Function at 0x140033870
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x690
mov rax, qword [0x14034e010]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x14034ed78]
xor rax, 0x8b78
imul rax, rax, 0x20019
imul rax, rax, 9
mov qword [rsp + 0x1f8], rax
imul rcx, qword [0x14034ed70], 0x8b78
xor edx, edx
mov rax, rcx
mov ecx, 4
div rcx
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0xa007d]
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x100], eax
imul rax, qword [0x14034ed70], 0x8b78
xor edx, edx
mov ecx, 4
div rcx
mov rcx, qword [0x14034ed78]
xor rcx, 0x8b78
imul rcx, rcx, 9
lea rax, [rcx + rax + 5]
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x104], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x70], al
movzx eax, byte [rsp + 0x52]
mov byte [rsp + 0x78], al
movabs rax, 0x6f3afc5f17adea70
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x410], rax
movabs rax, 0xb74295235788e034
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x418], rax
movabs rax, 0x401a3c660ecd09ae
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x420], rax
movabs rax, 0x6f39fb637ee0c1f2
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x410]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x140], rax
movabs rax, 0x2a68bd0843eba523
mov qword [rsp + 0x640], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x648], rax
movabs rax, 0x401a3c665d986cc5
mov qword [rsp + 0x650], rax
movabs rax, 0x6f39fb637ee0c1f2
mov qword [rsp + 0x658], rax
lea rax, [rsp + 0x53]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x53]
mov byte [rsp + 0x80], al
movdqa xmm0, xmmword [rsp + 0x640]
movdqa xmmword [rsp + 0x510], xmm0
mov rax, qword [rsp + 0xe0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x500], xmm0
movdqa xmm0, xmmword [rsp + 0x500]
pxor xmm0, xmmword [rsp + 0x510]
movdqa xmmword [rsp + 0x520], xmm0
mov rax, qword [rsp + 0xe0]
movdqa xmm0, xmmword [rsp + 0x520]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xe0]
add rax, 0x10
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x650]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x4f0], xmm0
mov rax, qword [rsp + 0x138]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x530], xmm0
movdqa xmm0, xmmword [rsp + 0x530]
pxor xmm0, xmmword [rsp + 0x4f0]
movdqa xmmword [rsp + 0x540], xmm0
mov rax, qword [rsp + 0x138]
movdqa xmm0, xmmword [rsp + 0x540]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x220], 0x77db6
mov rax, qword [rsp + 0x220]
xor rax, 4
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x228], 4
mov rax, qword [0x14034ed70]
xor rax, 0x8b78
imul rax, rax, 5
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x240], 0x77db2
mov rax, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x230]
lea rax, [rax + rcx + 1]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
sub rax, rcx
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
xor edx, edx
div rcx
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x5d8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x100]
mov r8d, dword [rsp + 0x104]
mov rdx, qword [rsp + 0x140]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cdqe
mov rcx, qword [rsp + 0x258]
cmp rax, rcx
jne 0x140033dda
mov rcx, qword [rsp + 0x5d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140331cd4]
lea rcx, [rsp + 0x608]
call fcn.14001ea10
nop
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0xc
jae 0x140033cdd
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
jne 0x140033ca6
mov dword [rsp + 0xd0], 1
jmp 0x140033cb1
mov dword [rsp + 0xd0], 0
movzx eax, byte [rsp + 0xd0]
mov byte [rsp + 0x54], al
movzx eax, byte [rsp + 0x54]
test eax, eax
jne 0x140033cdd
lea rdx, [rsp + 0x608]
lea rcx, [rsp + 0x608]
call fcn.14001e8e0
jmp 0x140033ced
xor edx, edx
lea rcx, [rsp + 0x608]
call fcn.1400294e0
nop
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140033d15
mov dword [rsp + 0xd4], 1
jmp 0x140033d20
mov dword [rsp + 0xd4], 0
movzx eax, byte [rsp + 0xd4]
mov byte [rsp + 0x55], al
movzx eax, byte [rsp + 0x55]
test eax, eax
je 0x140033dc1
mov edx, 7
lea rcx, [rsp + 0x608]
call fcn.140168960
lea rax, str.Cleaner
mov qword [rsp + 0x278], rax
mov qword [rsp + 0xe8], 0xffffffffffffffff
inc qword [rsp + 0xe8]
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0xe8]
cmp byte [rax + rcx], 0
jne 0x140033d66
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x288], rax
mov r8, qword [rsp + 0x288]
lea rdx, str.Cleaner
lea rcx, [rsp + 0x608]
call fcn.140021ce0
nop
lea rcx, [rsp + 0x608]
call fcn.140021a50
xor al, al
jmp 0x140034be6
lea rax, [rsp + 0x56]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x57]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x14034ed78]
xor rax, 0x8b78
imul rax, rax, 0x20006
imul rax, rax, 9
mov qword [rsp + 0x290], rax
imul rcx, qword [0x14034ed70], 0x8b78
xor edx, edx
mov rax, rcx
mov ecx, 4
div rcx
mov rcx, qword [rsp + 0x290]
lea rax, [rcx + rax + 0xa001e]
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x108], eax
imul rax, qword [0x14034ed70], 0x8b78
xor edx, edx
mov ecx, 4
div rcx
mov rcx, qword [0x14034ed78]
xor rcx, 0x8b78
imul rcx, rcx, 9
lea rax, [rcx + rax + 5]
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x10c], eax
movzx eax, byte [rsp + 0x56]
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x57]
mov byte [rsp + 0x90], al
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x98], al
movabs rax, 0x6f3afc5f17adea70
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x430], rax
movabs rax, 0xb74295235788e034
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x438], rax
movabs rax, 0x401a3c660ecd09ae
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x440], rax
movabs rax, 0x6f39fb637ee0c1f2
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x430]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x150], rax
movabs rax, 0x2a68bd0843eba523
mov qword [rsp + 0x660], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x668], rax
movabs rax, 0x401a3c665d986cc5
mov qword [rsp + 0x670], rax
movabs rax, 0x6f39fb637ee0c1f2
mov qword [rsp + 0x678], rax
lea rax, [rsp + 0x59]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x59]
mov byte [rsp + 0xa0], al
movdqa xmm0, xmmword [rsp + 0x660]
movdqa xmmword [rsp + 0x560], xmm0
mov rax, qword [rsp + 0xf0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x550], xmm0
movdqa xmm0, xmmword [rsp + 0x550]
pxor xmm0, xmmword [rsp + 0x560]
movdqa xmmword [rsp + 0x570], xmm0
mov rax, qword [rsp + 0xf0]
movdqa xmm0, xmmword [rsp + 0x570]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xf0]
add rax, 0x10
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x670]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x590], xmm0
mov rax, qword [rsp + 0x148]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x580], xmm0
movdqa xmm0, xmmword [rsp + 0x580]
pxor xmm0, xmmword [rsp + 0x590]
movdqa xmmword [rsp + 0x5a0], xmm0
mov rax, qword [rsp + 0x148]
movdqa xmm0, xmmword [rsp + 0x5a0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x2b8], 0x77db6
mov rax, qword [rsp + 0x2b8]
xor rax, 4
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2c0], 4
mov rax, qword [0x14034ed70]
xor rax, 0x8b78
imul rax, rax, 5
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x2d8], 0x77db2
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2c8]
lea rax, [rax + rcx + 1]
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2d8]
sub rax, rcx
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2e8]
xor edx, edx
div rcx
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x10c]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cdqe
mov rcx, qword [rsp + 0x2f0]
cmp rax, rcx
jne 0x1400345df
mov dword [rsp + 0x5e0], 1
lea rax, [rsp + 0x5a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movsxd rax, dword [0x14034ed2c]
movsxd rcx, dword [0x14034ed44]
add rcx, 0x8b78
imul rcx, rcx, 0x8b78
add rcx, 4
movsxd rdx, dword [0x14034ed44]
add rdx, 4
imul rcx, rdx
lea rax, [rax + rcx + 0x8b7c]
mov rcx, rax
call fcn.14002ff10
mov dword [rsp + 0x110], eax
mov rax, qword [0x14034ed78]
xor rax, 0x8b78
shl rax, 2
imul rax, rax, 9
mov qword [rsp + 0x2f8], rax
imul rcx, qword [0x14034ed70], 0x8b78
xor edx, edx
mov rax, rcx
mov ecx, 4
div rcx
mov rcx, qword [rsp + 0x2f8]
lea rax, [rcx + rax + 0x14]
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x120], eax
imul rax, qword [0x14034ed70], 0x8b78
xor edx, edx
mov ecx, 4
div rcx
mov rcx, qword [0x14034ed78]
xor rcx, 0x8b78
imul rcx, rcx, 0
imul rcx, rcx, 9
add rcx, rax
mov rax, rcx
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0x124], eax
movzx eax, byte [rsp + 0x5a]
mov byte [rsp + 0xa8], al
movzx eax, byte [rsp + 0x5b]
mov byte [rsp + 0xb0], al
movzx eax, byte [rsp + 0x5c]
mov byte [rsp + 0xb8], al
movabs rax, 0x4f04d1693798cb6a
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x400], rax
movabs rax, 0xc427e7653be1ac0c
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x408], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x158], rax
movabs rax, 0x2a68bd0843eba523
mov qword [rsp + 0x630], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x638], rax
lea rax, [rsp + 0x5d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x5d]
mov byte [rsp + 0xc0], al
movdqa xmm0, xmmword [rsp + 0x630]
movdqa xmmword [rsp + 0x5c0], xmm0
mov rax, qword [rsp + 0x128]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x5b0], xmm0
movdqa xmm0, xmmword [rsp + 0x5b0]
pxor xmm0, xmmword [rsp + 0x5c0]
movdqa xmmword [rsp + 0x460], xmm0
mov rax, qword [rsp + 0x128]
movdqa xmm0, xmmword [rsp + 0x460]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x5d0]
mov qword [rsp + 0x310], rax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x120]
mov r8d, dword [rsp + 0x124]
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x310]
invalid
invalid
out 0xc9, eax
hlt