Function at 0x1401a36a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [r8 + rdx], 0
jne 0x1401a36f0
lea rcx, [rsp + 0x50]
call fcn.140007c30
mov rsi, qword [rdi + 0x28]
mov rbx, qword [rdi + 0x20]
cmp rbx, rsi
je 0x1401a3755
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
lea rdx, [rsp + 0x50]
cmp r15, 0xf
cmova rdx, r12
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1401a373e
mov rcx, qword [rbx]
cmp r8, r14
jne 0x1401a374c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401a3755
add rbx, 0x20
cmp rbx, rsi
jne 0x1401a3720
lea rcx, [rsp + 0x50]
call fcn.1400050e0
mov rsi, qword [rdi + 0x28]
cmp rbx, rsi
je 0x1401a3798
add rbx, 0x20
cmp rbx, rsi
je 0x1401a3786
lea rcx, [rbx - 0x20]
mov rdx, rbx
call fcn.1400079a0
add rbx, 0x20
cmp rbx, rsi
jne 0x1401a3771
mov rcx, qword [rdi + 0x28]
sub rcx, 0x20
call fcn.1400050e0
add qword [rdi + 0x28], 0xffffffffffffffe0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r8 + rbp], 0
jne 0x1401a37b0
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140007c30
nop
mov r8, qword [rdi + 0x20]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 0x20]
call fcn.140154710
nop
lea rcx, [rsp + 0x50]
call fcn.1400050e0
xor esi, esi
mov qword [rsp + 0x70], rsi
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1401a37fe
mov rdx, qword [rdi]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1401a38fa
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1401a384b
mov rdx, qword [rdi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1401a38fa
mov rbx, qword [rdi + 0x20]
mov rbp, qword [rdi + 0x28]
cmp rbx, rbp
je 0x1401a38ef
mov r9d, esi
inc esi
lea r8, [0x14028c448]
mov edx, 0x50
lea rcx, [rsp + 0x80]
call fcn.1400d5290
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1401a38ab
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1401a38b2
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1401a38ef
add rbx, 0x20
cmp rbx, rbp
jne 0x1401a3880
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rdi + 0x28]
sub rax, qword [rdi + 0x20]
sar rax, 5
cmp rax, 0xa
jbe 0x1401a391a
lea rcx, [rdi + 0x20]
mov edx, 0xa
call fcn.14016f1e0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140244f00
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret