Function at 0x1400013a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400014e0
mov dword [rbp + 0xb8], 0x18
mov qword [rbp + 0xc0], r12
mov dword [rbp + 0xc8], r12d
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001513
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14000149f
mov rcx, qword [rdi]
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SystemConfig
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x88]
test eax, eax
je 0x14000150d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.140003220
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x140005378]
xor edx, edx
mov r8d, 1
lea rcx, [0x140005388]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000194d
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [rbp - 0x48]
movsd qword [rsp + 0x58], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp - 0x60]
movsd qword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rbp + 0x30]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [rsp + 0x58]
movsd qword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x30], xmm0
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rbp + 0x10]
movsd qword [rbp + 0x50], xmm1
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x40]
call qword [rax + 0x50]
mov ebx, eax
lea rcx, [rbp]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
js 0x140001943
mov ecx, 0x18
call fcn.140003248
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001691
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400054fc]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001c7b
jmp 0x140001694
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001cb2
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0x70]
mov rdx, qword [rbx]
call qword [rax + 0x38]
mov r15d, eax
mov r14d, 0xffffffff
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400016f9
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400016da
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400016ec
call fcn.140003240
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140003240
test r15d, r15d
js 0x140001943
mov r15, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000170f
mov r15, qword [rsi]
mov ecx, 0x18
call fcn.140003248
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001759
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14000175c
test r15, r15
jne 0x140001c86
jmp 0x14000175c
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001cb2
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400017b8
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001799
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400017ab
call fcn.140003240
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140003240
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0x68]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
js 0x140001939
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
call qword [rax + 0x78]
test eax, eax
js 0x14000192f
mov ecx, 0x18
call fcn.140003248
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000182f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x140005500]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001c91
jmp 0x140001832
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001cb2
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x40]
mov r15d, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000188d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000186e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001880
call fcn.140003240
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140003240
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
test r15d, r15d
js 0x14000192c
mov edx, 3
call qword [rax + 0x70]
mov rcx, qword [rbp + 0x78]
test eax, eax
mov rax, qword [rcx]
js 0x14000192c
mov edx, 1
call qword [rax + 0x90]
mov rcx, qword [rbp + 0x78]
test eax, eax
mov rax, qword [rcx]
js 0x14000192c
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
call qword [rax + 0x48]
test eax, eax
js 0x14000192f
mov rcx, qword [rbp + 0x90]
mov rax, qword [rcx]
lea r8, [rbp + 0x80]
mov edx, 9
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
test ebx, ebx
js 0x140001936
lea rdx, [rbp + 0x98]
call qword [rax + 0x88]
test eax, eax
jns 0x140001958
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1400014e0
mov rcx, qword [rbp + 0x98]
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x140001922
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
lea r8, [rbp + 0xa8]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x140001922
cmp qword [rdi + 0x18], 7
jbe 0x1400019bc
mov rdi, qword [rdi]
mov ecx, 0x18
call fcn.140003248
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001a06
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140001a09
test rdi, rdi
jne 0x140001c9c
jmp 0x140001a09
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001cb2
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x58]
mov edi, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001a66
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001a47
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001a59
call fcn.140003240
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140003240
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
js 0x14000192f
mov eax, 8
mov word [rsp + 0x70], ax
lea rcx, [0x140005518]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140001cbd
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp - 0x60]
movsd qword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x50], xmm0
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp + 0x30], xmm0
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbp - 0x48]
movsd qword [rbp + 0x10], xmm1
cmp qword [rsi + 0x18], 7
jbe 0x140001b2c
mov rsi, qword [rsi]
mov ecx, 0x18
call fcn.140003248
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001b76
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140001b79
test rsi, rsi
jne 0x140001ca7
jmp 0x140001b79
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c70
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 3
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp]
mov qword [rsp + 0x20], rdx
mov r9d, 6
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov edi, eax
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x140001c0f
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001bef
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001c01
call fcn.140003240
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140003240
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
js 0x14000192f
mov rcx, qword [rbp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x1400014e2
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
nop
mov ecx, 0x8007000e
call fcn.140003080
int3
mov ecx, 0x8007000e
call fcn.140003080
int3