Function at 0x140009170
Capabilities:
Create process on windows
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x260], rbx
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r13, rdx
mov rbx, rcx
mov qword [rbp - 0x68], rcx
xor r15d, r15d
mov r12d, r15d
lea ecx, [r15 + 2]
call fcn.1400a82f0
mov rdi, rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400a82f0
mov rsi, rax
mov qword [rbp - 0x78], rax
mov word [rax], r15w
lea ecx, [r15 + 2]
call fcn.1400a82f0
mov r14, rax
mov qword [rbp - 0x70], rax
mov word [rax], r15w
mov eax, 0xdc
mov word [rbp + 0x64], ax
lea r8, [rbp + 0x20]
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp word [r13], 0x30
jne 0x140009234
lea r9d, [r15 + 0x30]
lea r8, [0x1400d25b0]
lea rdx, str.The_full_name_of_the_selected_key_or_value_is_not_available.
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400098c7
mov r8d, 4
lea rdx, [0x1400d1cf8]
mov rcx, r13
call fcn.1400a9818
test eax, eax
jne 0x1400092db
lea rcx, str.HKEY_LOCAL_MACHINE
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x60], rax
lea r8, [r13 + 8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.140022b00
mov r15, rdi
mov rcx, qword [rax]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, r15
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400a82b0
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rdx, [r13 + 0xa]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rcx, qword [0x140119a10]
call fcn.1400075c0
jmp 0x1400094d6
mov r8d, 4
lea rdx, [0x1400d1ce8]
mov rcx, r13
call fcn.1400a9818
test eax, eax
jne 0x140009358
lea rcx, str.HKEY_CURRENT_USER
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x58], rax
lea r8, [r13 + 8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140022b00
mov r15, rdi
mov rcx, qword [rax]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, r15
call fcn.1400a82b0
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400a82b0
lea rdx, [r13 + 0xa]
mov rcx, qword [0x140119a18]
jmp 0x1400094cb
mov r8d, 4
lea rdx, [0x1400d1d10]
mov rcx, r13
call fcn.1400a9818
test eax, eax
jne 0x1400093d5
lea rcx, str.HKEY_CURRENT_CONFIG
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r8, [r13 + 8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140022b00
mov r15, rdi
mov rcx, qword [rax]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, r15
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400a82b0
lea rdx, [r13 + 0xa]
mov rcx, 0xffffffff80000005
jmp 0x1400094cb
mov r8d, 4
lea rdx, [0x1400d1cd8]
mov rcx, r13
call fcn.1400a9818
test eax, eax
jne 0x14000944f
lea rcx, str.HKEY_CLASSES_ROOT
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r8, [r13 + 8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140022b00
mov r15, rdi
mov rcx, qword [rax]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, r15
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400a82b0
lea rdx, [r13 + 0xa]
mov rcx, 0xffffffff80000000
jmp 0x1400094cb
mov r8d, 3
lea rdx, [0x1400d1d08]
mov rcx, r13
call fcn.1400a9818
test eax, eax
jne 0x140009504
lea rcx, str.HKEY_USERS
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r8, [r13 + 6]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140022b00
mov r15, rdi
mov rcx, qword [rax]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, r15
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400a82b0
lea rdx, [r13 + 8]
mov rcx, 0xffffffff80000003
lea r8, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000951a
mov edx, 0x5c
mov rcx, rdi
call fcn.1400a9910
lea r12, [rax + 2]
mov edx, 0x5c
mov rcx, rdi
call fcn.1400a9910
xor r15d, r15d
mov word [rax], r15w
jmp 0x140009586
mov rbx, rdi
mov rcx, r13
call fcn.1400a8238
mov rdi, rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, 0x7fffffff
or r15, 0xffffffffffffffff
nop
inc r15
cmp word [rdi + r15*2], 0
jne 0x140009530
cmp r15, r13
cmovb r13, r15
lea rdx, [r15*2 + 6]
mov rcx, rdi
call fcn.1400a83a8
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rbx, [rax + r13*2]
sub r15, r13
lea r8, [r15*2 + 2]
lea rcx, [r13 + 1]
lea rcx, [rax + rcx*2]
mov rdx, rbx
call fcn.1400a7cd0
movzx eax, word [0x1400d1c90]
mov word [rbx], ax
xor r15d, r15d
xor edx, edx
lea rcx, str.RegEdit_RegEdit
call qword [sym.imp.USER32.dll_FindWindowW]
mov r13, rax
test rax, rax
jne 0x1400096bc
mov rax, qword [0x1401256f8]
test rax, rax
je 0x1400095c2
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x50]
call fcn.1400a8b00
mov dword [rbp - 0x50], 0x68
mov eax, 1
mov dword [rbp - 0x14], eax
mov word [rbp - 0x10], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov rbx, rsi
test eax, eax
lea rcx, str._windir__regedit.exe
js 0x1400095ff
lea rcx, str._systemroot__regedit.exe
call fcn.1400a8238
mov rsi, rax
mov qword [rbp - 0x78], rax
mov rcx, rbx
call fcn.1400a82b0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140013270
mov rbx, r14
mov rcx, qword [rax]
call fcn.1400a8238
mov r14, rax
mov qword [rbp - 0x70], rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, r14
call fcn.140013360
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400096a2
or edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, str.RegEdit_RegEdit
call qword [sym.imp.USER32.dll_FindWindowW]
mov r13, rax
jmp 0x1400096de
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
test r13, r13
jne 0x140009704
lea r9d, [r13 + 0x30]
lea r8, [0x1400d25b0]
lea rdx, str.Error_launching_Regedit._Make_sure_you_are_running_with_Administrative_rights.
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.USER32.dll_MessageBoxW]
invalid