Function at 0x140060bc0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x140], rbx
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, rdx
mov rsi, rcx
lea rdi, [rcx + 0x1b0]
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.1400d6158
or rbx, 0xffffffffffffffff
test rax, rax
jne 0x140060c1d
mov eax, ebx
jmp 0x140060c23
sub rax, qword [rdi]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14002bb50
nop
call fcn.140055390
test al, al
jne 0x140060d41
mov r8d, dword [0x1401d5d60]
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r13d, eax
mov eax, 0x55555556
imul r8d
mov r11d, edx
shr r11d, 0x1f
add r11d, edx
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0x40], eax
mov eax, 0x66666667
imul r8d
mov r10d, edx
sar r10d, 1
mov ecx, r10d
shr ecx, 0x1f
add r10d, ecx
mov eax, 0x2aaaaaab
imul r8d
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov r14d, 1
lea r9, [rsp + 0x81]
lea r15d, [r14 + 0xd]
mov edi, dword [rsp + 0x40]
mov eax, r8d
cdq
idiv r14d
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, r8b
imul cl
mov byte [r9 - 1], al
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, r13b
imul cl
mov byte [r9], al
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, r11b
imul cl
mov byte [r9 + 1], al
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, dil
imul cl
mov byte [r9 + 2], al
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, r10b
imul cl
mov byte [r9 + 3], al
movzx eax, dl
imul r8b
movzx ecx, al
movzx eax, bpl
imul cl
mov byte [r9 + 4], al
inc r14d
lea r9, [r9 + 6]
dec r15
jne 0x140060cb2
lea rdi, [rsi + 0x1b0]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060dcb
call fcn.1400579d0
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14001b320
nop
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], r12
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140060dbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x140060dcb
mov dil, 1
jmp 0x140060f22
mov eax, dword [0x1401d5d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
xor ebp, ebp
cmp ecx, 7
jne 0x140060e1a
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
call fcn.140058340
mov rdi, rax
lea rcx, str.__r_
mov rdx, qword [str.__r_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rdi, rdi
je 0x140060e7c
test rdi, 0xffffffffffff0000
jne 0x140060e6b
movzx edi, di
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140060e8f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002760
jmp 0x140060e8f
mov rax, rbx
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x140060e70
jmp 0x140060e7e
mov eax, ebp
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140002470
nop
call fcn.140057bd0
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001b320
nop
lea r8, [rsi + 0x190]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000ff10
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140060ed5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140055600
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400158c0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140060f02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140060f1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor dil, dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140060f3c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x140]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret