Function at 0x14001498b
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x68], r9
mov dword [rbp - 0x50], r8d
mov qword [rbp - 0x60], rdx
mov eax, dword [0x14009dcb4]
imul edx, dword [0x140092018], 0x959045bd
imul r8d, dword [0x14009201c], 0xa50807e3
add edx, r8d
add edx, 0x8638b6d7
xor edx, eax
imul r8d, dword [0x140092020], 0x67bafd01
imul r9d, dword [0x140092024], 0x141143da
imul edx, eax
mov eax, r9d
add eax, r8d
add eax, 0xa92c81a7
and eax, edx
mov edx, dword [0x140092028]
mov r8d, dword [0x14009202c]
shrd r8d, edx, 0x19
imul edx, dword [0x140092030], 0x198599ee
imul r9d, dword [0x140092034], 0x11266344
xor r8d, 0x669ea95e
mov r10d, dword [0x140092038]
mov r11d, dword [0x14009203c]
shrd r11d, r10d, 0x11
xor r11d, 0xc7941620
imul r10d, dword [0x140092040], 0x6f40b56c
imul esi, dword [0x140092044], 0x6fd0d10c
cmp eax, r8d
mov eax, r9d
lea eax, [rdx + rax + 0x718fd3b0]
mov edx, esi
mov r8d, r10d
lea edx, [r8 + rdx + 0x106ac9e7]
cmove edx, r11d
cmp dword [0x14009dcb8], eax
mov qword [rbp - 0x58], rcx
cmovl edx, r11d
mov dword [rbp - 0x4c], edx
xorps xmm6, xmm6
mov r15d, 0x3a99cdc6
mov r10d, r15d
mov edi, ebx
mov r12, r11
mov rbx, r9
mov r11, r8
mov r8, rdx
mov r9, rcx
cmp r15d, 0xe1b810c4
jle 0x140014bf6
cmp r10d, 0x32ce3006
jg 0x140014d24
cmp r10d, 0x2212069c
jg 0x140014eb3
cmp r10d, 0xe1b810c5
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x20], r9
je 0x1400150ee
mov qword [rbp - 0x28], rsi
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11, r12
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov r15d, r10d
cmp r10d, 0xefd57021
jne 0x140014a91
mov rax, r13
mov eax, dword [0x14009dcb4]
mov ecx, dword [0x1400921f0]
mov edx, dword [0x1400921f4]
shrd edx, ecx, 0x10
xor edx, eax
xor edx, 0x8c241a62
imul ecx, dword [0x1400921f8], 0xa659542
imul r8d, dword [0x1400921fc], 0xa2f73b54
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x856e5181
and eax, edx
imul ecx, dword [0x140092200], 0x2d1a3858
imul edx, dword [0x140092204], 0x75f9f70e
add ecx, edx
add ecx, 0xa3f56126
imul edx, dword [0x140092208], 0xb9375f9
mov r8d, dword [0x140092218]
mov r15d, dword [0x14009221c]
shrd r15d, r8d, 0x17
imul r8d, dword [0x14009220c], 0x23bb92f
xor r15d, 0x8edea50c
imul r10d, dword [0x140092210], 0xaf70ba68
imul r11d, dword [0x140092214], 0xf873d839
cmp eax, ecx
mov eax, r8d
mov ecx, edx
lea eax, [rcx + rax - 0xcdc2371]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x4be12831]
cmove r15d, ecx
cmp dword [0x14009dcb8], eax
cmovl r15d, ecx
mov r14b, byte [r12]
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
jmp 0x140015985
cmp r10d, 0xbb6db0c1
jle 0x140014da0
cmp r10d, 0xcd24aa91
jg 0x140015054
cmp r10d, 0xbb6db0c2
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x30], r11
mov qword [rbp - 0x20], r9
je 0x1400157de
mov qword [rbp - 0x28], rsi
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov r11, r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov r15d, r10d
cmp r10d, 0xc5e1fd4a
jne 0x140014a91
mov r12, r13
mov byte [rbp - 0x48], r14b
mov r13, qword [rbp - 0x38]
mov eax, dword [r13]
mov r15, qword [rbp - 0x30]
mov rdx, qword [r15]
mov rbx, qword [rbp - 0x18]
mov r9d, dword [rbx]
mov rcx, qword [r12]
mov r8d, dword [0x140092258]
mov r10d, dword [0x14009225c]
shrd r10d, r8d, 8
mov r8d, r10d
xor r8d, 0xf331af91
sub rsp, 0x30
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r14d, edi
mov rdi, qword [rbp - 0x20]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x30
mov rsi, qword [rbp - 0x28]
mov dword [rsi], eax
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
add rsp, 0x20
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
mov al, byte [0x140092260]
movzx ecx, byte [0x140092261]
shl al, 5
mov edx, ecx
shl edx, 6
lea ecx, [rdx + rcx*4]
add cl, al
add cl, 0x49
mov r11, qword [rbp - 0x40]
mov byte [r11], cl
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r13
mov r13, r12
mov ebx, r14d
mov r14b, byte [rbp - 0x48]
mov r15d, 0xbb6db0c2
jmp 0x140014a91
cmp r10d, 0x42b841d2
jg 0x140014f1e
cmp r10d, 0x32ce3007
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x30], r11
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x38], rbx
je 0x1400151bc
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov r11, r12
mov qword [rbp - 0x40], r12
mov ebx, edi
mov byte [rbp - 0x28], dil
mov r15d, r10d
cmp r10d, 0x3a99cdc6
jne 0x140014a91
mov rax, rsi
mov r12, r13
mov edi, r14d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x40]
mov bl, byte [rbp - 0x28]
mov r15d, dword [rbp - 0x4c]
jmp 0x140014a91
cmp r10d, 0x8c8d7946
jle 0x1400150c5
cmp r10d, 0x8c8d7947
mov qword [rbp - 0x18], r8
je 0x1400156e7
mov qword [rbp - 0x28], rsi
mov rcx, r9
mov rdx, r8
mov r8, r11
mov qword [rbp - 0x20], r9
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11, r12
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov r15d, r10d
cmp r10d, 0xa1e48934
jne 0x140014a91
mov eax, r14d
mov eax, dword [0x14009dcb4]
imul ecx, dword [0x1400921c0], 0xcf0b8b24
imul edx, dword [0x1400921c4], 0x42fc0d7f
add ecx, edx
add ecx, 0x1af64a29
xor ecx, eax
imul ecx, eax
mov eax, dword [0x1400921c8]
mov edx, dword [0x1400921cc]
shrd edx, eax, 0xf
xor edx, 0x56493464
mov eax, dword [0x1400921d0]
mov r8d, dword [0x1400921d4]
shrd r8d, eax, 0xb
and edx, ecx
xor r8d, 0x1b9d7777
mov eax, dword [0x1400921d8]
mov ecx, dword [0x1400921dc]
shrd ecx, eax, 9
xor ecx, 0x51a7adfc
mov eax, dword [0x1400921e0]
mov r9d, dword [0x1400921e4]
shrd r9d, eax, 8
imul eax, dword [0x1400921e8], 0xf73ee59d
imul r10d, dword [0x1400921ec], 0x3621e05
xor r9d, 0xc48d58b3
cmp edx, r8d
mov edx, r10d
lea r15d, [rax + rdx + 0x6126cca8]
cmove r15d, r9d
cmp dword [0x14009dcb8], ecx
cmovl r15d, r9d
jmp 0x140015032
cmp r10d, 0x2212069d
je 0x14001532a
mov rcx, r9
mov rdx, r8
mov qword [rbp - 0x18], r8
mov r8, r11
mov qword [rbp - 0x20], r9
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11, r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov byte [rbp - 0x28], dil
mov r15d, r10d
cmp r10d, 0x23e82936
jne 0x140014a91
mov rax, rsi
mov r12, r13
mov edi, r14d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x40]
mov bl, byte [rbp - 0x28]
jmp 0x1400150e3
cmp r10d, 0x42b841d3
je 0x140015368
mov qword [rbp - 0x28], rsi
mov rcx, r9
mov rdx, r8
mov qword [rbp - 0x18], r8
mov r8, r11
mov qword [rbp - 0x20], r9
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11, r12
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov r15d, r10d
cmp r10d, 0x7777e5bb
jne 0x140014a91
mov eax, r14d
imul eax, dword [0x1400920f0], 0xb9c8da47
imul ecx, dword [0x1400920f4], 0xe951a4eb
mov edx, dword [0x14009dcb4]
add eax, ecx
add eax, 0xc1796360
xor eax, edx
mov ecx, dword [0x1400920f8]
mov r8d, dword [0x1400920fc]
shrd r8d, ecx, 0x19
imul eax, edx
xor r8d, 0x930e5c61
and r8d, eax
mov eax, dword [0x140092100]
mov ecx, dword [0x140092104]
shrd ecx, eax, 0x19
xor ecx, 0x95c515d2
imul eax, dword [0x140092108], 0xe9c3abfd
imul edx, dword [0x14009210c], 0x9caa309e
imul r9d, dword [0x140092110], 0xc3133b88
imul r10d, dword [0x140092114], 0xd8eeb22f
imul r11d, dword [0x140092118], 0x897377b1
imul ebx, dword [0x14009211c], 0x9b88a723
cmp r8d, ecx
mov ecx, r10d
mov r8d, r9d
lea ecx, [r8 + rcx - 0x5f305d2e]
mov r8d, ebx
mov r9d, r11d
lea r15d, [r9 + r8 + 0x779b3ac5]
cmove r15d, ecx
add eax, edx
add eax, 0xd2c272d9
cmp dword [0x14009dcb8], eax
cmovl r15d, ecx
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11, r12
mov r13, qword [rbp - 0x40]
mov ebx, edi
jmp 0x140014a91
cmp r10d, 0xcd24aa92
je 0x140015937
mov rcx, r9
mov rdx, r8
mov qword [rbp - 0x18], r8
mov r8, r11
mov qword [rbp - 0x20], r9
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11, r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rbx
mov ebx, edi
mov byte [rbp - 0x28], dil
mov r15d, r10d
cmp r10d, 0xe18654dc
jne 0x140014a91
mov rax, rsi
mov r12, r13
mov edi, r14d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11, qword [rbp - 0x40]
mov bl, byte [rbp - 0x28]
mov r15d, 0xefd57021
jmp 0x140014a91
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov r11, r12
mov ebx, edi
cmp r10d, 0x8659fccc
jne 0x14001598f
mov r15d, 0xa1e48934
jmp 0x140014a91
imul eax, dword [0x14009215c], 0xdc43678c
imul ecx, dword [0x140092160], 0x974c30d4
mov edx, dword [0x14009dcb4]
add eax, ecx
add eax, 0xa379b223
xor eax, edx
mov ecx, dword [0x140092164]
mov r8d, dword [0x140092168]
shrd r8d, ecx, 0xc
imul eax, edx
xor r8d, 0x5cd9c09a
imul ecx, dword [0x14009216c], 0x5445227c
imul edx, dword [0x140092170], 0xfc61cfee
and r8d, eax
mov eax, edx
mov edx, dword [0x14009217c]
mov r9d, dword [0x140092180]
shrd r9d, edx, 0x19
add eax, ecx
add eax, 0xcb3007a0
mov ecx, dword [0x140092184]
mov r15d, dword [0x140092188]
shrd r15d, ecx, 0xe
imul ecx, dword [0x140092174], 0x34445de6
xor r9d, 0x39e25911
xor r15d, 0x70c60395
imul r10d, dword [0x140092178], 0xdfc63812
cmp r8d, eax
mov eax, r10d
cmove r15d, r9d
add eax, ecx
add eax, 0x59294be8
cmp dword [0x14009dcb8], eax
cmovl r15d, r9d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
jmp 0x14001597f
mov eax, dword [0x140092220]
mov ecx, dword [0x140092224]
shrd ecx, eax, 0x1a
xor ecx, 0x461ae7f7
mov eax, ecx
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x40], r13
mov r13, rsp
imul eax, dword [str._Oi], 0xe4a65ace
imul ecx, dword [0x14009222c], 0x68d80479
add eax, ecx
add eax, 0xd188963c
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r15, rsp
mov eax, dword [0x140092230]
mov ecx, dword [0x140092234]
shrd ecx, eax, 9
xor ecx, 0xd9c0f576
mov eax, ecx
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x48], rsp
mov eax, dword [0x140092238]
mov ecx, dword [0x14009223c]
shrd ecx, eax, 0x10
xor ecx, 0x7bce7779
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x28], rsp
sub rsp, 0x20
mov rcx, r15
mov rdx, qword [rbp - 0x58]
mov rbx, qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call rbx
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x60]
call rbx
add rsp, 0x20
imul eax, dword [0x140092240], 0xeeb77816
imul ecx, dword [0x140092244], 0xf3a7b503
add eax, ecx
add eax, 0x47d9772c
mov dword [r13], eax
mov qword [r13 + 8], 0
mov eax, dword [0x140092248]
mov ecx, dword [str._v]
shrd ecx, eax, 0x1d
xor ecx, 0xb92442a9
mov dword [r13 + 0x18], ecx
mov qword [r13 + 0x10], r15
movups xmmword [r13 + 0x20], xmm6
mov eax, dword [0x140092250]
mov ecx, dword [0x140092254]
shrd ecx, eax, 0xf
mov edx, ecx
xor edx, 0xe949cb0d
sub rsp, 0x20
mov rcx, qword [rbp - 0x28]
mov r8, r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11, r12
mov r13, qword [rbp - 0x40]
mov ebx, edi
mov r15d, 0x42b841d3
jmp 0x140014a91
movzx eax, byte [0x140092262]
movzx ecx, byte [0x140092263]
shl eax, 4
lea eax, [rax + rax*2]
add ecx, ecx
lea ecx, [rcx + rcx*2]
add cl, al
add cl, 0x46
mov byte [r12], cl
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov r11, r12
mov ebx, edi
mov r15d, 0x8c8d7947
jmp 0x140014a91
imul eax, dword [0x140092048], 0x5bc2a9e7
imul ecx, dword [str.Lr_I], 0x8a2b5a25
add eax, ecx
add eax, 0x8b3f0d58
add rax, 0xf
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
imul eax, dword [0x140092050], 0x890b66f
imul ecx, dword [0x140092054], 0xb5b3c604
add eax, ecx
add eax, 0x74f28cf9
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x20], rcx
imul eax, dword [0x140092058], 0xa840f37e
imul edx, dword [0x14009205c], 0xed2a9b54
add eax, edx
add eax, 0x9cdf2d79
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x30], rdx
imul eax, dword [0x140092060], 0xe8180091
imul r8d, dword [0x140092064], 0xbab9c772
add eax, r8d
add eax, 0x8d2a0558
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x38], r8
mov eax, dword [0x140092068]
mov r9d, dword [0x14009206c]
shrd r9d, eax, 8
xor r9d, 0x1c4d245f
mov eax, r9d
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r12, rsp
imul eax, dword [0x140092070], 0x682f9224
imul r9d, dword [0x140092074], 0x9bc79434
add eax, r9d
add eax, 0x1d437389
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rbx, rsp
imul eax, dword [0x140092078], 0x5c3ee44d
imul r9d, dword [0x14009207c], 0x282f182c
add eax, r9d
add eax, 0x7074940b
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rsi, rsp
mov qword [rbp - 0x28], rsi
imul eax, dword [0x140092080], 0xc2104094
imul r9d, dword [0x140092084], 0x209b8d81
add eax, r9d
add eax, 0x39ae0036
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r15, rsp
mov qword [rbp - 0x40], r15
mov eax, dword [0x140092088]
mov r9d, dword [0x14009208c]
shrd r9d, eax, 0x10
xor r9d, 0xd36a79
mov eax, r9d
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov byte [rbp - 0x48], r14b
mov r14, rdi
mov eax, dword [rbp + 0x70]
mov dword [rcx], eax
mov rax, qword [rbp - 0x68]
mov qword [rdx], rax
mov eax, dword [rbp - 0x50]
mov dword [r8], eax
sub rsp, 0x20
mov rcx, rbx
mov rdx, qword [rbp - 0x58]
mov r13, qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call r13
mov rcx, rsi
mov rdx, qword [rbp - 0x60]
call r13
add rsp, 0x20
mov eax, dword [0x140092090]
mov ecx, dword [0x140092094]
shrd ecx, eax, 0xa
xor ecx, 0xb0906353
mov dword [r12], ecx
mov qword [r12 + 8], 0
mov eax, dword [0x140092098]
mov ecx, dword [0x14009209c]
shrd ecx, eax, 0x14
xor ecx, 0x77b59c20
mov dword [r12 + 0x18], ecx
mov qword [r12 + 0x10], rbx
imul eax, dword [0x1400920a0], 0xdda73706
imul ecx, dword [0x1400920a4], 0xa6a81cb
movups xmmword [r12 + 0x20], xmm6
lea edx, [rax + rcx]
add edx, 0x710119ec
sub rsp, 0x20
mov rcx, rdi
mov r8, r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
add rsp, 0x20
mov dword [r15], eax
mov ecx, dword [0x1400920a8]
mov edx, dword [0x1400920ac]
shrd edx, ecx, 0xb
xor edx, 0xb9368915
cmp eax, edx
setg bl
imul eax, dword [0x1400920b0], 0xf09eec6a
imul ecx, dword [0x1400920b4], 0x89dbb1f6
mov edx, dword [0x14009dcb4]
add eax, ecx
add eax, 0xb7d9fd1d
xor eax, edx
imul eax, edx
imul ecx, dword [0x1400920b8], 0x2c0ac698
imul edx, dword [0x1400920bc], 0x2bfe7361
add ecx, edx
add ecx, 0xc33621a4
and ecx, eax
mov eax, dword [0x1400920c0]
mov edx, dword [0x1400920c4]
shrd edx, eax, 0x18
mov eax, dword [0x1400920d0]
mov r8d, dword [0x1400920d4]
shrd r8d, eax, 0x1d
xor edx, 0xd8c1930f
mov eax, dword [0x1400920d8]
mov r15d, dword [0x1400920dc]
shrd r15d, eax, 3
imul eax, dword [0x1400920c8], 0x34d32aa1
xor r8d, 0x46e65859
xor r15d, 0x49668c04
imul r11d, dword [0x1400920cc], 0x6b0c352a
cmp ecx, edx
mov ecx, r11d
cmove r15d, r8d
add eax, ecx
add eax, 0x8ec791e
cmp dword [0x14009dcb8], eax
cmovl r15d, r8d
mov rsi, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x20]
mov r11, qword [rbp - 0x18]
mov r13, rdi
mov r14b, byte [rbp - 0x48]
jmp 0x140014a91
mov al, byte [0x14009218c]
movzx ecx, byte [0x14009218d]
shl al, 7
shl ecx, 4
lea ecx, [rcx + rcx*2]
add cl, al
add cl, 0xd0
mov byte [r12], cl
mov eax, dword [0x140092190]
mov ecx, dword [0x140092194]
shrd ecx, eax, 0x13
mov eax, dword [0x14009dcb4]
xor ecx, eax
xor ecx, 0x9df29c8
imul edx, dword [0x140092198], 0x673849bf
imul ecx, eax
imul eax, dword [0x14009219c], 0x5744606f
add eax, edx
add eax, 0x8b4e70f1
mov edx, dword [0x1400921a0]
mov r8d, dword [0x1400921a4]
shrd r8d, edx, 0xf
and eax, ecx
xor r8d, 0xabe9175d
mov ecx, dword [0x1400921a8]
mov edx, dword [0x1400921ac]
shrd edx, ecx, 0xc
mov ecx, dword [0x1400921b8]
mov byte [rbp - 0x48], r14b
mov r14, r9
mov r15d, dword [0x1400921bc]
shrd r15d, ecx, 0x18
imul ecx, dword [0x1400921b0], 0xdef72ee1
xor edx, 0xc09fd6e5
imul r10d, dword [0x1400921b4], 0x5fae84a2
xor r15d, 0xdc4e12b5
cmp eax, r8d
mov eax, r10d
lea eax, [rcx + rax - 0xe4ccdb6]
cmove r15d, eax
cmp dword [0x14009dcb8], edx
cmovl r15d, eax
mov rcx, r9
mov rdx, qword [rbp - 0x18]
mov r8, r11
mov r9, rbx
mov r11, r12
mov ebx, edi
mov r14b, byte [rbp - 0x48]
jmp 0x140014a91
mov eax, dword [rbx]
mov r15, qword [r11]
mov rdx, r9
mov r9d, dword [r8]
imul r8d, dword [0x140092120], 0x5ca98f31
imul r10d, dword [0x140092124], 0x8f44a256
mov rcx, qword [r13]
add r8d, r10d
add r8d, 0x70b0b99d
sub rsp, 0x30
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x30
mov dword [rsi], eax
mov rcx, qword [r13]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
add rsp, 0x20
mov rcx, qword [r13]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
movzx eax, byte [0x140092128]
movzx ecx, byte [0x140092129]
imul eax, eax, 0x4a
imul ecx, ecx, 0x46
add cl, al
add cl, 0x11
mov byte [r12], cl
mov eax, dword [0x14009dcb4]
mov ecx, dword [0x14009212c]
mov edx, dword [0x140092130]
shrd edx, ecx, 0x1b
xor edx, eax
xor edx, 0x12897ec0
mov ecx, dword [0x140092134]
mov r8d, dword [0x140092138]
shrd r8d, ecx, 0x15
imul edx, eax
xor r8d, 0xc3dcdfb9
imul eax, dword [0x14009213c], 0xd0910f89
imul ecx, dword [0x140092140], 0x5a0f1824
and r8d, edx
mov edx, dword [0x14009214c]
mov r9d, dword [0x140092150]
shrd r9d, edx, 0xe
imul edx, dword [0x140092144], 0xc0fca445
imul r10d, dword [0x140092148], 0x98de12fd
add eax, ecx
add eax, 0x1db0602d
imul ecx, dword [0x140092154], 0xd0564f80
xor r9d, 0xe225d9e7
imul r11d, dword [0x140092158], 0xc77f8bae
cmp r8d, eax
mov eax, r11d
lea r15d, [rcx + rax - 0x78e6ffaa]
mov ecx, r10d
cmove r15d, r9d
add ecx, edx
add ecx, 0xc1a21f8e
cmp dword [0x14009dcb8], ecx
cmovl r15d, r9d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
jmp 0x140015982
imul eax, dword [0x1400920e0], 0xdb32282b
imul ecx, dword [0x1400920e4], 0x63a142f8
imul edx, dword [0x1400920e8], 0x365dace4
add eax, ecx
add eax, 0x7a69bc9e
imul ecx, dword [0x1400920ec], 0x41f5601d
lea r15d, [rdx + rcx]
add r15d, 0x3aeff347
test dil, 1
cmovne r15d, eax
mov rcx, r9
mov rdx, r8
mov r8, r11
mov r9, rbx
mov r11, r12
mov ebx, edi
jmp 0x140014a91
mov r15d, r10d
cmp r10d, 0x82562cbd
jne 0x140014a91
mov eax, r14d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret