Function at 0x14001f500
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 8], rax
mov r14, rcx
mov rdi, rdx
mov rcx, qword [0x1402c0460]
mov word [rsp + 0x48], cx
lea eax, [rcx + 2]
mov word [rsp + 0x4a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x50], rax
cmp rcx, 0xfffe
jbe 0x14001f56a
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f631
lea rax, [rsp + 0x40]
xor r8d, r8d
lea r9, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xfffffffffffffff7
call fcn.140168f00
mov ebx, eax
test eax, eax
js 0x14001f5d4
xor r13d, r13d
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r13
lea rcx, [rbp]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14001f5cc
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14001f6a5
cmp ebx, 0xc0000022
je 0x14001f609
nop dword [rax]
cmp ebx, 0xc0000005
je 0x14001f609
mov eax, ebx
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x14001f5fc
movzx eax, bx
jmp 0x14001f614
nop dword [rax]
cmp eax, 0xb
jne 0x14001f618
mov eax, ebx
jmp 0x14001f614
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f627
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f631
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f691
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov esi, 0xffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001f945
lfence
jmp 0x14001f93e
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
nop dword [rax + rax]
jmp 0x14001f945
mov rcx, rdi
mov qword [rsp + 0x160], r12
call fcn.14013c700
mov rbx, rax
mov dword [rsp + 0x48], 0x10000e
mov r9d, 1
xor r8d, r8d
mov r15d, 0x10
mov edx, dword [rax]
mov rcx, qword [rax + 8]
add edx, 2
mov dword [rsp + 0x28], edx
lea rax, str.LastKey
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rbp]
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f725
nop dword [rax + rax]
call fcn.140141ea0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetSystemRoot
mov rdi, qword [rsp + 0x48]
mov rdx, qword [0x1402ca998]
lea rbx, [rdi + 0x18]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdx, qword [rsp + 0x50]
mov r8, rdi
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.14020af00
mov rcx, qword [r12 + 8]
movups xmm0, xmmword [str._regedit.exe]
movups xmmword [rdi + rcx], xmm0
movsd xmm0, qword [0x14023db28]
movsd qword [rdi + rcx + 0x10], xmm0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 8]
mov rax, qword [r12 + 8]
and ecx, 1
je 0x14001f7ca
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
jmp 0x14001f7f0
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, str.runas
mov qword [rbp - 0x3c], rcx
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0x34], ecx
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
lea rcx, [rsp + 0x60]
mov dword [rbp - 0x70], 5
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x64], 0x800540
mov dword [rsp + 0x60], 0x70
call fcn.14013bb60
test al, al
je 0x14001f834
mov rcx, qword ds:[rbp - 0x38]
test rcx, rcx
je 0x14001f927
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001f927
cmp dword [0x1402bff40], 0xffffffff
jae 0x14001f84b
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14001f851
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
test eax, eax
jns 0x14001f927
cmp eax, 0xc0000022
je 0x14001f89d
cmp eax, 0xc0000005
je 0x14001f89d
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001f88d
movzx eax, bx
jmp 0x14001f8a8
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14001f8ac
mov eax, ebx
jmp 0x14001f8a8
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f8b8
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f8c5
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f91f
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f927
lfence
call fcn.140141ea0
jmp 0x14001f927
mov edx, r15d
call sym.SystemInformer.exe_PhShowMessage
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], esi
mov r12, qword [rsp + 0x160]
cmp esi, 1
jne 0x14001f945
nop
call fcn.140141ea0
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x110
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret