Function at 0x140010ef0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x18b0]
mov eax, 0x19b0
call fcn.1401089d0
sub rsp, rax
mov rax, qword [0x1401ffe18]
xor rax, rsp
mov qword [rbp + 0x1868], rax
movdqa xmm0, xmmword [0x140114340]
lea rcx, [rsp + 0x30]
pxor xmm0, xmmword [0x140114460]
lea rdx, [rbp + 0x790]
movdqa xmm1, xmmword [0x140114350]
xor edi, edi
pxor xmm1, xmmword [0x140114470]
mov r8d, 0x860
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [0x140114360]
pxor xmm0, xmmword [0x140114480]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [0x140114370]
pxor xmm1, xmmword [0x140114490]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmm0, xmmword [0x140114380]
pxor xmm0, xmmword [0x1401144a0]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmm1, xmmword [0x140114390]
pxor xmm1, xmmword [0x1401144b0]
movdqa xmmword [rbp + 0x7d0], xmm0
movdqa xmm0, xmmword [0x1401143a0]
pxor xmm0, xmmword [0x1401144c0]
movdqa xmmword [rbp + 0x7e0], xmm1
movdqa xmm1, xmmword [0x1401143b0]
pxor xmm1, xmmword [0x1401144d0]
movdqa xmmword [rbp + 0x7f0], xmm0
movdqa xmm0, xmmword [0x1401143c0]
pxor xmm0, xmmword [0x1401144e0]
movdqa xmmword [rbp + 0x800], xmm1
movdqa xmm1, xmmword [0x1401143d0]
pxor xmm1, xmmword [0x1401144f0]
movdqa xmmword [rbp + 0x810], xmm0
movdqa xmm0, xmmword [0x1401143e0]
pxor xmm0, xmmword [0x140114500]
movdqa xmmword [rbp + 0x820], xmm1
movdqa xmm1, xmmword [0x1401143f0]
pxor xmm1, xmmword [0x140114510]
movdqa xmmword [rbp + 0x830], xmm0
movdqa xmm0, xmmword [0x140114400]
pxor xmm0, xmmword [0x140114520]
movdqa xmmword [rbp + 0x840], xmm1
movdqa xmm1, xmmword [0x140114410]
pxor xmm1, xmmword [0x140114530]
movdqa xmmword [rbp + 0x850], xmm0
movdqa xmm0, xmmword [0x140114420]
pxor xmm0, xmmword [0x140114540]
movdqa xmmword [rbp + 0x860], xmm1
movdqa xmm1, xmmword [0x140114430]
pxor xmm1, xmmword [0x140114550]
movdqa xmmword [rbp + 0x870], xmm0
movdqa xmm0, xmmword [0x140114440]
pxor xmm0, xmmword [0x140114560]
movdqa xmmword [rbp + 0x880], xmm1
movdqa xmm1, xmmword [0x140114450]
pxor xmm1, xmmword [0x140114570]
movdqa xmmword [rbp + 0x890], xmm0
movdqa xmmword [rbp + 0x8a0], xmm1
mov qword [rbp + 0x1850], rdi
mov dword [rbp + 0x1864], 4
mov dword [rbp + 0x1858], edi
mov dword [rbp + 0x185c], edi
mov dword [rbp + 0x1860], 4
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rbp + 0x1850]
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140011130
xor al, al
jmp 0x1400120af
mov qword [rsp + 0x19c0], rbx
lea rcx, [rbp + 0x790]
movaps xmmword [rsp + 0x19a0], xmm6
movabs rax, 0x17bb960dd15a1dc3
mov qword [rsp + 0x30], rax
xorps xmm5, xmm5
movaps xmmword [rsp + 0x1990], xmm7
movabs rax, 0x18246e032536271c
mov qword [rsp + 0x38], rax
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0xca857bbf7bbb158
mov qword [rsp + 0x40], rax
xorps xmm7, xmm7
movabs rax, 0x4a58a238386d0cc
movaps xmmword [rsp + 0x1980], xmm8
mov qword [rsp + 0x48], rax
xorps xmm2, xmm2
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0xa158a15115b655f
mov qword [rsp + 0x50], rax
xorps xmm3, xmm3
movabs rax, 0x2cc5c6d7d3eea8e
movaps xmmword [rsp + 0x1970], xmm9
mov qword [rsp + 0x58], rax
xorps xmm4, xmm4
movabs rax, 0x17cf966cd13f1d85
pxor xmm5, xmm2
mov qword [rbp - 0x70], rax
pxor xmm6, xmm3
movabs rax, 0x18776e6625442769
movdqa xmmword [rbp + 0x7c0], xmm5
mov qword [rbp - 0x68], rax
pxor xmm7, xmm4
pxor xmm0, xmmword [rbp - 0x70]
movabs rax, 0xcc157cff7cfb13d
mov qword [rbp - 0x60], rax
mov ebx, 6
movabs rax, 0x4ea8a5083e1d0a2
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov edx, ebx
mov qword [rbp - 0x58], rax
movabs rax, 0xa678a67113e6529
pxor xmm1, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0x2cc5c087d5aeae7
mov qword [rbp - 0x48], rax
lea rax, [rsp + 0x30]
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmmword [rbp + 0x7d0], xmm6
movdqa xmmword [rbp + 0x7e0], xmm7
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140011290
mov rcx, qword [rbp + 0x1850]
lea rax, [rbp + 0x1860]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1864]
lea rax, [rbp + 0x1858]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140011692
movabs rax, 0x6ce70b9d55fd159
lea rcx, [rbp + 0x790]
mov qword [rsp + 0x30], rax
xorps xmm5, xmm5
movabs rax, 0x17fd56bc37a95cad
xorps xmm6, xmm6
mov qword [rsp + 0x38], rax
xorps xmm7, xmm7
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0x1a0606ce66ce755f
mov qword [rsp + 0x40], rax
xorps xmm2, xmm2
movabs rax, 0xde358001161cf49
xorps xmm3, xmm3
mov qword [rsp + 0x48], rax
xorps xmm4, xmm4
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0x47b847b55600921
mov qword [rsp + 0x50], rax
pxor xmm5, xmm2
movabs rax, 0x1bac758ddc7b152f
movdqa xmmword [rbp + 0x7c0], xmm5
mov qword [rsp + 0x58], rax
pxor xmm6, xmm3
movabs rax, 0x6ba70d8d53ad11f
movdqa xmmword [rbp + 0x7d0], xmm6
mov qword [rbp - 0x70], rax
pxor xmm7, xmm4
movabs rax, 0x17ae56d937db5cd8
movdqa xmmword [rbp + 0x7e0], xmm7
mov qword [rbp - 0x68], rax
mov rdx, rbx
pxor xmm0, xmmword [rbp - 0x70]
movabs rax, 0x1a6f06ba66ba753a
mov qword [rbp - 0x60], rax
movabs rax, 0xdac58731106cf27
mov qword [rbp - 0x58], rax
movabs rax, 0x409840955050957
pxor xmm1, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0x1bac75e8dc1f1546
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x48], rax
lea rax, [rsp + 0x30]
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7a0], xmm1
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140011450
movdqa xmm0, xmmword [0x140114a00]
lea rcx, [rbp + 0xff0]
pxor xmm0, xmmword [0x140114b20]
lea rdx, [rbp + 0x790]
movdqa xmm1, xmmword [0x140114a10]
mov r8d, 0x860
pxor xmm1, xmmword [0x140114b30]
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [0x140114a20]
pxor xmm0, xmmword [0x140114b40]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [0x140114a30]
pxor xmm1, xmmword [0x140114b50]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmm0, xmmword [0x140114a40]
pxor xmm0, xmmword [0x140114b60]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmm1, xmmword [0x140114a50]
pxor xmm1, xmmword [0x140114b70]
movdqa xmmword [rbp + 0x7d0], xmm0
movdqa xmm0, xmmword [0x140114a60]
pxor xmm0, xmmword [0x140114b80]
movdqa xmmword [rbp + 0x7e0], xmm1
movdqa xmm1, xmmword [0x140114a70]
pxor xmm1, xmmword [0x140114b90]
movdqa xmmword [rbp + 0x7f0], xmm0
movdqa xmm0, xmmword [0x140114a80]
pxor xmm0, xmmword [0x140114ba0]
movdqa xmmword [rbp + 0x800], xmm1
movdqa xmm1, xmmword [0x140114a90]
pxor xmm1, xmmword [0x140114bb0]
movdqa xmmword [rbp + 0x810], xmm0
movdqa xmm0, xmmword [0x140114aa0]
pxor xmm0, xmmword [0x140114bc0]
movdqa xmmword [rbp + 0x820], xmm1
movdqa xmm1, xmmword [0x140114ab0]
pxor xmm1, xmmword [0x140114bd0]
movdqa xmmword [rbp + 0x830], xmm0
movdqa xmm0, xmmword [0x140114ac0]
pxor xmm0, xmmword [0x140114be0]
movdqa xmmword [rbp + 0x840], xmm1
movdqa xmm1, xmmword [0x140114ad0]
pxor xmm1, xmmword [0x140114bf0]
movdqa xmmword [rbp + 0x850], xmm0
movdqa xmm0, xmmword [0x140114ae0]
pxor xmm0, xmmword [0x140114c00]
movdqa xmmword [rbp + 0x860], xmm1
movdqa xmm1, xmmword [0x140114af0]
pxor xmm1, xmmword [0x140114c10]
movdqa xmmword [rbp + 0x870], xmm0
movdqa xmm0, xmmword [0x140114b00]
pxor xmm0, xmmword [0x140114c20]
movdqa xmmword [rbp + 0x880], xmm1
movdqa xmm1, xmmword [0x140114b10]
pxor xmm1, xmmword [0x140114c30]
movdqa xmmword [rbp + 0x890], xmm0
movdqa xmmword [rbp + 0x8a0], xmm1
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 4
mov dword [rsp + 0x20], 3
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, [rbp + 0xff0]
call fcn.14004fc40
cmp dword [rbp + 0x1858], 3
je 0x140011858
movabs rax, 0x155d97a8bde9ad71
mov dword [rbp + 0x1858], 3
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x790]
movabs rax, 0x187a71ec141889a5
xorps xmm5, xmm5
mov qword [rsp + 0x38], rax
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0x42af55d955d9de9
mov qword [rsp + 0x40], rax
xorps xmm7, xmm7
movabs rax, 0x1e5a2a7923f8fd50
xorps xmm2, xmm2
mov qword [rsp + 0x48], rax
xorps xmm3, xmm3
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0x123d323cfde9f87d
mov qword [rsp + 0x50], rax
xorps xmm4, xmm4
movabs rax, 0xde007596c2a4187
pxor xmm5, xmm2
mov qword [rsp + 0x58], rax
pxor xmm6, xmm3
movabs rax, 0x152997c9bd8cad37
movdqa xmmword [rbp + 0x7c0], xmm5
mov qword [rbp - 0x70], rax
pxor xmm7, xmm4
movabs rax, 0x18297189146a89d0
movdqa xmmword [rbp + 0x7d0], xmm6
mov qword [rbp - 0x68], rax
movabs rax, 0x443f52995299d8c
pxor xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x60], rax
movabs rax, 0x1e152a0a239ffd3e
mov qword [rbp - 0x58], rax
movabs rax, 0x124f324efd8cf80b
pxor xmm1, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0xde0073c6c4e41ee
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x48], rax
lea rax, [rsp + 0x30]
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmmword [rbp + 0x7e0], xmm7
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rbx, 1
jne 0x1400117d2
mov rcx, qword [rbp + 0x1850]
lea rax, [rbp + 0x1858]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x1858], edi
movabs rax, 0x1671b351dab6c167
movabs rcx, 0xc05181b01df0d05
mov qword [rsp + 0x30], rax
xorps xmm6, xmm6
movabs rax, 0xa2e80ab2367b9e2
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x38], rax
xorps xmm7, xmm7
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0x21c1671b671bab6
mov qword [rsp + 0x40], rax
xorps xmm8, xmm8
movabs rax, 0x1bbd4aad440ce554
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x790]
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0x12bf52bf1ab71a23
mov qword [rsp + 0x50], rax
xorps xmm9, xmm9
movabs rax, 0xd0f26fb882d642c
xorps xmm2, xmm2
mov qword [rsp + 0x58], rax
xorps xmm3, xmm3
movabs rax, 0xc5ce74987351
xorps xmm4, xmm4
mov qword [rsp + 0x60], rax
xorps xmm5, xmm5
movabs rax, 0x1605b330dad3c121
pxor xmm6, xmm2
mov qword [rbp - 0x50], rax
pxor xmm7, xmm3
movabs rax, 0xa7d80ce2315b997
movdqa xmmword [rbp + 0x7d0], xmm6
mov qword [rbp - 0x48], rax
pxor xmm8, xmm4
pxor xmm0, xmmword [rbp - 0x50]
movabs rax, 0x2751605b605bad3
mov qword [rbp - 0x40], rax
pxor xmm9, xmm5
movabs rax, 0x1bf24ade446be53a
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov ebx, 7
mov qword [rbp - 0x38], rax
mov edx, ebx
pxor xmm1, xmmword [rbp - 0x40]
movabs rax, 0x12cd52cd1ad21a55
mov qword [rbp - 0x30], rax
movabs rax, 0xd42269e88496445
mov qword [rbp - 0x28], rax
movabs rax, 0xc5a574eb7330
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
mov qword [rbp - 0x20], rax
lea rax, [rsp + 0x30]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7e0], xmm7
movdqa xmmword [rbp + 0x7f0], xmm8
movdqa xmmword [rbp + 0x800], xmm9
nop dword [rax]
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400119f0
mov rcx, qword [rbp + 0x1850]
lea rax, [rbp + 0x1860]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1864]
lea rax, [rbp + 0x185c]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140011e52
movabs rax, 0x9ea230c847e994b
movabs rcx, 0xc0476a21383d7e8
mov qword [rsp + 0x30], rax
xorps xmm6, xmm6
movabs rax, 0x1b1aee80cb56e3d4
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x38], rax
xorps xmm7, xmm7
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0x5f0a9ea09ea247e
mov qword [rsp + 0x40], rax
xorps xmm8, xmm8
movabs rax, 0x1cdfdb6d94cc75d5
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x790]
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0x9312931047eaaa3
mov qword [rsp + 0x50], rax
xorps xmm9, xmm9
movabs rax, 0x158fb336ffc9d86
xorps xmm2, xmm2
mov qword [rsp + 0x58], rax
xorps xmm3, xmm3
movabs rax, 0x26a9898da30c
xorps xmm4, xmm4
mov qword [rsp + 0x60], rax
xorps xmm5, xmm5
movabs rax, 0x99e236d841b990d
pxor xmm6, xmm2
mov qword [rbp - 0x50], rax
pxor xmm7, xmm3
movabs rax, 0x1b49eee5cb24e3a1
movdqa xmmword [rbp + 0x7d0], xmm6
mov qword [rbp - 0x48], rax
pxor xmm8, xmm4
pxor xmm0, xmmword [rbp - 0x50]
movabs rax, 0x599a99e099e241b
mov qword [rbp - 0x40], rax
pxor xmm9, xmm5
movabs rax, 0x1c90db1e94ab75bb
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov rdx, rbx
mov qword [rbp - 0x38], rax
movabs rax, 0x9432943041baad5
pxor xmm1, xmmword [rbp - 0x40]
mov qword [rbp - 0x30], rax
movabs rax, 0x115fb566f989def
mov qword [rbp - 0x28], rax
movabs rax, 0x26c289fea36d
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
mov qword [rbp - 0x20], rax
lea rax, [rsp + 0x30]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7e0], xmm7
movdqa xmmword [rbp + 0x7f0], xmm8
movdqa xmmword [rbp + 0x800], xmm9
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140011c10
movdqa xmm0, xmmword [0x140114100]
lea rcx, [rbp + 0xff0]
pxor xmm0, xmmword [0x140114220]
lea rdx, [rbp + 0x790]
movdqa xmm1, xmmword [0x140114110]
mov r8d, 0x860
pxor xmm1, xmmword [0x140114230]
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [0x140114120]
pxor xmm0, xmmword [0x140114240]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [0x140114130]
pxor xmm1, xmmword [0x140114250]
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmm0, xmmword [0x140114140]
pxor xmm0, xmmword [0x140114260]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmm1, xmmword [0x140114150]
pxor xmm1, xmmword [0x140114270]
movdqa xmmword [rbp + 0x7d0], xmm0
movdqa xmm0, xmmword [0x140114160]
pxor xmm0, xmmword [0x140114280]
movdqa xmmword [rbp + 0x7e0], xmm1
movdqa xmm1, xmmword [0x140114170]
pxor xmm1, xmmword [0x140114290]
movdqa xmmword [rbp + 0x7f0], xmm0
movdqa xmm0, xmmword [0x140114180]
pxor xmm0, xmmword [0x1401142a0]
movdqa xmmword [rbp + 0x800], xmm1
movdqa xmm1, xmmword [0x1401142b0]
pxor xmm1, xmmword [0x140114190]
movdqa xmmword [rbp + 0x810], xmm0
movdqa xmm0, xmmword [0x1401141a0]
pxor xmm0, xmmword [0x1401142c0]
movdqa xmmword [rbp + 0x820], xmm1
movdqa xmm1, xmmword [0x1401141b0]
pxor xmm1, xmmword [0x1401142d0]
movdqa xmmword [rbp + 0x830], xmm0
movdqa xmm0, xmmword [0x1401141c0]
pxor xmm0, xmmword [0x1401142e0]
movdqa xmmword [rbp + 0x840], xmm1
movdqa xmm1, xmmword [0x1401141d0]
pxor xmm1, xmmword [0x1401142f0]
movdqa xmmword [rbp + 0x850], xmm0
movdqa xmm0, xmmword [0x1401141e0]
pxor xmm0, xmmword [0x140114300]
movdqa xmmword [rbp + 0x860], xmm1
movdqa xmm1, xmmword [0x1401141f0]
pxor xmm1, xmmword [0x140114310]
movdqa xmmword [rbp + 0x870], xmm0
movdqa xmm0, xmmword [0x140114200]
pxor xmm0, xmmword [0x140114320]
movdqa xmmword [rbp + 0x880], xmm1
movdqa xmm1, xmmword [0x140114210]
pxor xmm1, xmmword [0x140114330]
movdqa xmmword [rbp + 0x890], xmm0
movdqa xmmword [rbp + 0x8a0], xmm1
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 4
mov dword [rsp + 0x20], 3
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, [rbp + 0xff0]
call fcn.14004fc40
cmp dword [rbp + 0x185c], 3
je 0x140012076
movabs rax, 0x1a3a30b092b2a323
mov dword [rbp + 0x185c], 3
mov qword [rsp + 0x30], rax
movabs rcx, 0xc04894627c7c1e8
movabs rax, 0xf0aff34dc8a91f8
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x38], rax
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x30]
movabs rax, 0x14b4ba3a1a3a32b2
mov qword [rsp + 0x40], rax
xorps xmm7, xmm7
movabs rax, 0xf23ef5da8dc6705
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
movabs rax, 0x1939393912b2bb3b
mov qword [rsp + 0x50], rax
xorps xmm8, xmm8
movabs rax, 0x153f0eab81588c22
xorps xmm9, xmm9
mov qword [rsp + 0x58], rax
xorps xmm2, xmm2
movabs rax, 0x35b599b9b0b0
xorps xmm3, xmm3
mov qword [rsp + 0x60], rax
xorps xmm4, xmm4
movabs rax, 0x1a4e30d192d7a365
xorps xmm5, xmm5
mov qword [rbp - 0x50], rax
pxor xmm6, xmm2
movabs rax, 0xf59ff51dcf8918d
movdqa xmmword [rbp + 0x7d0], xmm6
mov qword [rbp - 0x48], rax
pxor xmm7, xmm3
pxor xmm0, xmmword [rbp - 0x50]
movabs rax, 0x14ddba4e1a4e32d7
mov qword [rbp - 0x40], rax
pxor xmm8, xmm4
movabs rax, 0xf6cef2ea8bb676b
movdqa xmmword [rbp + 0x790], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm9, xmm5
mov qword [rbp - 0x38], rax
movabs rax, 0x194b394b12d7bb4d
pxor xmm1, xmmword [rbp - 0x40]
mov qword [rbp - 0x30], rax
movabs rax, 0x15720ece813c8c4b
mov qword [rbp - 0x28], rax
movabs rax, 0x35de99cab0d1
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x7a0], xmm1
movdqa xmm1, xmmword [rsp + 0x60]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x790]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x7c0], xmm1
movdqa xmmword [rbp + 0x7b0], xmm0
movdqa xmmword [rbp + 0x7e0], xmm7
movdqa xmmword [rbp + 0x7f0], xmm8
movdqa xmmword [rbp + 0x800], xmm9
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x140011ff0
mov rcx, qword [rbp + 0x1850]
lea rax, [rbp + 0x185c]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x185c], edi
mov rcx, qword [rbp + 0x1850]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm9, xmmword [rsp + 0x1970]
mov al, 1
movaps xmm8, xmmword [rsp + 0x1980]
movaps xmm7, xmmword [rsp + 0x1990]
movaps xmm6, xmmword [rsp + 0x19a0]
mov rbx, qword [rsp + 0x19c0]
mov rcx, qword [rbp + 0x1868]
xor rcx, rsp
call fcn.140108a30
mov rdi, qword [rsp + 0x19c8]
add rsp, 0x19b0
pop rbp
ret