Function at 0x14005b640
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x130
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbp, rdx
mov rsi, rcx
mov eax, dword [0x1401c6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 1
jne 0x14005b6a6
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, 0x5c
mov rcx, qword [rsi + 0x1b8]
call fcn.1400cf2b4
or rdi, 0xffffffffffffffff
test rax, rax
jne 0x14005b6c4
mov eax, edi
jmp 0x14005b6ce
sub rax, qword [rsi + 0x1b8]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x1b8]
call fcn.14002a800
nop
mov r8d, dword [0x1401c6d80]
mov eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x14005b700
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 5
jne 0x14005b720
call fcn.1400cd268
mov r8d, dword [0x1401c6d80]
cmp r8d, eax
jne 0x14005b720
dec r8d
mov dword [0x1401c6d80], r8d
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 9
jne 0x14005b7b0
xor ecx, ecx
mov eax, 0xc907da5
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xa3
mov eax, r8d
sub eax, edx
cmp eax, 0x99
je 0x14005b7aa
nop dword [rax]
mov eax, r8d
or eax, 0xffffffce
add r8d, eax
inc ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x14005b7aa
mov eax, 0xc907da5
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xa3
mov eax, r8d
sub eax, edx
cmp eax, 0x99
jne 0x14005b770
mov dword [0x1401c6d80], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b8]
mov rcx, qword [rsi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b83d
call fcn.140052dc0
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14001b610
nop
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbp
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005b832
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x14005b83d
mov bl, 1
jmp 0x14005b93d
call fcn.1400536b0
mov rbx, rax
lea rcx, [0x1401be9a8]
mov rdx, qword [0x1401be9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x14005b89d
test rbx, 0xffffffffffff0000
jne 0x14005b88e
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14005b8b0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400026e0
jmp 0x14005b8b0
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14005b891
jmp 0x14005b89f
xor eax, eax
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400023f0
nop
call fcn.140052fc0
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b610
nop
lea r8, [rsi + 0x198]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000f540
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005b8f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140014de0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005b91e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14005b93b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bl, bl
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005b957
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400cc8b0
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret