Function at 0x14003e380
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2158
call fcn.1401268f0
sub rsp, rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x2150], rax
lea r15, [rsp + 0x150]
mov r8d, 0x2000
mov rcx, r15
mov dl, 0xaa
call fcn.1401298e0
mov rcx, rdi
mov rdx, r15
call fcn.14016f010
test eax, eax
js 0x14003e495
lea rdx, str.SMDB
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003e4cb
lea rdx, [0x1401c5838]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003e4c4
lea rdx, [0x1401c583c]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003e4bd
lea rdx, [0x1401c5840]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
mov r12d, reloc.WS2_32.dll_recvfrom
mov ebp, 0x80020009
test eax, eax
cmovne r12d, ecx
jne 0x14003e497
jmp 0x14003e4d0
cmp eax, 0x13
jne 0x14003e730
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
lea rcx, [rsp + 0x150]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
jns 0x14003e704
mov ebp, eax
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.140126950
mov eax, ebp
add rsp, 0x2158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12w, shutdown
jmp 0x14003e4d0
mov r12w, 0x4008
jmp 0x14003e4d0
mov r12w, 8
mov rax, qword [rdi]
movabs r15, 0x100002600
mov r13, qword [sym.imp.USER32.dll_CharNextW]
jmp 0x14003e4ef
mov rcx, rax
call r13
mov qword [rdi], rax
movzx ecx, word [rax]
cmp rcx, 0x20
ja 0x14003e4fe
bt r15, rcx
jb 0x14003e4e6
lea r15, [rsp + 0x150]
mov rcx, rdi
mov rdx, r15
call fcn.14016f010
test eax, eax
js 0x14003e495
movzx eax, r12w
cmp eax, 0x12
jg 0x14003e465
cmp eax, 0x11
jne 0x14003e649
lea rcx, [rsp + 0x150]
call fcn.1401486d4
mov r12, rax
mov ebp, 0x80004005
test r12b, 1
jne 0x14003e497
mov r15d, r12d
shr r15d, 0x1f
add r15d, r12d
sar r15d, 1
lea r13, [rsp + 0x50]
mov r8d, 0x100
mov rcx, r13
mov dl, 0xaa
call fcn.1401298e0
mov r8, r13
mov qword [r13 - 8], 0
movsxd r13, r15d
xor edx, edx
cmp r12d, 2
cmovae rdx, r13
cmp rdx, 0x101
jae 0x14003e620
mov qword [rsp + 0x48], r8
test r8, r8
je 0x14003e5d5
mov qword [rsp + 0x38], r8
mov rcx, r8
xor edx, edx
mov r8, r13
call fcn.1401298e0
test r12d, r12d
jle 0x14003e5db
mov eax, r12d
xor edx, edx
mov r8d, 0x3ff
mov r9d, 0x7e0000
movabs r10, 0x7e000000000000
xor r11d, r11d
jmp 0x14003e6d7
xor eax, eax
xor ebx, ebx
jmp 0x14003e60b
mov rax, qword [rsp + 0x48]
mov rcx, qword [r14]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov rdx, rbx
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
cmp rax, rcx
jne 0x14003e637
test r8, r8
je 0x14003e497
jmp 0x14003e67d
lea rcx, [rsp + 0x48]
call fcn.14016efe0
lea rax, [rsp + 0x48]
mov r8, qword [rax]
jmp 0x14003e596
lea rcx, [rsp + 0x48]
mov r14, r8
call fcn.14016f330
mov r8, r14
jmp 0x14003e615
cmp eax, 8
jne 0x14003e68d
mov rcx, r15
call fcn.1401486d4
lea eax, [rax*2 + 2]
mov rcx, qword [r14]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x14003e68d
mov ecx, ebx
call fcn.14016f2e0
jmp 0x14003e495
mov rcx, rdi
mov rdx, rsi
call fcn.14016f010
mov ebp, eax
sar ebp, 0x1f
and ebp, eax
jmp 0x14003e497
add cl, 0xc9
jmp 0x14003e6ac
add cl, 0xd0
mov r12d, ecx
mov ecx, edx
not cl
and cl, 4
shl r12b, cl
mov rcx, qword [rsp + 0x48]
mov r13d, r11d
shr r13d, 1
or byte [rcx + r13], r12b
inc r11
add dl, 4
cmp rax, r11
je 0x14003e5db
movzx ecx, word [rsp + r11*2 + 0x150]
xor r12d, r12d
lea r13d, [rcx - 0x30]
cmp r13d, 0x36
ja 0x14003e6af
bt r8, r13
jb 0x14003e6a9
bt r9, r13
jb 0x14003e6a4
bt r10, r13
jae 0x14003e6af
add cl, 0xa9
jmp 0x14003e6ac
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x48]
mov dword [rdx], eax
mov rcx, qword [r14]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 4
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
jmp 0x14003e675
cmp eax, 0x4008
jne 0x14003e68d
lea r12, [rsp + 0x150]
mov rcx, r12
call fcn.1401486d4
mov rbp, rax
lea r15, [rsp + 0x50]
mov r8d, 0x100
mov rcx, r15
mov dl, 0xaa
call fcn.1401298e0
mov qword [r15 - 8], 0
add ebp, 2
movsxd rdx, ebp
lea rbp, [rsp + 0x48]
mov rcx, rbp
call fcn.14016f2f0
mov rbp, qword [rbp]
test rbp, rbp
jne 0x14003e7a6
mov ebx, SafeArrayDestroy
xor eax, eax
cmp rax, r15
je 0x14003e67d
lea rcx, [rsp + 0x48]
call fcn.14016f330
jmp 0x14003e67d
cmp word [rsp + 0x150], 0
jne 0x14003e7dd
mov dword [rbp], 0
mov r13, qword [rsp + 0x48]
test r13, r13
jne 0x14003e805
mov ebx, SafeArrayDestroy
jmp 0x14003e78c
mov word [rbp], cx
add r12, 2
add rbp, 2
cmp word [r12], 0
je 0x14003e7b1
mov rcx, r12
call r13
movzx ecx, word [r12]
cmp cx, 0x5c
jne 0x14003e7c9
cmp word [rax], 0x30
jne 0x14003e7c9
mov word [rbp], 0
mov rcx, rax
call r13
mov r12, rax
jmp 0x14003e7d1
xor ebp, ebp
mov r12, r13
mov rcx, r12
call fcn.1401486d4
lea ecx, [rax + 1]
lea r12, [r12 + rcx*2]
mov edx, ebp
lea rbp, [rdx + rcx*2]
test eax, eax
jne 0x14003e80a
mov rcx, qword [r14]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rax, qword [rsp + 0x48]
jmp 0x14003e78e