Function at 0x1400ec890
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov qword [rbp + 0x1f], rdx
xor sil, sil
mov ecx, 0x22
call fcn.140368330
mov r14, rax
xor r15d, r15d
test rax, rax
je 0x1400ec9f5
movzx edx, bl
mov ecx, edx
shr rcx, 4
lea r8, str.0123456789abcdef
movzx ecx, word [r8 + rcx*2]
mov word [rax], cx
and edx, 0xf
movzx eax, word [r8 + rdx*2]
mov word [r14 + 2], ax
movzx ecx, byte [rbp + 0x68]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 4], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 6], ax
movzx ecx, byte [rbp + 0x69]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 8], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0xa], ax
movzx ecx, byte [rbp + 0x6a]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 0xc], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0xe], ax
movzx ecx, byte [rbp + 0x6b]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 0x10], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0x12], ax
movzx ecx, byte [rbp + 0x6c]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 0x14], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0x16], ax
movzx ecx, byte [rbp + 0x6d]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 0x18], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0x1a], ax
movzx ecx, byte [rbp + 0x6e]
mov eax, ecx
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [r14 + 0x1c], ax
and ecx, 0xf
movzx eax, word [r8 + rcx*2]
mov word [r14 + 0x1e], ax
mov word [r14 + 0x20], r15w
mov qword [rbp - 1], r15
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov r8d, 0x18
lea rdx, str.SOFTWAREHitmanPro.Alert
lea rcx, [rbp - 1]
call fcn.1400739a0
nop
mov rdx, qword [rbp + 0xf]
mov r8, qword [rbp + 0x17]
mov rax, r8
sub rax, rdx
mov r12d, 1
cmp rax, r12
jb 0x1400eca61
lea rcx, [rdx + 1]
mov qword [rbp + 0xf], rcx
lea rax, [rbp - 1]
cmp r8, 8
cmovae rax, qword [rbp - 1]
mov r8d, 0x5c
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r15w
jmp 0x1400eca7c
lfence
mov qword [rsp + 0x20], r12
lea r9, [0x1405e45bc]
mov rdx, r12
lea rcx, [rbp - 1]
call fcn.1400735a0
mov rcx, qword [rbp + 0xf]
mov rdx, qword [rbp + 0x17]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400ecac2
lea rdi, [rcx + 9]
mov qword [rbp + 0xf], rdi
lea rbx, [rbp - 1]
cmp rdx, 8
cmovae rbx, qword [rbp - 1]
lea rcx, [rbx + rcx*2]
mov r8d, 0x12
lea rdx, str._rampart_
call fcn.14035bc80
mov word [rbx + rdi*2], r15w
jmp 0x1400ecae3
lfence
mov qword [rsp + 0x20], 9
lea r9, str._rampart_
mov edx, 9
lea rcx, [rbp - 1]
call fcn.1400735a0
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
mov qword [rsp + 0x40], r15
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400ecb63
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, sil
test eax, eax
cmove esi, r12d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.1403683a0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x1400ecba8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ecba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ecbd4
call fcn.140359090
movzx eax, sil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140368068
int3