Function at 0x140018e3c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov ecx, 0x8eb
call fcn.140029ab4
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x1400190e6
lea rcx, [rbp - 0x40]
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x38]
xor r9d, r9d
movdqu xmmword [rbp - 0x10], xmm0
mov edx, 0xf003f
mov dword [rsp + 0x28], r15d
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x18], 0x240
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x140018ecd
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbx
call fcn.14007d45c
test eax, eax
je 0x1400190e6
lea ecx, [rax + 0xc8]
cmp ecx, eax
jbe 0x1400190e6
lea esi, [rax + rax]
cmp esi, eax
jbe 0x1400190e6
lea edx, [rsi + 0xc8]
mov ecx, 1
call fcn.140077530
mov rdi, rax
test rax, rax
je 0x1400190e6
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.1400010a0
mov ecx, esi
lea rdx, [0x14008c400]
shr rcx, 1
lea r14, [rdi + rcx*2]
mov rcx, r14
call fcn.14007d3d4
lea rcx, [rbp - 0x40]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x38]
xor r9d, r9d
movdqu xmmword [rbp - 0x10], xmm0
mov edx, 0xf003f
mov dword [rsp + 0x28], r15d
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x18], 0x240
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x1400190de
lea rdx, [0x14008c420]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x38]
lea rax, [0x14008c440]
lea rdx, [rbp - 0x40]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x1400190d4
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.1400010a0
lea rdx, [0x14008c450]
mov rcx, r14
call fcn.14007d3d4
lea rcx, [rbp - 0x40]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x40]
xor r9d, r9d
movdqu xmmword [rbp - 0x10], xmm0
mov edx, 0xf003f
mov dword [rsp + 0x28], r15d
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x18], 0x240
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x1400190d4
lea rdx, [0x14008c470]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x40]
lea rax, [0x14008c490]
lea rdx, [rbp - 0x40]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0xe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rdx, [0x14008c4a0]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x30]
lea rdx, [rbp - 0x40]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rbp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rdi
call fcn.140077564
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret