Function at 0x14001ac60
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r13, r9
mov r15, r8
mov rdi, rdx
mov qword [rbp], rcx
xor eax, eax
test al, al
je 0x14001aca0
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
nop dword [rax]
mov ecx, dword [0x141dc3060]
or ecx, dword [0x141dc3064]
or ecx, 0x54174c58
add ecx, 0xa2a593a8
and ecx, 0x956933a4
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov r14, rsp
cmp ecx, 0xa26e8dca
je 0x14001aca0
mov eax, dword [0x141dc3068]
imul eax, dword [0x141dc306c]
imul eax, eax, 0x9726c8b3
or eax, 0x4f04290e
xor eax, 0x52c27df5
cmp eax, 0xf59ea550
jbe 0x14001ad30
movzx eax, byte [0x141ddc4f8]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c0a10
add rsp, 0x20
nop word cs:[rax + rax]
mov esi, dword [0x141dc3070]
or esi, dword [0x141dc3074]
add esi, 0xcb0da95
and esi, 0x67d382ef
movzx eax, byte [0x141ddc4f8]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c0a10
add rsp, 0x20
cmp esi, 0x8c85670c
je 0x14001ad30
mov rbx, rax
test rax, rax
je 0x14001ad93
mov eax, dword [0x141dc3088]
xor eax, dword [0x141dc308c]
imul eax, eax, 0x22e2d084
or eax, 0xffe8cd30
cmp eax, 0xe4b030eb
jne 0x14001add6
jmp 0x14001adfe
mov eax, dword [0x141dc3078]
sub eax, dword [0x141dc307c]
xor eax, 0x801222
and eax, 0x3825226
cmp eax, 0x4fbe606
ja 0x14001add0
mov eax, dword [0x141dc3080]
and eax, dword [0x141dc3084]
and eax, 0x985a211b
imul eax, eax, 0x7a7eadca
ud2
ud2
mov eax, dword [0x141dc3090]
add eax, dword [0x141dc3094]
mov ecx, dword [r13]
mov dword [rbx], ecx
imul eax, eax, 0x83fc75c0
or eax, 0xfaff0df9
mov qword [r12], rdi
cmp eax, 0x312ec7a2
jne 0x14001ae0a
mov eax, dword [r13]
mov dword [rbx], eax
mov qword [r12], rdi
jmp 0x14001add6
add rdi, r15
mov eax, dword [0x141dc3098]
xor eax, dword [0x141dc309c]
and eax, 0xe8e338ca
imul eax, eax, 0xa48c1d5f
imul rax, rax, 0x6a698f35
shr rax, 0x3e
cmp eax, 0x9e45e679
ja 0x14001ae63
mov eax, dword [0x141dc30a0]
and eax, dword [0x141dc30a4]
and eax, 0x9552f949
mov qword [r12 + 8], rdi
mov word [r12 + 0x10], 0
mov word [r12 + 0x18], 1
cmp eax, 0xcc178ea6
jne 0x14001ae7a
mov qword [r12 + 8], rdi
mov word [r12 + 0x10], 0
mov word [r12 + 0x18], 1
jmp 0x14001ae36
mov word [r12 + 0x1a], 0
sub rsp, 0x20
mov rcx, r14
mov rdx, r12
call fcn.14001ce80
add rsp, 0x20
mov rdi, qword [r14 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 4
mov rcx, qword [rbp]
mov rdx, rdi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
mov esi, eax
cmp qword [r14], 0
je 0x14001aee6
mov rcx, qword [0x141ddc4e0]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dc30a8]
add eax, dword [0x141dc30ac]
or eax, 0xb33c8c1
imul rax, rax, 0x744da35b
shr rax, 0x3e
or eax, 0x1bad84ba
cmp eax, 0x481a4d4d
jne 0x14001af28
mov rcx, qword [0x141ddc4e0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rsi
shl rdi, 0x20
or rdi, 2
nop word [rax + rax]
mov r15d, dword [0x141dc30b0]
imul r15d, dword [0x141dc30b4]
or r15d, 0xad5be533
and r15d, 0xfddbf537
mov rcx, qword [0x141ddc4e0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call r14
add rsp, 0x20
cmp r15d, 0x72ccef4c
jb 0x14001af40
xor eax, eax
test esi, esi
cmove rdi, rax
mov rax, rdi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret