Function at 0x140062590
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, rdx
mov rsi, rcx
mov r9d, dword [0x1401d6d80]
lea r8d, [r9 + 2]
lea eax, [r9 + 1]
imul r8d, eax
imul r8d, r9d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
or rdi, 0xffffffffffffffff
cmp r8d, 4
jne 0x140062623
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x7b
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
mov edx, 0x5c
mov rcx, qword [rsi + 0x1b0]
call fcn.1400d7948
test rax, rax
jne 0x14006263d
mov eax, edi
jmp 0x140062647
sub rax, qword [rsi + 0x1b0]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x80]
lea rcx, [rsi + 0x1b0]
call fcn.14002b820
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400626f6
call fcn.140058f90
mov r8, rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.14001b580
nop
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbp
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400626eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x1400626f6
mov bl, 1
jmp 0x1400627ec
mov ecx, dword [0x1401d6d80]
imul ecx, ecx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
xor ebp, ebp
cmp ecx, 3
jne 0x140062745
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
call fcn.1400598c0
mov rbx, rax
lea rcx, str.D_r_
mov rdx, qword [str.D_r_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
test rbx, rbx
je 0x1400627ac
test rbx, 0xffffffffffff0000
jne 0x140062796
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x1400627bf
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002960
jmp 0x1400627bf
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400627a0
jmp 0x1400627ae
mov eax, ebp
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002670
nop
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140063370
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400627ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bl, bl
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140062809
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret