Function at 0x14004cba4
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x280
movaps xmmword [rsp + 0x270], xmm6
mov rdi, r9
mov rsi, rcx
lea rdx, [0x14022b7e0]
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003b270
cmp byte [rbx + 0x17], 0
jns 0x14004cbde
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x2d0]
lea rax, [rsp + 0x68]
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14004cccc
xorps xmm6, xmm6
lea rbx, [rsp + 0xc8]
movaps xmmword [rbx - 0x28], xmm6
movaps xmmword [rbx - 0x18], xmm6
mov dword [rbx - 8], eax
mov bpl, 1
lea rdx, [rsp + 0x88]
mov byte [rdx + 0x10], bpl
lea rax, [0x14022bbba]
mov qword [rdx], rax
mov qword [rdx + 8], 0x30
mov rcx, rbx
call fcn.140039a7c
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x20], xmm0
and qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x38], xmm0
and qword [rdi + 0x10], 0
movups xmmword [rdi], xmm6
mov rax, qword [r14 + 0x10]
mov qword [rbx + 0x60], rax
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x50], xmm0
and qword [r14 + 0x10], 0
movups xmmword [r14], xmm6
mov byte [rbx + 0x68], bpl
lea r8, [rsp + 0x70]
mov byte [r8 + 0x10], bpl
lea rax, [0x14022bbea]
jmp 0x14004cdb0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x14004ccd8
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [r14 + 0x17]
mov r8, r14
test al, al
jns 0x14004ccf0
mov r8, qword [r14]
mov eax, dword [r14 + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14004ce33
xorps xmm6, xmm6
lea rbx, [rsp + 0xc8]
movaps xmmword [rbx - 0x28], xmm6
movaps xmmword [rbx - 0x18], xmm6
mov dword [rbx - 8], eax
mov bpl, 1
lea rdx, [rsp + 0x88]
mov byte [rdx + 0x10], bpl
lea rax, [0x14022bca2]
mov qword [rdx], rax
mov qword [rdx + 8], 0x30
mov rcx, rbx
call fcn.140039a7c
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x20], xmm0
and qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x38], xmm0
and qword [rdi + 0x10], 0
movups xmmword [rdi], xmm6
mov rax, qword [r14 + 0x10]
mov qword [rbx + 0x60], rax
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x50], xmm0
and qword [r14 + 0x10], 0
movups xmmword [r14], xmm6
mov byte [rbx + 0x68], bpl
lea r8, [rsp + 0x70]
mov byte [r8 + 0x10], bpl
lea rax, [0x14022bcd2]
mov qword [r8], rax
mov qword [r8 + 8], 0xb8
lea rdi, [rsp + 0x1d8]
lea rbx, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rbx
call fcn.14004c9f6
lea r14, [rsp + 0x140]
mov rcx, r14
mov rdx, rdi
call fcn.14004ca3e
mov rcx, rdi
call fcn.14004caf2
mov rcx, rbx
call fcn.14004caf2
mov rcx, rsi
mov rdx, r14
call fcn.14004ce48
mov rcx, r14
call fcn.14004caf2
mov rcx, qword [rsp + 0x50]
mov dl, byte [rsp + 0x67]
call fcn.14003a7a0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x270]
add rsp, 0x280
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsi + 0xa0], 1
jmp 0x14004ce0c