Function at 0x16b54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0xf0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12d, 1
mov rsi, rdx
mov rdx, rcx
lea rcx, [rsp + 0x68]
mov rbx, r8
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x5c], r12d
mov dword [rsp + 0x58], r12d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8d, [r12 + 0x27]
lea rcx, [rsp + 0xb8]
xor edx, edx
call fcn.000554c0
test rbx, rbx
je 0x16be0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
sub rcx, r12
lea r8, [rcx + rcx]
lea rcx, [rsp + 0xb8]
call fcn.000550e0
jmp 0x16bf2
lea rcx, [rsp + 0xb8]
mov edx, 9
call fcn.0002a2ec
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x40
mov qword [rsp + 0x98], rsi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov edi, eax
test eax, eax
js 0x16e1e
lea rdx, [0x000558e0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb8]
lea rdx, [rsp + 0x48]
mov r9d, r12d
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test eax, eax
js 0x16e13
lea rdx, [0x00055900]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x40]
mov ebx, 4
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x48]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rdx, [0x00055920]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx edx, word [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
add edx, 2
mov r9d, r12d
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test eax, eax
js 0x16e13
lea rdx, [0x00055940]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test eax, eax
js 0x16e13
lea rdx, [0x00055950]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00055960]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx edx, word [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
add edx, 2
mov r9d, r12d
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test eax, eax
js 0x16e13
lea rdx, [0x00055970]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x5c]
lea rdx, [rsp + 0x48]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00055060
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop r12
pop rdi
pop rsi
ret