Function at 0x140011f20
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140120100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x37], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 0x3c
lea rdx, str.U09GVFdBUkVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXI
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
mov rdx, rax
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
mov r13d, 0xf003f
mov r9d, r13d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov edi, 0x1000
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140011ff3
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x140011fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012663
call fcn.140039d60
movdqa xmm6, xmmword [0x1401148d0]
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14001203b
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x140012036
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012669
call fcn.140039d60
test ebx, ebx
jne 0x140012633
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.RGlzYWJsZUFudGlTcHl3YXJl
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], r9d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400120d7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x1400120d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001266f
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140012117
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x140012112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012675
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 0x1c
lea rdx, str.UmVhbC1UaW1lIFByb3RlY3Rpb24
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
and qword [rsp + 0x40], 0
lea rcx, [rbp + 0x27]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400121bd
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x1400121b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001267b
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x1400121fd
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x1400121f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012681
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov ebx, 0x24
mov r8d, ebx
lea rdx, str.RGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZw
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
lea r13d, [rbx - 0x20]
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140012298
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x140012293
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012687
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x1400122d8
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x1400122d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001268d
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8, rbx
lea rdx, str.RGlzYWJsZUJlaGF2aW9yTW9uaXRvcmluZw
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14001236a
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x140012365
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012693
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x1400123aa
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x1400123a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012699
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8, rbx
lea rdx, str.RGlzYWJsZVNjYW5PblJlYWx0aW1lRW5hYmxl
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14001243c
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x140012437
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001269f
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14001247c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x140012477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400126a5
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8, rbx
lea rdx, str.RGlzYWJsZU9uQWNjZXNzUHJvdGVjdGlvbg
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14001250e
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x140012509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400126ab
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14001254e
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x140012549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400126b1
call fcn.140039d60
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 0x1c
lea rdx, str.RGlzYWJsZUlPQVZQcm90ZWN0aW9u
lea rcx, [rbp - 0x19]
call fcn.140002a40
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f814
nop
mov rcx, rax
call fcn.140011e8c
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400125e3
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, rdi
jb 0x1400125de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400126b7
call fcn.140039d60
movdqu xmmword [rbp + 0x17], xmm6
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14001261f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, rdi
jb 0x14001261a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001265d
call fcn.140039d60
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140039d40
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r13, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
nop
call fcn.1400403c0
int3