Function at 0x14001f4e0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 8], rax
mov r14, rcx
mov rdi, rdx
mov rcx, qword [0x1402c0460]
mov word [rsp + 0x48], cx
lea eax, [rcx + 2]
mov word [rsp + 0x4a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x50], rax
cmp rcx, 0xfffe
jbe 0x14001f54a
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f611
lea rax, [rsp + 0x40]
xor r8d, r8d
lea r9, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xfffffffffffffff7
call fcn.140168740
mov ebx, eax
test eax, eax
js 0x14001f5b4
xor r13d, r13d
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r13
lea rcx, [rbp]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14001f5ac
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14001f685
cmp ebx, 0xc0000022
je 0x14001f5e9
nop dword [rax]
cmp ebx, 0xc0000005
je 0x14001f5e9
mov eax, ebx
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x14001f5dc
movzx eax, bx
jmp 0x14001f5f4
nop dword [rax]
cmp eax, 0xb
jne 0x14001f5f8
mov eax, ebx
jmp 0x14001f5f4
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f607
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f611
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f671
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov esi, 0xffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001f925
lfence
jmp 0x14001f91e
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
nop dword [rax + rax]
jmp 0x14001f925
mov rcx, rdi
mov qword [rsp + 0x160], r12
call fcn.14013c500
mov rbx, rax
mov dword [rsp + 0x48], 0x10000e
mov r9d, 1
xor r8d, r8d
mov r15d, 0x10
mov edx, dword [rax]
mov rcx, qword [rax + 8]
add edx, 2
mov dword [rsp + 0x28], edx
lea rax, str.LastKey
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rbp]
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f705
nop dword [rax + rax]
call fcn.140141ca0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetSystemRoot
mov rdi, qword [rsp + 0x48]
mov rdx, qword [0x1402ca978]
lea rbx, [rdi + 0x18]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdx, qword [rsp + 0x50]
mov r8, rdi
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.14020a640
mov rcx, qword [r12 + 8]
movups xmm0, xmmword [str._regedit.exe]
movups xmmword [rdi + rcx], xmm0
movsd xmm0, qword [0x14023db28]
movsd qword [rdi + rcx + 0x10], xmm0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 8]
mov rax, qword [r12 + 8]
and ecx, 1
je 0x14001f7aa
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
jmp 0x14001f7d0
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, str.runas
mov qword [rbp - 0x3c], rcx
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0x34], ecx
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
lea rcx, [rsp + 0x60]
mov dword [rbp - 0x70], 5
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x64], 0x800540
mov dword [rsp + 0x60], 0x70
call fcn.14013b960
test al, al
je 0x14001f814
mov rcx, qword ds:[rbp - 0x38]
test rcx, rcx
je 0x14001f907
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001f907
cmp dword [0x1402bff40], 0xffffffff
jae 0x14001f82b
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14001f831
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
test eax, eax
jns 0x14001f907
cmp eax, 0xc0000022
je 0x14001f87d
cmp eax, 0xc0000005
je 0x14001f87d
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001f86d
movzx eax, bx
jmp 0x14001f888
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14001f88c
mov eax, ebx
jmp 0x14001f888
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f898
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f8a5
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f8ff
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f907
lfence
call fcn.140141ca0
jmp 0x14001f907
mov edx, r15d
call sym.SystemInformer.exe_PhShowMessage
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], esi
mov r12, qword [rsp + 0x160]
cmp esi, 1
jne 0x14001f925
nop
call fcn.140141ca0
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x110
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret