Function at 0x1400f2200
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x320
lea rdi, [rsp + 0x50]
mov ecx, 0xb4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x330]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov byte [rsp + 0x300], 0
mov byte [rsp + 0x301], 0
cmp qword [rsp + 0x338], 0
je 0x1400f2312
cmp dword [rsp + 0x340], 0
jne 0x1400f228a
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x330]
call fcn.1400215e0
jmp 0x1400f2a85
cmp dword [rsp + 0x340], 4
je 0x1400f22cb
mov byte [rsp + 0x301], 1
lea r8, [rsp + 0x2b8]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x338]
call fcn.1400aad00
mov byte [rsp + 0x300], 1
mov qword [rsp + 0x2a8], rax
jmp 0x1400f2312
mov rcx, qword [rsp + 0x338]
call fcn.1400aa620
test eax, eax
je 0x1400f22ef
mov rcx, qword [rsp + 0x338]
call fcn.1400aabb0
mov dword [rsp + 0x74], eax
jmp 0x1400f2312
lea r9, str.Number
mov r8, qword [rsp + 0x338]
xor edx, edx
mov rcx, qword [rsp + 0x330]
call fcn.140021670
jmp 0x1400f2a85
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0xb0]
or eax, 0x20006
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
lea r9, [0x1402a3a04]
xor r8d, r8d
mov rdx, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x2c4], eax
cmp dword [rsp + 0x2c4], 0
je 0x1400f2387
jmp 0x1400f2a35
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x304], eax
cmp dword [rsp + 0x304], 7
ja case.0x1400f23bb.5
mov eax, dword [rsp + 0x304]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0xf2ab0]
add rax, rcx
jmp rax
cmp byte [rsp + 0x300], 0
jne 0x1400f23d3
lea rcx, [0x1402a4150]
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
inc rax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x2c4], eax
jmp 0x1400f2a2a
cmp byte [rsp + 0x300], 0
jne 0x1400f2432
lea rcx, [0x1402a4150]
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
inc rax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x2c4], eax
jmp 0x1400f2a2a
mov rax, qword [rsp + 0x2b8]
lea rax, [rax + rax + 4]
mov rcx, rax
call fcn.1401a7dd0
mov qword [rsp + 0x2c8], rax
cmp qword [rsp + 0x2c8], 0
jne 0x1400f24b3
mov dword [rsp + 0x2c4], shutdown
jmp 0x1400f2a2a
cmp byte [rsp + 0x300], 0
jne 0x1400f24c9
lea rcx, [0x1402a4150]
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
inc rax
mov r8, rax
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2c8]
call fcn.1400ff430
xor eax, eax
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2b8]
mov word [rcx + rdx*2 + 2], ax
cmp qword [rsp + 0x2b8], 0
jbe 0x1400f2559
mov rax, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2b8]
movzx eax, word [rax + rcx*2 - 2]
cmp eax, 0xa
jne 0x1400f2559
mov rax, qword [rsp + 0x2b8]
dec rax
mov byte [rsp + 0x301], 1
mov qword [rsp + 0x2b8], rax
xor eax, eax
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2b8]
mov word [rcx + rdx*2], ax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d0], rax
jmp 0x1400f257f
mov rax, qword [rsp + 0x2d0]
add rax, 2
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
test eax, eax
je 0x1400f25ad
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
cmp eax, 0xa
jne 0x1400f25ab
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
mov word [rcx], ax
jmp 0x1400f256b
cmp qword [rsp + 0x2b8], 0
je 0x1400f25ce
mov rax, qword [rsp + 0x2b8]
add rax, 2
mov qword [rsp + 0x308], rax
jmp 0x1400f25da
mov qword [rsp + 0x308], 0
mov eax, dword [rsp + 0x308]
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x2c4], eax
mov rcx, qword [rsp + 0x2c8]
call fcn.1401a7da0
jmp 0x1400f2a2a
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x2c4], eax
jmp 0x1400f2a2a
cmp byte [rsp + 0x301], 0
jne 0x1400f267a
lea rcx, [0x1402a4158]
call fcn.1401352a0
mov eax, dword [rsp + 0x2b8]
mov dword [rsp + 0x2d8], eax
mov eax, dword [rsp + 0x2d8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x1400f26ab
mov dword [rsp + 0x2c4], 0x57
jmp 0x1400f2a2a
mov eax, dword [rsp + 0x2d8]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x2dc], eax
movsxd rax, dword [rsp + 0x2dc]
mov rcx, rax
call fcn.1401a7dd0
mov qword [rsp + 0x2e0], rax
cmp qword [rsp + 0x2e0], 0
jne 0x1400f26f1
mov dword [rsp + 0x2c4], shutdown
jmp 0x1400f2a2a
mov dword [rsp + 0x2e8], 0
mov dword [rsp + 0x2ec], 0
mov eax, dword [rsp + 0x2d8]
cmp dword [rsp + 0x2ec], eax
jge 0x1400f29d3
mov eax, dword [rsp + 0x2dc]
cmp dword [rsp + 0x2e8], eax
jge 0x1400f29d3
mov dword [rsp + 0x2f0], 0
mov dword [rsp + 0x2f4], reloc.WSOCK32.dll_recv
jmp 0x1400f2758
mov eax, dword [rsp + 0x2f4]
sub eax, 0xf
mov dword [rsp + 0x2f4], eax
cmp dword [rsp + 0x2f4], 0
jl 0x1400f29a3
cmp byte [rsp + 0x300], 0
jne 0x1400f277c
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x30
jl 0x1400f2810
cmp byte [rsp + 0x300], 0
jne 0x1400f27ab
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x39
jg 0x1400f2810
cmp byte [rsp + 0x300], 0
jne 0x1400f27da
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
sub eax, 0x30
imul eax, dword [rsp + 0x2f4]
mov ecx, dword [rsp + 0x2f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2f0], eax
jmp 0x1400f298e
cmp byte [rsp + 0x300], 0
jne 0x1400f2826
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x41
jl 0x1400f28ba
cmp byte [rsp + 0x300], 0
jne 0x1400f2855
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x46
jg 0x1400f28ba
cmp byte [rsp + 0x300], 0
jne 0x1400f2884
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
sub eax, 0x37
imul eax, dword [rsp + 0x2f4]
mov ecx, dword [rsp + 0x2f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2f0], eax
jmp 0x1400f298e
cmp byte [rsp + 0x300], 0
jne 0x1400f28d0
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x61
jl 0x1400f2961
cmp byte [rsp + 0x300], 0
jne 0x1400f28ff
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
cmp eax, 0x66
jg 0x1400f2961
cmp byte [rsp + 0x300], 0
jne 0x1400f292e
lea rcx, [0x1402a4150]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x2ec]
mov rcx, qword [rsp + 0x2a8]
movzx eax, word [rcx + rax*2]
sub eax, 0x57
imul eax, dword [rsp + 0x2f4]
mov ecx, dword [rsp + 0x2f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2f0], eax
jmp 0x1400f298e
mov rcx, qword [rsp + 0x2e0]
call fcn.1401a7da0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x2c4], 0x57
jmp 0x1400f2a35
mov eax, dword [rsp + 0x2ec]
inc eax
mov dword [rsp + 0x2ec], eax
jmp 0x1400f2747
movsxd rax, dword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2e0]
movzx edx, byte [rsp + 0x2f0]
mov byte [rcx + rax], dl
mov eax, dword [rsp + 0x2e8]
inc eax
mov dword [rsp + 0x2e8], eax
jmp 0x1400f2707
mov eax, dword [rsp + 0x2e8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x2c4], eax
mov rcx, qword [rsp + 0x2e0]
call fcn.1401a7da0
jmp 0x1400f2a2a
jmp 0x1400f2a2a
mov dword [rsp + 0x2c4], 0x57
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x14031a1e8]
mov ecx, dword [rsp + 0x2c4]
mov dword [rax + 0x64], ecx
cmp dword [rsp + 0x2c4], 0
je 0x1400f2a66
mov edx, dword [rsp + 0x2c4]
mov rcx, qword [rsp + 0x330]
call fcn.1400236b0
jmp 0x1400f2a85
xor r8d, r8d
lea rdx, [0x1402a3a18]
mov rcx, qword [rsp + 0x330]
call fcn.14004e740
jmp 0x1400f2a85
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_connect
call fcn.140134a00
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140135520
add rsp, 0x320
pop rdi
ret