Function at 0x140003320
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14371b080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rbx, rcx
lea rcx, [rbp - 0x59]
call fcn.140009c20
nop
mov r8, qword [rax]
lea rcx, [rbp - 1]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140002440
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140002e50
cmp qword [rax + 0x18], 7
jbe 0x140003382
mov rax, qword [rax]
xor esi, esi
mov qword [rsp + 0x40], rsi
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x1400033f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036c0
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715050]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], si
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x140003445
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003440
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036c6
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715060]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14000349c
mov rdx, qword [rbp + 0xf]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000348b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036cc
call fcn.1400106e0
mov qword [rbp - 1], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140003509
mov rdx, qword [rbp - 0x51]
call fcn.14000ad80
mov rcx, qword [rbp - 0x49]
mov r8, qword [rbp - 0x59]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x140003501
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036d2
mov rcx, r8
call fcn.1400106e0
mov rdx, rbx
lea rcx, [rbp + 0x1f]
call fcn.140002e50
nop
mov r8, rdi
lea rcx, [rbp - 0x59]
call fcn.1400020f0
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140002440
nop
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140002e50
mov rdx, rax
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rcx, qword [rbp + 0x1f]
cmp qword [rax + 0x18], 7
jbe 0x140003557
mov rdx, qword [rax]
mov eax, dword [rbp + 0x2f]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbp - 9]
cmp rdx, 7
jbe 0x1400035bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036d8
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715050]
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], si
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140003609
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003604
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036de
call fcn.1400106e0
movdqa xmm0, xmmword [0x143715060]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140003654
mov rdx, qword [rbp - 0x49]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000364f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036e4
call fcn.1400106e0
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 7
jbe 0x14000369b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003696
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036ba
call fcn.1400106e0
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400106c0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
nop
call fcn.14001a910
int3