Function at 0x14001f560
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 8], rax
mov r14, rcx
mov rdi, rdx
mov rcx, qword [0x1402c1460]
mov word [rsp + 0x48], cx
lea eax, [rcx + 2]
mov word [rsp + 0x4a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x50], rax
cmp rcx, 0xfffe
jbe 0x14001f5ca
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f691
lea rax, [rsp + 0x40]
xor r8d, r8d
lea r9, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xfffffffffffffff7
call fcn.140169b80
mov ebx, eax
test eax, eax
js 0x14001f634
xor r13d, r13d
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r13
lea rcx, [rbp]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14001f62c
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14001f705
cmp ebx, 0xc0000022
je 0x14001f669
nop dword [rax]
cmp ebx, 0xc0000005
je 0x14001f669
mov eax, ebx
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x14001f65c
movzx eax, bx
jmp 0x14001f674
nop dword [rax]
cmp eax, 0xb
jne 0x14001f678
mov eax, ebx
jmp 0x14001f674
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f687
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f691
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023b2dc]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f6f1
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov esi, 0xffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001f9a5
lfence
jmp 0x14001f99e
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
nop dword [rax + rax]
jmp 0x14001f9a5
mov rcx, rdi
mov qword [rsp + 0x160], r12
call fcn.14013ca60
mov rbx, rax
mov dword [rsp + 0x48], 0x10000e
mov r9d, 1
xor r8d, r8d
mov r15d, 0x10
mov edx, dword [rax]
mov rcx, qword [rax + 8]
add edx, 2
mov dword [rsp + 0x28], edx
lea rax, str.LastKey
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rbp]
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f785
nop dword [rax + rax]
call fcn.140142200
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetSystemRoot
mov rdi, qword [rsp + 0x48]
mov rdx, qword [0x1402cb8c0]
lea rbx, [rdi + 0x18]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdx, qword [rsp + 0x50]
mov r8, rdi
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.14020be40
mov rcx, qword [r12 + 8]
movups xmm0, xmmword [str._regedit.exe]
movups xmmword [rdi + rcx], xmm0
movsd xmm0, qword [0x14023ecf8]
movsd qword [rdi + rcx + 0x10], xmm0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 8]
mov rax, qword [r12 + 8]
and ecx, 1
je 0x14001f82a
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
jmp 0x14001f850
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, str.runas
mov qword [rbp - 0x3c], rcx
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0x34], ecx
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
lea rcx, [rsp + 0x60]
mov dword [rbp - 0x70], 5
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x64], 0x800540
mov dword [rsp + 0x60], 0x70
call fcn.14013bec0
test al, al
je 0x14001f894
mov rcx, qword ds:[rbp - 0x38]
test rcx, rcx
je 0x14001f987
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001f987
cmp dword [0x1402c0f40], 0xffffffff
jae 0x14001f8ab
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14001f8b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
test eax, eax
jns 0x14001f987
cmp eax, 0xc0000022
je 0x14001f8fd
cmp eax, 0xc0000005
je 0x14001f8fd
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001f8ed
movzx eax, bx
jmp 0x14001f908
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14001f90c
mov eax, ebx
jmp 0x14001f908
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f918
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14001f925
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023b2dc]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f97f
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f987
lfence
call fcn.140142200
jmp 0x14001f987
mov edx, r15d
call sym.SystemInformer.exe_PhShowMessage
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], esi
mov r12, qword [rsp + 0x160]
cmp esi, 1
jne 0x14001f9a5
nop
call fcn.140142200
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x110
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret