Function at 0x14001f3e0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rbp + 8], rax
mov r14, rcx
mov rdi, rdx
mov rcx, qword [0x1402bc450]
mov word [rsp + 0x48], cx
lea eax, [rcx + 2]
mov word [rsp + 0x4a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x50], rax
cmp rcx, 0xfffe
jbe 0x14001f44a
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x14001f511
lea rax, [rsp + 0x40]
xor r8d, r8d
lea r9, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xfffffffffffffff7
call fcn.14016ae40
mov ebx, eax
test eax, eax
js 0x14001f4b4
xor r13d, r13d
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r13
lea rcx, [rbp]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14001f4ac
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14001f585
cmp ebx, 0xc0000022
je 0x14001f4e9
nop dword [rax]
cmp ebx, 0xc0000005
je 0x14001f4e9
mov eax, ebx
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x14001f4dc
movzx eax, bx
jmp 0x14001f4f4
nop dword [rax]
cmp eax, 0xb
jne 0x14001f4f8
mov eax, ebx
jmp 0x14001f4f4
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f507
lfence
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x14001f511
lfence
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
lea r8, [0x14023c43c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f571
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, ds:[rbx - 0x10]
mov esi, 0xffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001f825
lfence
jmp 0x14001f81e
mov edx, 0x10
call sym.SystemInformer.exe_Ordinal_1698
nop dword [rax + rax]
jmp 0x14001f825
mov rcx, rdi
mov qword [rsp + 0x160], r12
call fcn.14013e6a0
mov rbx, rax
mov dword [rsp + 0x48], 0x10000e
mov r9d, 1
xor r8d, r8d
mov r15d, 0x10
mov edx, dword [rax]
mov rcx, qword [rax + 8]
add edx, 2
mov dword [rsp + 0x28], edx
lea rax, str.LastKey
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rbp]
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f605
nop dword [rax + rax]
call fcn.140143da0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_Ordinal_1667
mov rdi, qword [rsp + 0x48]
mov rdx, qword [0x1402c5ff0]
lea rbx, [rdi + 0x18]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov rdx, qword [rsp + 0x50]
mov r8, rdi
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.14020c7e0
mov rcx, qword [r12 + 8]
movups xmm0, xmmword [str._regedit.exe]
movups xmmword [rdi + rcx], xmm0
movsd xmm0, qword [0x140268e78]
movsd qword [rdi + rcx + 0x10], xmm0
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_Ordinal_1518
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 8]
mov rax, qword [r12 + 8]
and ecx, 1
je 0x14001f6aa
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
jmp 0x14001f6d0
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, str.runas
mov qword [rbp - 0x3c], rcx
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0x34], ecx
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
lea rcx, [rsp + 0x60]
mov dword [rbp - 0x70], 5
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x64], 0x800540
mov dword [rsp + 0x60], 0x70
call fcn.14013dc60
test al, al
je 0x14001f714
mov rcx, qword ds:[rbp - 0x38]
test rcx, rcx
je 0x14001f807
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001f807
cmp dword [0x1402bbf68], 0xffffffff
jae 0x14001f72b
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14001f731
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov ebx, eax
test eax, eax
jns 0x14001f807
cmp eax, 0xc0000022
je 0x14001f77d
cmp eax, 0xc0000005
je 0x14001f77d
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001f76d
movzx eax, bx
jmp 0x14001f788
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14001f78c
mov eax, ebx
jmp 0x14001f788
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001f798
lfence
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x14001f7a5
lfence
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
lea r8, [0x14023c43c]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001f7ff
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f807
lfence
call fcn.140143da0
jmp 0x14001f807
mov edx, r15d
call sym.SystemInformer.exe_Ordinal_1698
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], esi
mov r12, qword [rsp + 0x160]
cmp esi, 1
jne 0x14001f825
nop
call fcn.140143da0
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x110
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret