Function at 0x140016406
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rbp, rcx
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.1400b9dd5
lea rax, [0x140113b89]
lea rsi, [rsp + 0xe0]
mov qword [rsi], rax
mov rcx, qword [rsi]
movabs rax, 0xa93d80564cd18442
mov qword [rsi], rax
mov rdx, qword [rsi]
call fcn.14000a6e1
and dword [rsi + 8], 0
and qword [rsi], 0
mov r8b, 1
xor edx, edx
lea rcx, [0x140116568]
test r8b, 1
je 0x140016511
movzx r9d, byte [rdx + rcx]
mov r8, rdx
or r8, 1
movzx r8d, byte [r8 + rcx]
mov r10, rdx
or r10, 2
movzx r10d, byte [r10 + rcx]
mov r11, rdx
or r11, 3
movzx r11d, byte [r11 + rcx]
mov rsi, rdx
or rsi, 4
movzx esi, byte [rsi + rcx]
mov rdi, rdx
or rdi, 5
movzx edi, byte [rdi + rcx]
mov rbx, rdx
or rbx, 6
mov r15, rdx
or r15, 7
movzx ebx, byte [rbx + rcx]
movzx r15d, byte [r15 + rcx]
shl r15, 0x38
shl rbx, 0x30
or rbx, r15
shl rdi, 0x28
shl rsi, 0x20
shl r11, 0x18
shl r10, 0x10
shl r8, 8
or r8, r9
or r8, r10
or r8, r11
or r8, rsi
or r8, rdi
or r8, rbx
xor r8, qword [rax + rdx]
mov qword [rsp + rdx + 0xe0], r8
mov edx, 8
xor r8d, r8d
jmp 0x140016467
mov edx, 8
cmp rdx, 0xb
ja 0x140016547
movzx r8d, byte [rdx + rcx + 2]
shl r8d, 0x10
movzx r9d, word [rdx + rcx]
add r8d, r9d
add r8d, 0x4e000000
xor r8d, dword [rax + rdx]
mov dword [rsp + rdx + 0xe0], r8d
add rdx, 4
jmp 0x140016516
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x48], rax
mov r12, qword [rsp + 0x60]
test r12, r12
je 0x140016671
mov r13, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
lea rax, [0x14011262c]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
movabs rax, 0x299d717dde09b896
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
call fcn.14000a9e6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor ecx, ecx
lea rdx, [0x140116574]
cmp rcx, 0x2f
ja 0x1400165d8
mov r8, qword [rcx + rdx]
xor r8, qword [rax + rcx]
mov qword [rsp + rcx + 0x60], r8
add rcx, 8
jmp 0x1400165bf
mov al, byte [rax + 0x30]
xor al, 0xc6
lea rsi, [rsp + 0x60]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
lea rdx, [rsp + 0xe0]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx + 0x20], xmm2
mov byte [rdx + 0x30], al
mov r8d, 0x31
mov rcx, rsi
call fcn.14000aa7b
lea rax, [rsp + 0xc8]
and qword [rax], 0
lea rcx, [rsp + 0x120]
and dword [rcx], 0
mov rdi, qword [rsi]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140016689
mov r14, rbx
shl r14, 0x20
or r14, 2
jmp 0x140016691
lea rdx, [rsp + 0x48]
mov r8d, 0xc
mov rcx, rbp
call fcn.140002100
jmp 0x140016af5
mov r14, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.140045a85
test ebx, ebx
je 0x1400166f5
lea rdi, [rsp + 0x60]
mov qword [rdi], r14
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.140004da7
mov rcx, rdi
call fcn.140005b1b
mov rax, qword [rbx]
test rax, rax
je 0x1400166ff
mov rcx, qword [rsp + 0x50]
mov dl, byte [rsp + 0x58]
mov r8d, dword [rsp + 0x5c]
mov dword [rbp + 0x14], r8d
mov r8d, dword [rsp + 0x59]
mov dword [rbp + 0x11], r8d
mov qword [rbp], rax
mov qword [rbp + 8], rcx
mov byte [rbp + 0x10], dl
jmp 0x140016ab3
mov qword [rsp + 0x98], r14
jmp 0x14001670c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
lea rax, [0x140112eb6]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
movabs rax, 0xce51f2220be1abd4
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
call fcn.14000aa04
and qword [rsp + 0x60], 0
mov r8b, 1
xor ecx, ecx
lea rdx, [0x1401165a5]
test r8b, 1
je 0x1400167ef
movzx r9d, byte [rcx + rdx]
mov r8, rcx
or r8, 1
movzx r8d, byte [r8 + rdx]
mov r10, rcx
or r10, 2
movzx r10d, byte [r10 + rdx]
mov r11, rcx
or r11, 3
movzx r11d, byte [r11 + rdx]
mov rsi, rcx
or rsi, 4
movzx esi, byte [rsi + rdx]
mov rdi, rcx
or rdi, 5
movzx edi, byte [rdi + rdx]
mov rbx, rcx
or rbx, 6
mov r14, rcx
or r14, 7
movzx ebx, byte [rbx + rdx]
movzx r14d, byte [r14 + rdx]
shl r14, 0x38
shl rbx, 0x30
or rbx, r14
shl rdi, 0x28
shl rsi, 0x20
shl r11, 0x18
shl r10, 0x10
shl r8, 8
or r8, r9
or r8, r10
or r8, r11
or r8, rsi
or r8, rdi
or r8, rbx
xor r8, qword [rax + rcx]
mov qword [rsp + rcx + 0x60], r8
mov ecx, 8
xor r8d, r8d
jmp 0x140016748
mov al, byte [rax + 8]
xor al, 0xc
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rcx
mov byte [rsp + 0xb8], al
add r15, r12
lea rcx, [rsp + 0xe0]
mov qword [rcx], r12
mov qword [rcx + 8], r15
and word [rcx + 0x10], 0
mov dword [rcx + 0x18], 1
call fcn.140051f34
test ax, ax
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r13
je 0x1400169b4
mov edi, edx
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.1400458e5
mov rax, qword [rsi]
inc rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
cmp rcx, 5
mov esi, 4
cmovae rsi, rcx
mov rax, rsi
shr rax, 0x3e
jne 0x140016b0a
mov qword [rsp + 0xc0], rbp
lea rbx, [rsi + rsi]
mov ecx, 2
mov rdx, rbx
call fcn.1400b4fb4
test rax, rax
je 0x140016b11
mov r13, rax
mov word [rax], di
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
lea rbp, [rsp + 0x60]
movaps xmmword [rbp + 0x10], xmm1
movaps xmmword [rbp], xmm0
mov r12d, 1
lea rbx, [rsp + 0x48]
mov r14, 0xffffffffffffffff
mov rcx, rbp
call fcn.140051f34
cmp ax, 1
jne 0x1400169aa
mov edi, edx
cmp r12, rsi
jne 0x14001699c
mov rcx, rbx
mov rdx, rbp
call fcn.1400458e5
mov r15, qword [rsp + 0x48]
inc r15
cmove r15, r14
add r15, rsi
jae 0x14001691a
xor ecx, ecx
jmp 0x140016994
lea rax, [rsi + rsi]
cmp rax, r15
cmova r15, rax
cmp r15, 5
jae 0x140016931
mov r15d, 4
xor edx, edx
mov rcx, r15
shr rcx, 0x3e
sete dl
lea r8, [r15 + r15]
add rdx, rdx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 2
lea rcx, [rsp + 0xc8]
mov r9, rbx
call fcn.1400d27f5
cmp qword [rsp + 0xc8], 0
mov rcx, qword [rsp + 0xd0]
je 0x140016984
mov r15, qword [rsp + 0xd8]
jmp 0x140016994
mov r13, rcx
mov rsi, r15
movabs rcx, 0x8000000000000001
mov rdx, r15
call fcn.140007c3a
mov word [r13 + r12*2], di
inc r12
jmp 0x1400168dd
mov rbp, qword [rsp + 0xc0]
jmp 0x1400169bf
mov r13d, 2
xor r12d, r12d
xor esi, esi
mov r14, qword [rsp + 0x98]
add r12, r12
mov rcx, r12
call fcn.1400d48da
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r13
mov r8, r12
call fcn.1400ffba0
test rsi, rsi
je 0x1400169fe
add rsi, rsi
mov edx, 2
mov rcx, r13
mov r8, rsi
call fcn.14000885e
lea r15, [rsp + 0x60]
lea rdx, [rsp + 0xb0]
mov r8d, 9
mov rcx, r15
call fcn.14000aa7b
mov r13, qword [r15]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r13
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, eax
mov rdx, qword [r15 + 8]
mov rcx, r13
call fcn.140045a85
mov rcx, rdi
mov rdx, rbx
call fcn.140053c1b
test esi, esi
je 0x140016ac7
shl rsi, 0x20
or rsi, 2
lea rdi, [rsp + 0x60]
mov qword [rdi], rsi
lea rsi, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
call fcn.140004da7
mov rcx, rdi
call fcn.140005b1b
mov rax, qword [rsi]
test rax, rax
je 0x140016ac7
movups xmm0, xmmword [rsp + 0x128]
movups xmmword [rbp + 8], xmm0
mov qword [rbp], rax
mov rcx, r14
call fcn.1400d4a43
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, 0xffffffff80000001
call fcn.1400d4a43
mov rcx, r12
mov rdx, r13
jmp 0x140016af0
and qword [rbp], 0
mov rcx, r14
call fcn.1400d4a43
mov rcx, 0xffffffff80000001
call fcn.1400d4a43
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
call fcn.140053c1b
nop
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400327d0
ud2
mov ecx, 2
mov rdx, rbx
call fcn.14010d920
ud2