Function at 0x14001d740
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r14, rcx
mov rdi, rdx
mov rcx, qword [0x1402bb450]
mov word [rsp + 0x50], cx
lea eax, [rcx + 2]
mov word [rsp + 0x52], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x58], rax
cmp rcx, 0xfffe
jbe 0x14001d7ae
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14001d872
xor r8d, r8d
lea rax, [rsp + 0x48]
lea r9, [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
lea rcx, [r8 - 9]
call fcn.140167940
mov ebx, eax
test eax, eax
js 0x14001d818
xor r13d, r13d
lea r8, [rbp + 0x78]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0xa8]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x14001d810
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14001d8e5
nop dword [rax + rax]
cmp ebx, 0xc0000022
je 0x14001d84d
cmp ebx, 0xc0000005
je 0x14001d84d
mov eax, ebx
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x14001d844
movzx eax, bx
jmp 0x14001d858
cmp eax, 0xb
jne 0x14001d85c
mov eax, ebx
jmp 0x14001d858
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001d868
lfence
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14001d872
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001d8d1
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, ds:[rbx - 0x10]
mov esi, 0xffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001dbab
lfence
jmp 0x14001dba6
mov edx, 0x10
call sym.SystemInformer.exe_QiShowMessage
nop dword [rax + rax]
jmp 0x14001dbab
mov rcx, rdi
mov qword [rsp + 0x210], r12
call fcn.14013a420
mov rbx, rax
mov dword [rsp + 0x60], 0x10000e
mov r15d, 0x10
xor r8d, r8d
mov edx, dword [rax]
mov rcx, qword [rax + 8]
add edx, 2
mov dword [rsp + 0x28], edx
lea rax, str.LastKey
mov qword [rsp + 0x20], rcx
lea r9d, [r15 - 0xf]
mov rcx, qword [rbp + 0xa8]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001d965
nop
call fcn.14013fb00
lea rcx, [rsp + 0x70]
call sym.SystemInformer.exe_QiGetSystemRoot
mov rdi, qword [rsp + 0x70]
mov rdx, qword [0x1402c4fb8]
lea rbx, [rdi + 0x18]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdx, qword [rsp + 0x78]
mov r8, rdi
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.1402074d0
mov rcx, qword [r12 + 8]
movups xmm0, xmmword [str._regedit.exe]
movups xmmword [rdi + rcx], xmm0
movsd xmm0, qword [0x14023a998]
movsd qword [rdi + rcx + 0x10], xmm0
lea rcx, [rbp + 0x60]
call sym.SystemInformer.exe_QiGetOwnTokenAttributes
xorps xmm0, xmm0
test dword [rax + 8], 1
mov rax, qword [r12 + 8]
je 0x14001da4b
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x70
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x7c], 0x800540
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x50], 5
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1401398e0
test al, al
je 0x14001dab4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001db8f
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001db8f
xor ecx, ecx
mov qword [rbp + 8], rax
mov qword [rbp + 0x54], rcx
lea rax, str.runas
mov dword [rbp + 0x5c], ecx
lea rcx, [rbp - 0x10]
movups xmmword [rbp + 0x24], xmm0
mov dword [rbp - 0x10], 0x70
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp - 0xc], 0x800540
movups xmmword [rbp + 0x44], xmm0
mov qword [rbp - 8], r14
movdqa xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 5
mov qword [rbp], rax
call fcn.1401398e0
test al, al
je 0x14001dab4
mov rcx, qword ds:[rbp + 0x58]
test rcx, rcx
je 0x14001db8f
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14001db8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebx, eax
test eax, eax
jns 0x14001db8f
cmp eax, 0xc0000022
je 0x14001db02
cmp eax, 0xc0000005
je 0x14001db02
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001daf2
movzx eax, bx
jmp 0x14001db0d
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14001db11
mov eax, ebx
jmp 0x14001db0d
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14001db1d
lfence
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14001db27
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_execute_the_program.
mov rcx, r14
test rax, rax
je 0x14001db87
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001db8f
lfence
call fcn.14013fb00
jmp 0x14001db8f
mov edx, r15d
call sym.SystemInformer.exe_QiShowMessage
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], esi
mov r12, qword [rsp + 0x210]
cmp esi, 1
jne 0x14001dbab
call fcn.14013fb00
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret