Function at 0x140040cf4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14008d310]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x68], rbx
and dword [rsp + 0x70], ebx
and qword [rsp + 0x78], rbx
and qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.14005f874
test eax, eax
js 0x140040ff4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
lea rax, str.VSMEMDATAPIDS
mov qword [rsp + 0x28], rax
lea rax, str.17.0
mov qword [rsp + 0x20], rax
lea r9, str.SoftwareMicrosoftVSCommon
lea r8, str._s_s_s_d
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.14001d660
test eax, eax
js 0x140040ff4
and qword [rsp + 0x58], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140040ff4
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.VSInstanceId
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140040ff4
mov rax, qword [rdi + 0x18]
imul rax, qword [rdi + 0x50]
shr rax, 0x14
mov dword [rsp + 0x50], eax
mov r15d, 4
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.PeakPageFileCommitMB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsi + 0x20]
shr rax, 0x14
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.AvailablePageFileMB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsi + 0x18]
shr rax, 0x14
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.TotalPageFileMB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsi + 0x10]
shr rax, 0x14
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.AvailablePhysicalMemoryMB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsi + 8]
shr rax, 0x14
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.TotalPhysicalMemoryMB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rdi + 0x50]
mov rdx, rcx
imul rdx, qword [rdi + 0x18]
xorps xmm0, xmm0
test rdx, rdx
js 0x140040f3f
cvtsi2sd xmm0, rdx
jmp 0x140040f54
mov rax, rdx
shr rax, 1
and edx, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
imul rcx, qword [rdi + 0x10]
xorps xmm1, xmm1
test rcx, rcx
js 0x140040f68
cvtsi2sd xmm1, rcx
jmp 0x140040f7d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
divsd xmm0, xmm1
mulsd xmm0, qword [0x14007ceb8]
cvttsd2si rax, xmm0
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.ResourceUsagePercent
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, SafeArrayDestroy
xor r8d, r8d
lea rdx, str.CollectionTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x14004100d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret