Function at 0x1400346a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
movabs rcx, 0x6c4f846c129b4532
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x38], rcx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
movabs rax, 0x21ad8429832a1bc9
mov qword [rbp - 0x70], rax
movabs r14, 0x964ee04d877a4dc5
mov qword [rbp - 0x68], rcx
movabs rax, 0x963ae02b87154d96
mov qword [rbp - 0x60], rax
movabs r15, 0x1d713b20848b025e
movabs rax, 0x1d143b5284ea0229
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x58], rax
movabs rdi, 0x76ab0c63320340b7
movups xmm0, xmmword [rbp - 0x60]
movabs rax, 0x76ea0c2b325040eb
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x50], rax
movabs rsi, 0xe58cdb6274792f0
xorps xmm0, xmmword [rsp + 0x70]
movabs rax, 0xe10cde5270c92a2
mov qword [rbp - 0x48], rax
xor r9d, r9d
movups xmm1, xmmword [rbp - 0x50]
movabs rax, 0x21ad8429837a1b86
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x40], rax
xor r8d, r8d
movups xmm2, xmmword [rbp - 0x40]
lea rax, [rbp + 0x208]
mov qword [rbp - 0x78], rsi
xorps xmm1, xmmword [rbp - 0x80]
mov rcx, 0xffffffff80000001
xorps xmm2, xmmword [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 2
movdqa xmmword [rbp - 0x40], xmm2
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400349cf
cmp byte [reloc.WS2_32.dll_accept], bl
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x208]
movabs rax, 0x962be020871f4d97
mov qword [rsp + 0x50], rax
setne bl
movabs rax, 0x1d033b4584e90233
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x58], rax
mov r9d, 4
movups xmm0, xmmword [rsp + 0x50]
movabs rax, 0x76c20c04326c40fb
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x60], rax
xor r8d, r8d
xorps xmm0, xmmword [rsp + 0x70]
movabs rax, 0xe58cdb62747929e
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x200]
movups xmm1, xmmword [rsp + 0x60]
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rsi
xorps xmm1, xmmword [rbp - 0x80]
mov dword [rsp + 0x28], 4
movdqa xmmword [rbp - 0x50], xmm1
mov dword [rbp + 0x200], ebx
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400349c2
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], 0x100
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [0x140112030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, byte [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp + 0x208]
mov r9d, 3
mov byte [rsp + 0x50], al
xor r8d, r8d
movzx eax, byte [rbp - 0x2e]
mov byte [rsp + 0x51], al
movzx eax, byte [rbp - 0x2c]
mov byte [rsp + 0x52], al
movzx eax, byte [rbp - 0x2a]
mov byte [rsp + 0x53], al
movzx eax, byte [rbp - 0x28]
mov byte [rsp + 0x54], al
movzx eax, byte [rbp - 0x26]
mov byte [rsp + 0x55], al
movzx eax, byte [rbp - 0x24]
mov byte [rsp + 0x56], al
movzx eax, byte [rbp - 0x22]
mov byte [rsp + 0x57], al
movzx eax, byte [rbp - 0x20]
mov byte [rsp + 0x58], al
movzx eax, byte [rbp - 0x1e]
mov byte [rsp + 0x59], al
movzx eax, byte [rbp - 0x1c]
mov byte [rsp + 0x5a], al
movzx eax, byte [rbp - 0x1a]
mov byte [rsp + 0x5b], al
movzx eax, byte [rbp - 0x18]
mov byte [rsp + 0x5c], al
movzx eax, byte [rbp - 0x16]
mov byte [rsp + 0x5d], al
movzx eax, byte [rbp - 0x14]
mov byte [rsp + 0x5e], al
movzx eax, byte [rbp - 0x12]
mov byte [rsp + 0x5f], al
movzx eax, byte [rbp - 0x10]
mov byte [rsp + 0x60], al
movzx eax, byte [rbp - 0xe]
mov byte [rsp + 0x61], al
movzx eax, byte [rbp - 0xc]
mov byte [rsp + 0x62], al
movzx eax, byte [rbp - 0xa]
mov byte [rsp + 0x63], al
movabs rax, 0x9627e02a87154d89
mov qword [rsp + 0x70], rax
movabs rax, 0x1d083b4584c00230
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rsi
movups xmm1, xmmword [rbp - 0x80]
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r15
xorps xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rsi
xorps xmm1, xmmword [rbp - 0x50]
mov dword [rsp + 0x28], reloc.WS2_32.dll_sendto
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret