Function at 0x140015be8
Capabilities:
Set registry value

Disassembly:
push rax
pushf
mov eax, 0xbca9c771
pushf
not eax
add eax, 0xb05ee716
xor eax, 0xee1775e1
rol eax, 0x95
popf
pushf
not eax
add eax, 0xd361420e
xor eax, 0x8abd8dc0
rol eax, 0xa7
popf
cmp eax, 4
jne 0x140015c25
popf
pop rax
jmp 0x14001608d
cmp eax, 0
jne 0x140015c34
popf
pop rax
jmp 0x140015d15
cmp eax, 3
jne 0x140015c43
popf
pop rax
jmp 0x140015f7d
cmp eax, 1
jne 0x140015c52
popf
pop rax
jmp 0x140015e70
cmp eax, 0xd
jne 0x140015c61
popf
pop rax
jmp 0x1400165ee
cmp eax, 7
jne 0x140015c70
popf
pop rax
jmp 0x1400162cd
cmp eax, 0xe
jne 0x140015c7f
popf
pop rax
jmp 0x140016690
cmp eax, 0xb
jne 0x140015c8e
popf
pop rax
jmp 0x1400164b7
cmp eax, 0xc
jne 0x140015c9d
popf
pop rax
jmp 0x14001654e
cmp eax, 8
jne 0x140015cac
popf
pop rax
jmp 0x140016303
cmp eax, 0x10
jne 0x140015cbb
popf
pop rax
jmp 0x140016728
cmp eax, 2
jne 0x140015cca
popf
pop rax
jmp 0x140015eb8
cmp eax, 9
jne 0x140015cd9
popf
pop rax
jmp 0x140016401
cmp eax, 0xa
jne 0x140015ce8
popf
pop rax
jmp 0x14001645c
cmp eax, 6
jne 0x140015cf7
popf
pop rax
jmp 0x140016237
cmp eax, 0xf
jne 0x140015d06
popf
pop rax
jmp 0x1400166f0
cmp eax, 5
jne 0x140015d15
popf
pop rax
jmp 0x1400161a6
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x6d7d47a6
pushf
not r8d
add r8d, 0x970f91cb
xor r8d, 0xbc913d95
rol r8d, 0x47
popf
pushf
not r8d
add r8d, 0x9e43c887
xor r8d, 0xe6ade11c
rol r8d, 0x7d
popf
pushf
not r8d
add r8d, 0xb257f4b7
xor r8d, 0x9316f2e2
rol r8d, 0x73
popf
lea rdx, [0x1a6505008]
pushf
sub rdx, 0x664fd878
popf
lea rcx, [rsp + 0x40]
call fcn.140026450
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x140015e17
push rax
pushf
mov eax, 0xdb93c0a0
pushf
not eax
add eax, 0xc98744d3
xor eax, 0xdf9af2ad
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xea52a179
xor eax, 0xcfc39e29
rol eax, 6
popf
pushf
not eax
add eax, 0x90f5b598
xor eax, 0xfe81c4c8
rol eax, 0x27
popf
pushf
not eax
add eax, 0x968b46b6
xor eax, 0xbadff005
rol eax, 0x87
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0xa91e5c70
pushf
not eax
add eax, 0xd4d1730a
xor eax, 0x9e4d61d9
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xf0b1df54
xor eax, 0x80a55fbe
rol eax, 0x36
popf
pushf
not eax
add eax, 0xc5058be7
xor eax, 0xdc3794c2
rol eax, 0xef
popf
pushf
not eax
add eax, 0x916d5dd6
xor eax, 0xe2a433ea
rol eax, 0x18
popf
jmp 0x140015c16
mov rdi, qword [rdi]
push rax
pushf
mov eax, 0x9f0ccf43
pushf
not eax
add eax, 0xfb1e2880
xor eax, 0xea1cc1e7
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xb9d93401
xor eax, 0x827940ed
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xc43d36e0
xor eax, 0xa2cbf69d
rol eax, 1
popf
jmp 0x140015c16
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002dbe4
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
jmp 0x140015ee3
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140015f4a
push rax
pushf
mov eax, 0xe14ed8b8
pushf
not eax
add eax, 0x896a294e
xor eax, 0xdd1ef3c7
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xddfec398
xor eax, 0xff582fc9
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xf6fb2193
xor eax, 0xa7c6ac5e
rol eax, 0x72
popf
pushf
not eax
add eax, 0xe92d9b78
xor eax, 0xb92709ce
rol eax, 0x75
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0x1b23f664
pushf
not eax
add eax, 0xb8b16f48
xor eax, 0x9f502e18
rol eax, 0x94
popf
pushf
not eax
add eax, 0xfe5e381f
xor eax, 0x8eac8a49
rol eax, 0x12
popf
jmp 0x140015c16
mov byte [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x935eba28
pushf
not r9d
add r9d, 0xef8ffd9c
xor r9d, 0x8b14d16b
rol r9d, 0x94
popf
pushf
not r9d
add r9d, 0xe372523f
xor r9d, 0xd8719e86
rol r9d, 0x6a
popf
pushf
not r9d
add r9d, 0xff5d0b78
xor r9d, 0xe2139faa
rol r9d, 0xe5
popf
pushf
not r9d
add r9d, 0xe899d84c
xor r9d, 0xdffdc0e0
rol r9d, 0x21
popf
xor r8d, r8d
lea rdx, [0x1b08eeac2]
pushf
sub rdx, 0x708e730e
popf
mov rcx, qword [rsp + 0x30]
jmp 0x140016019
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001605a
push rax
pushf
mov eax, 0x95103991
pushf
not eax
add eax, 0xf3408c81
xor eax, 0xbff4e87e
rol eax, 0x83
popf
pushf
not eax
add eax, 0xea8a23ae
xor eax, 0xdc644f0e
rol eax, 0x5e
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0x40beda43
pushf
not eax
add eax, 0xb5be73cd
xor eax, 0xc867de6c
rol eax, 7
popf
pushf
not eax
add eax, 0xf31fdd11
xor eax, 0xa6d3ea32
rol eax, 0x8e
popf
jmp 0x140015c16
mov byte [rsp + 0x39], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0xd326c171
pushf
not r9d
add r9d, 0xcd4c9478
xor r9d, 0x872eb22b
rol r9d, 2
popf
pushf
not r9d
add r9d, 0xde2cdafa
xor r9d, 0xb3eaab4c
rol r9d, 0x56
popf
pushf
not r9d
add r9d, 0xf2b03851
xor r9d, 0xf099b2d1
rol r9d, 0x44
popf
xor r8d, r8d
lea rdx, [0x19221e04e]
pushf
sub rdx, 0x5221688e
popf
mov rcx, qword [rsp + 0x30]
jmp 0x140016110
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140016160
push rax
pushf
mov eax, 0xe36600f9
pushf
not eax
add eax, 0xe9427eb0
xor eax, 0x8892e594
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xc3fb764a
xor eax, 0xe44b118e
rol eax, 0x87
popf
pushf
not eax
add eax, 0x89980f9a
xor eax, 0x98291366
rol eax, 0x1f
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0x11546f73
pushf
not eax
add eax, 0xdb00a2fb
xor eax, 0xc70738a3
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xb4e02f9c
xor eax, 0xd77f8d9b
rol eax, 0xeb
popf
pushf
not eax
add eax, 0x9cdeea09
xor eax, 0xe986fdbb
rol eax, 0x93
popf
jmp 0x140015c16
mov byte [rsp + 0x3a], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x3a]
mov qword [rsp + 0x20], rax
mov r9d, 0x485b674a
pushf
not r9d
add r9d, 0x8408e8b9
xor r9d, 0x9e058f31
rol r9d, 0x80
popf
pushf
not r9d
add r9d, 0xff48d444
xor r9d, 0x88b38032
rol r9d, 0x32
popf
pushf
not r9d
add r9d, 0xef750b72
xor r9d, 0xdc19c724
rol r9d, 0x88
popf
xor r8d, r8d
lea rdx, [0x18511ad0a]
pushf
sub rdx, 0x4511353a
popf
mov rcx, qword [rsp + 0x30]
jmp 0x140016229
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001645c
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140016274
push rax
pushf
mov eax, 0xb92704fc
pushf
not eax
add eax, 0xcdbe07d0
xor eax, 0x860f3507
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd61a6def
xor eax, 0x8bbe8e9c
rol eax, 0x70
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0xc6b47964
pushf
not eax
add eax, 0x95383f15
xor eax, 0x88abe4db
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9f34021b
xor eax, 0xf389616b
rol eax, 0x16
popf
pushf
not eax
add eax, 0xe7ffd010
xor eax, 0xe560d5e4
rol eax, 0x11
popf
pushf
not eax
add eax, 0x96a44b84
xor eax, 0x875af842
rol eax, 0xfd
popf
jmp 0x140015c16
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0x843bd706
pushf
not eax
add eax, 0xf1abf973
xor eax, 0xb433281c
rol eax, 0xf1
popf
pushf
not eax
add eax, 0x9b4a9beb
xor eax, 0x8668e974
rol eax, 0x9f
popf
jmp 0x140015c16
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 0xaeb40704
pushf
not r9d
add r9d, 0x9bd8a293
xor r9d, 0xeff07f5d
rol r9d, 0x73
popf
pushf
not r9d
add r9d, 0xabe28ade
xor r9d, 0xb53a13e5
rol r9d, 0x36
popf
pushf
not r9d
add r9d, 0x92626533
xor r9d, 0xd25eee33
rol r9d, 0xc
popf
pushf
not r9d
add r9d, 0xfb401424
xor r9d, 0xf0cd6f27
rol r9d, 0x61
popf
xor r8d, r8d
lea rdx, [0x1b5d478dc]
pushf
sub rdx, 0x75d40104
popf
mov rcx, qword [rsp + 0x30]
jmp 0x140016391
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400163ce
push rax
pushf
mov eax, 0x2acf220b
pushf
not eax
add eax, 0x9c6bb470
xor eax, 0xcf529bd6
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xa3c2584a
xor eax, 0xba8a317f
rol eax, 7
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0xe38f1262
pushf
not eax
add eax, 0xecb6254f
xor eax, 0xd5e996a9
rol eax, 0x66
popf
pushf
not eax
add eax, 0xb812b28d
xor eax, 0x84718915
rol eax, 0x76
popf
jmp 0x140015c16
mov rcx, qword [rsp + 0x30]
jmp 0x140016407
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x1400164b7
xor bl, bl
push rax
pushf
mov eax, 0x7f995dd
pushf
not eax
add eax, 0x8c2f4ac5
xor eax, 0xf6baf745
rol eax, 0
popf
pushf
not eax
add eax, 0x8aecec32
xor eax, 0xa67f67b1
rol eax, 0x49
popf
pushf
not eax
add eax, 0xbd9971aa
xor eax, 0xdaa70a29
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xa9fb5f13
xor eax, 0xfcb1610e
rol eax, 0x6e
popf
jmp 0x140015c16
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140016508
push rax
pushf
mov eax, 0x2b59c337
pushf
not eax
add eax, 0xce51013e
xor eax, 0xed8dda70
rol eax, 0xab
popf
pushf
not eax
add eax, 0xaa5e19f1
xor eax, 0xfec80195
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xe0bc7a9f
xor eax, 0xdafe21c2
rol eax, 0x38
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0xc36a68b1
pushf
not eax
add eax, 0xa53bea06
xor eax, 0xdf647d18
rol eax, 0x23
popf
pushf
not eax
add eax, 0xee509937
xor eax, 0xaa5efe83
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x938043a2
xor eax, 0xc9a07a97
rol eax, 0x2d
popf
jmp 0x140015c16
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016595
push rax
pushf
mov eax, 0x5cb2bcdf
pushf
not eax
add eax, 0xe0a97d31
xor eax, 0xf08a8db2
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xea0bfcb4
xor eax, 0xb27e23c2
rol eax, 0x78
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0x20a0db4c
pushf
not eax
add eax, 0xb64d598f
xor eax, 0xca5c21af
rol eax, 0xa8
popf
pushf
not eax
add eax, 0x8987b7b8
xor eax, 0xe81228ff
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xf556e90d
xor eax, 0x87c328c7
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xf612a32f
xor eax, 0xe3d61977
rol eax, 0xb6
popf
jmp 0x140015c16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016636
push rax
pushf
mov eax, 0x8f3a9d21
pushf
not eax
add eax, 0xca09f06f
xor eax, 0xcca92464
rol eax, 0x71
popf
pushf
not eax
add eax, 0x94f01b20
xor eax, 0xa69b2e53
rol eax, 0xd1
popf
jmp 0x140015c16
push rax
pushf
mov eax, 0x45c56ae2
pushf
not eax
add eax, 0xebf13b5e
xor eax, 0xfc8bf90c
rol eax, 0x79
popf
pushf
not eax
add eax, 0xd38677bc
xor eax, 0xf1564cf4
rol eax, 0x60
popf
pushf
not eax
add eax, 0xf27933df
xor eax, 0xec274d7e
rol eax, 0xba
popf
pushf
not eax
add eax, 0xd5146a72
xor eax, 0xd851769d
rol eax, 0x95
popf
jmp 0x140015c16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ced0
push rax
pushf
mov eax, 0x95f6d42c
pushf
not eax
add eax, 0xb400923d
xor eax, 0xabfa3c55
rol eax, 0x47
popf
pushf
not eax
add eax, 0xdbb4fb21
xor eax, 0xe173d846
rol eax, 0xcd
popf
jmp 0x140015c16
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002a31b
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret