Function at 0x140005f80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x140019010]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, rdx
mov qword [rbp - 0x40], rcx
xor eax, eax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400137ec]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rbx
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400137f0]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400137f8]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
movdqa xmm1, xmmword [0x140014010]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140014000]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x2d
mov dl, 0x26
mov r8b, 0x3c
mov r9b, 0x1e
movzx r10d, cl
mov bl, 0x3a
mov dil, 0x3b
mov sil, 0x21
mov r14b, 0x27
movzx r15d, dl
mov r12b, 0x14
mov r13b, 0x1a
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r11b
xor byte [rsp + 0x53], r11b
xor byte [rsp + 0x54], r11b
xor byte [rsp + 0x55], r11b
xor byte [rsp + 0x56], r11b
xor byte [rsp + 0x57], r11b
xor byte [rsp + 0x58], r11b
xor byte [rsp + 0x59], r11b
xor byte [rsp + 0x5a], r11b
xor byte [rsp + 0x5b], r11b
xor byte [rsp + 0x5c], r11b
xor byte [rsp + 0x5d], r11b
xor byte [rsp + 0x5e], r11b
xor byte [rsp + 0x5f], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r11b
xor byte [rsp + 0x62], r11b
xor byte [rsp + 0x63], r11b
xor byte [rsp + 0x64], r11b
xor byte [rsp + 0x65], r11b
xor byte [rsp + 0x66], r11b
xor byte [rsp + 0x67], r11b
xor byte [rsp + 0x68], r11b
xor byte [rsp + 0x69], r11b
xor byte [rsp + 0x6a], r11b
xor byte [rsp + 0x6b], r11b
xor byte [rsp + 0x6c], r11b
xor byte [rsp + 0x6d], r11b
xor byte [rsp + 0x6e], r11b
xor byte [rsp + 0x6f], r11b
xor cl, r11b
mov byte [rsp + 0x70], cl
xor dl, r11b
mov byte [rsp + 0x71], dl
xor r8b, r11b
mov byte [rsp + 0x72], r8b
xor r9b, r11b
mov byte [rsp + 0x73], r9b
xor r10b, r11b
mov byte [rsp + 0x74], r10b
xor bl, r11b
mov byte [rsp + 0x75], bl
xor dil, r11b
mov byte [rsp + 0x76], dil
xor sil, r11b
mov byte [rsp + 0x77], sil
xor r14b, r11b
mov byte [rsp + 0x78], r14b
xor r15b, r11b
mov byte [rsp + 0x79], r15b
xor r12b, r11b
mov byte [rsp + 0x7a], r12b
xor r13b, r11b
mov byte [rsp + 0x7b], r13b
mov al, 0x3d
xor al, r11b
mov byte [rsp + 0x7c], al
mov al, 0x26
xor al, r11b
mov byte [rsp + 0x7d], al
mov byte [rsp + 0x7e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x51]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1400061b0
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x80]
call fcn.140007fb0
nop
mov r14d, dword [rbp - 0x70]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.140010714
mov rsi, rax
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1400070d0
mov rcx, rsi
call fcn.1400103b0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400062cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000631a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006315
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
mov edi, r15d
test esi, esi
sete dil
test esi, esi
jne 0x14000636f
lea rax, [rbp - 0x30]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x140006330
lea ebx, [rbx*2 + 2]
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, r15d
test eax, eax
sete dil
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000637e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140010390
mov rbx, qword [rsp + 0x540]
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret