31
mov qword [rsp + 0xc8], 0x2a
movups xmm0, xmmword [0x1401fe23e]
movups xmmword [rax + 0x1a], xmm0
movups xmm0, xmmword [0x1401fe234]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.SYSTEMCurrentControlSetControlSafeBoot_]
movups xmmword [rax], xmm0
mov byte [rax + 0x2a], 0
movzx r8d, byte [rsp + 0x88]
test r8b, 1
je 0x14005a200
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
jmp 0x14005a20b
shr r8, 1
lea rdx, [rsp + 0x89]
mov rcx, rsi
call fcn.140071800
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx edi, byte [rsp + 0x70]
test dil, 1
je 0x14005a260
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
jmp 0x14005a266
shr rdi, 1
mov r13, r12
lea rbx, [rdi + rdi]
cmp rbx, 0xffffffffffffffdf
jae 0x14005a5a6
cmp rbx, 0x2d
ja 0x14005a2f0
lea eax, [rdi + rdi]
mov byte [rsp + 0x58], al
mov rax, r15
test rdi, rdi
je 0x14005a33e
lea r8, [rbx - 2]
cmp r8, 0x2e
jb 0x14005a2b6
shr r8, 1
add rbx, r13
cmp rax, rbx
jae 0x14005a500
lea rcx, [rax + r8]
inc rcx
cmp r13, rcx
jae 0x14005a500
mov rcx, rax
mov rdx, r13
lea rax, [rdi*2]
add rax, r13
nop word [rax + rax]
movzx r8d, byte [rdx]
mov byte [rcx], r8b
add rdx, 2
inc rcx
cmp rdx, rax
jne 0x14005a2d0
jmp 0x14005a341
mov rsi, r12
mov r12, r14
mov r14, rbp
mov rbp, r15
mov r15, rdi
or r15, 0xf
inc r15
mov rcx, r15
call fcn.14006fb50
mov qword [rsp + 0x68], rax
or r15, 1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rdi
mov r15, rbp
mov rbp, r14
mov r14, r12
mov r12, rsi
lea rsi, [rsp + 0xc0]
test rdi, rdi
jne 0x14005a28d
mov rcx, rax
mov byte [rcx], 0
movzx r8d, byte [rsp + 0x58]
test r8b, 1
je 0x14005a360
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
jmp 0x14005a366
shr r8, 1
mov rdx, r15
lea rcx, [rsp + 0xe0]
call fcn.140071800
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
mov rdx, rbp
je 0x14005a3ac
mov rdx, qword [rsp + 0xb0]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test byte [rsp + 0xa0], 1
jne 0x14005a4b0
test byte [rsp + 0x58], 1
jne 0x14005a4c8
test byte [rsp + 0xe0], 1
jne 0x14005a4e0
test byte [rsp + 0xc0], 1
je 0x14005a42c
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
mov rcx, qword [rsp + 0xd8]
lea rax, str.Service
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [rsp + 0x54], 1
je 0x14005a557
lea rcx, [rsp + 0x88]
lea rdx, str.Network_
call fcn.140071dc0
test byte [rsp + 0x70], 1
je 0x14005a170
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
jmp 0x14005a170
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x58], 1
je 0x14005a407
mov rcx, qword [rsp + 0x68]
call fcn.14006fbd0
test byte [rsp + 0xe0], 1
je 0x14005a415
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
jne 0x14005a41f
jmp 0x14005a42c
inc r8
mov r9, r8
and r9, 0xfffffffffffffff0
lea rcx, [rax + r9]
lea rdx, [r9*2]
add rdx, r13
xor r10d, r10d
nop dword [rax]
movdqu xmm0, xmmword [r13 + r10*2]
movdqu xmm1, xmmword [r13 + r10*2 + 0x10]
pand xmm0, xmm7
pand xmm1, xmm7
packuswb xmm0, xmm1
movdqu xmmword [rax + r10], xmm0
add r10, 0x10
cmp r9, r10
jne 0x14005a520
cmp r8, r9
jne 0x14005a2bc
jmp 0x14005a341
test byte [rsp + 0x70], 1
je 0x14005a56b
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
test byte [rsp + 0x88], 1
je 0x14005a582
mov rcx, qword [rsp + 0x98]
call fcn.14006fbd0
movaps xmm6, xmmword [rsp + 0x100]
movaps xmm7, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x58]
call fcn.140030800
jmp 0x14005a5b2
mov rsi, rax
test byte [rsp + 0xe0], 1
je 0x14005a649
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14005a653
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x70], 1
je 0x14005a65a
jmp 0x14005a68c
mov rcx, qword [rsp + 0x68]
call fcn.14006fbd0
test byte [rsp + 0xe0], 1
je 0x14005a649
jmp 0x14005a5c3
test byte [rsp + 0xe0], 1
jne 0x14005a5c3
test byte [rsp + 0xc0], 1
jne 0x14005a5da
test byte [rsp + 0x70], 1
jne 0x14005a68c
test byte [rsp + 0x88], 1
jne 0x14005a6a3
mov rcx, rsi
call fcn.14009a110
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x58], 1
je 0x14005a63b
jmp 0x14005a611
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
test byte [rsp + 0x88], 1
je 0x14005a664
mov rcx, qword [rsp + 0x98]
call fcn.14006fbd0
mov rcx, rsi
call fcn.14009a110
int3