Function at 0x14005c470
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rax, qword [0x1400f1080]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm1, xmmword [0x1400e0330]
mov r8b, 0x79
movd ecx, xmm1
xor r15d, r15d
movdqu xmmword [rbp + 7], xmm1
mov qword [rsp + 0x40], r15
mov dl, 0x78
xor byte [rbp + 9], cl
movdqa xmm0, xmm1
xor byte [rbp + 0xa], cl
xor dl, cl
xor byte [rbp + 0xb], cl
xor r8b, cl
xor byte [rbp + 0xc], cl
xor r9d, r9d
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0x17], dl
lea rdx, [rbp + 8]
mov byte [rbp + 0x18], r8b
xor r8d, r8d
xor al, cl
mov byte [rbp + 0x19], 0
mov byte [rbp + 8], al
mov rcx, 0xffffffff80000001
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ca0d
mov qword [rsp + 0xb0], rbx
mov r8b, WSAGetLastError
mov r9b, 0x7a
mov qword [rsp + 0xb8], rsi
xor r8b, 8
mov qword [rsp + 0xc0], rdi
xor r9b, 8
mov byte [rbp + 0xb], r8b
mov al, 0x7c
mov byte [rbp + 0xc], r9b
xor al, 8
mov qword [rsp + 0xc8], r12
mov cl, 0x61
mov byte [rbp + 8], al
xor cl, 8
mov dword [rsp + 0x28], 4
mov dl, 0x65
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
lea rax, [0x1400f110c]
xor dl, 8
mov qword [rsp + 0x20], rax
xor r10d, r10d
mov byte [rbp + 0xa], dl
mov r9d, 4
mov qword [rsp + 0x90], r14
xor r8d, r8d
mov byte [rbp + 7], 8
lea rdx, [rbp + 8]
mov byte [rbp + 0xd], r10b
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x1400f1ee4], r15b
mov eax, r15d
mov r8b, 0x4c
mov dword [rsp + 0x28], 4
setne al
mov byte [rbp + 7], Ordinal_45
mov dword [rbp + 0x27], eax
mov r9b, 0x43
xor r8b, 0x2a
xor r9b, 0x2a
mov al, 0x49
mov byte [rbp + 0xb], r8b
xor al, 0x2a
mov byte [rbp + 0xc], r9b
mov cl, 0x45
mov byte [rbp + 8], al
xor cl, 0x2a
lea rax, [rbp + 0x27]
mov dl, 0x44
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
xor dl, 0x2a
mov r10b, Ordinal_79
mov byte [rbp + 0xa], dl
mov r11b, 0x59
mov qword [rsp + 0x20], rax
xor r10b, 0x2a
lea rdx, [rbp + 8]
xor r11b, 0x2a
mov byte [rbp + 0xd], r10b
xor ebx, ebx
mov byte [rbp + 0xe], r11b
mov r9d, 4
mov byte [rbp + 0xf], bl
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [reloc.WS2_32.dll_accept], r15b
mov eax, r15d
mov cl, 0x6c
mov byte [rbp + 7], 9
setne al
mov r10b, 0x6a
mov dword [rbp + 0x2b], eax
mov dl, 0x67
mov al, 0x64
mov r8b, 0x7c
mov r9b, 0x56
mov r11b, 0x61
movzx ebx, cl
movzx edi, r10b
xor al, 9
mov dword [rsp + 0x28], 4
xor cl, 9
mov byte [rbp + 8], al
xor dl, 9
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 0x2b]
xor r8b, 9
mov byte [rbp + 0xa], dl
xor r9b, 9
mov byte [rbp + 0xb], r8b
mov byte [rbp + 0xc], r9b
lea rdx, [rbp + 8]
xor r10b, 9
mov qword [rsp + 0x20], rax
xor r11b, 9
mov byte [rbp + 0xd], r10b
mov sil, 0x62
mov byte [rbp + 0xe], r11b
xor r14d, r14d
xor bl, 9
xor dil, 9
mov byte [rbp + 0xf], bl
xor sil, 9
mov byte [rbp + 0x10], dil
mov r9d, 4
mov byte [rbp + 0x11], sil
xor r8d, r8d
mov byte [rbp + 0x12], r14b
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x1400f1e13], r15b
mov r9b, 0x6c
movzx r14d, r9b
mov dword [rsp + 0x28], 4
mov eax, r15d
mov byte [rbp + 7], 7
setne al
mov r8b, 0x64
mov dword [rbp + 0x2f], eax
xor r8b, 7
mov al, 0x65
mov byte [rbp + 0xb], r8b
movzx r11d, al
xor r9b, 7
xor al, 7
mov byte [rbp + 0xc], r9b
mov cl, 0x6b
mov byte [rbp + 8], al
xor cl, 7
lea rax, [rbp + 0x2f]
mov dl, 0x68
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
xor dl, 7
mov r10b, 0x58
mov byte [rbp + 0xa], dl
xor r10b, 7
mov qword [rsp + 0x20], rax
xor r11b, 7
mov byte [rbp + 0xd], r10b
mov bl, 0x75
mov byte [rbp + 0xe], r11b
mov dil, 0x62
lea rdx, [rbp + 8]
mov sil, 0x66
xor r12d, r12d
xor bl, 7
mov byte [rbp + 0x13], r12b
xor dil, 7
mov byte [rbp + 0xf], bl
xor sil, 7
mov byte [rbp + 0x10], dil
xor r14b, 7
mov byte [rbp + 0x11], sil
mov r9d, 4
mov byte [rbp + 0x12], r14b
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x1400f1e12], r12b
setne r15b
mov r9b, Ordinal_33
mov dword [rbp + 0x33], r15d
movzx r14d, r9b
mov dword [rsp + 0x28], 4
mov r8b, 4
mov byte [rbp + 7], reloc.WS2_32.dll_WSASetLastError
mov r11b, 7
mov byte [rbp + 0x14], r12b
xor r9b, 0x70
movzx r15d, r11b
xor r8b, 0x70
mov byte [rbp + 0xc], r9b
mov al, reloc.WS2_32.dll_send
mov byte [rbp + 0xb], r8b
xor al, 0x70
mov cl, 5
xor cl, 0x70
mov byte [rbp + 8], al
mov dl, 3
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 0x33]
xor dl, 0x70
mov qword [rsp + 0x20], rax
mov r10b, Ordinal_30
mov byte [rbp + 0xa], dl
xor r10b, 0x70
lea rdx, [rbp + 8]
xor r11b, 0x70
mov byte [rbp + 0xd], r10b
mov bl, Ordinal_26
mov byte [rbp + 0xe], r11b
mov dil, reloc.WLDAP32.dll_Ordinal_30
mov sil, reloc.WS2_32.dll_sendto
xor bl, 0x70
xor dil, 0x70
xor sil, 0x70
mov byte [rbp + 0xf], bl
xor r14b, 0x70
mov byte [rbp + 0x10], dil
xor r15b, 0x70
mov byte [rbp + 0x11], sil
mov r9d, 4
mov byte [rbp + 0x12], r14b
xor r8d, r8d
mov byte [rbp + 0x13], r15b
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r11d, dword [0x1400f1e68]
lea rbx, [0x1400f1e58]
inc r11d
mov byte [rbp + 7], WSASetLastError
cmp qword [0x1400f1e70], 0xf
mov al, Ordinal_26
mov r8b, 0xa
mov dword [rsp + 0x28], r11d
cmova rbx, qword [0x1400f1e58]
mov r9b, 1
xor dl, dl
mov qword [rsp + 0x20], rbx
xor dl, 0x6e
movzx r10d, al
xor r8b, 0x6e
mov byte [rbp + 0xa], dl
xor r9b, 0x6e
mov byte [rbp + 0xb], r8b
mov cl, 7
mov byte [rbp + 0xc], r9b
xor cl, 0x6e
lea rdx, [rbp + 8]
xor edi, edi
mov byte [rbp + 9], cl
mov rcx, qword [rbp + 0x1f]
xor al, 0x6e
xor r10b, 0x6e
mov byte [rbp + 8], al
mov r9d, 1
mov byte [rbp + 0xd], r10b
xor r8d, r8d
mov byte [rbp + 0xe], dil
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movdqa xmm1, xmmword [0x1400e0350]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 7], xmm1
mov dl, 0x6c
mov dword [rsp + 0x28], 4
xor dl, cl
psrldq xmm0, 1
xor byte [rbp + 9], cl
mov r9d, 4
xor byte [rbp + 0xa], cl
xor r8d, r8d
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
movd eax, xmm0
mov byte [rbp + 0x17], dl
lea rdx, [rbp + 8]
mov byte [rbp + 0x18], dil
xor al, cl
mov rcx, qword [rbp + 0x1f]
mov byte [rbp + 8], al
lea rax, [0x1400f1e00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movdqa xmm1, xmmword [0x1400e02a0]
mov dl, 0x50
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 7], xmm1
mov r9d, 4
mov dword [rsp + 0x28], 4
xor dl, cl
psrldq xmm0, 1
xor byte [rbp + 9], cl
xor r8d, r8d
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
xor byte [rbp + 0x13], cl
xor byte [rbp + 0x14], cl
xor byte [rbp + 0x15], cl
xor byte [rbp + 0x16], cl
movd eax, xmm0
mov byte [rbp + 0x17], dl
lea rdx, [rbp + 8]
mov byte [rbp + 0x18], dil
xor al, cl
mov rcx, qword [rbp + 0x1f]
mov byte [rbp + 8], al
lea rax, [0x1400f1e04]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400c1970
add rsp, 0x98
pop r15
pop rbp
ret