Function at 0x1400335b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, r9
mov r15, r8
xor r13d, r13d
mov r14, r13
mov r9, qword [r9 + 0x20]
mov rdi, qword [rsi + 0x18]
mov rcx, r9
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
je 0x1400337ce
inc r12
cmp rdi, r9
jbe 0x140033626
call fcn.1400679f0
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
nop dword [rax + rax]
mov rbp, qword [rsi + 0x20]
cmp qword [rsi + 0x18], rbp
jbe 0x14003365f
call fcn.1400679f0
test rbx, rbx
je 0x140033669
cmp rbx, qword [rsi]
je 0x14003366e
call fcn.1400679f0
cmp rdi, rbp
je 0x1400336c9
test rbx, rbx
jne 0x140033682
call fcn.1400679f0
mov r11, r13
jmp 0x140033685
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x20]
jb 0x140033690
call fcn.1400679f0
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x1400336bf
add r12, rax
test rbx, rbx
jne 0x1400336ab
call fcn.1400679f0
mov r11, r13
jmp 0x1400336ae
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x20]
jb 0x1400336b9
call fcn.1400679f0
add rdi, 0x28
jmp 0x140033650
mov ebp, 0xd
jmp 0x14003384b
test r12, r12
je 0x1400337ce
mov edx, 2
mov rcx, r12
call fcn.1400672d4
mov r14, rax
test rax, rax
jne 0x1400336ef
lea ebp, [rax + 8]
jmp 0x14003383d
mov r13, rax
mov rdi, qword [rsi + 0x18]
cmp rdi, qword [rsi + 0x20]
jbe 0x140033701
call fcn.1400679f0
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsi + 0x20]
cmp qword [rsi + 0x18], rdi
jbe 0x140033732
call fcn.1400679f0
test rbp, rbp
je 0x14003373c
cmp rbp, qword [rsi]
je 0x140033741
call fcn.1400679f0
cmp rbx, rdi
je 0x1400337c5
test rbp, rbp
jne 0x140033754
call fcn.1400679f0
xor edx, edx
jmp 0x140033758
mov rdx, qword [rbp]
cmp rbx, qword [rdx + 0x20]
jb 0x140033763
call fcn.1400679f0
cmp qword [rbx + 0x20], 8
jb 0x140033770
mov r8, qword [rbx + 8]
jmp 0x140033774
lea r8, [rbx + 8]
mov rax, r13
sub rax, r14
sar rax, 1
mov rdx, r12
sub rdx, rax
mov rcx, r13
call fcn.140065de0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r13, [r13 + rcx*2]
test rbp, rbp
jne 0x1400337ad
call fcn.1400679f0
xor edx, edx
jmp 0x1400337b1
mov rdx, qword [rbp]
cmp rbx, qword [rdx + 0x20]
jb 0x1400337bc
call fcn.1400679f0
add rbx, 0x28
jmp 0x140033723
xor r13d, r13d
mov word [r14 + r12*2 - 2], r13w
mov eax, 0x20206
mov r9d, 0x20006
cmp byte [rsp + 0xb0], 0
cmovne r9d, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
jne 0x14003383d
lea eax, [r12 + r12]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea r9d, [rbp + 7]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14003384b
mov rcx, r14
call fcn.14006664c
nop
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x140033896
mov rbx, qword [rsi + 0x20]
cmp rdi, rbx
je 0x14003388d
add rdi, 0x20
cmp qword [rdi], 8
jb 0x140033870
mov rcx, qword [rdi - 0x18]
call fcn.140065920
mov qword [rdi], 7
mov qword [rdi - 8], r13
mov word [rdi - 0x18], r13w
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rbx
jne 0x140033861
mov rcx, qword [rsi + 0x18]
call fcn.140065920
mov qword [rsi + 0x18], r13
mov qword [rsi + 0x20], r13
mov qword [rsi + 0x28], r13
mov rcx, qword [rsi]
call fcn.140065920
mov eax, ebp
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret