Function at 0x14006ec00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140401ac0]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor r15d, r15d
lea edx, [r15 + 0xc]
lea rcx, [rbp + 0xd8]
call fcn.14007bd20
mov r14, rax
lea edx, [r15 + 4]
lea rcx, [rbp + 0xb8]
call fcn.14007bd20
mov rsi, rax
lea edx, [r15 + 4]
lea rcx, [rbp + 0x98]
call fcn.14007bd20
mov rdi, rax
lea edx, [r15 + 4]
lea rcx, [rbp + 0x78]
call fcn.14007bd20
mov rbx, rax
lea edx, [r15 + 8]
lea rcx, [rbp + 0x58]
call fcn.14007bd20
nop
lea r9d, [r15 + 1]
lea r8, [0x14026c364]
xor edx, edx
mov rcx, rax
call fcn.14007da60
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006ed0f
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_45
lea rax, [rsp + 0x38]
jmp 0x14006ed30
mov qword [rsp + 0x20], 1
lea r9, [0x14026c360]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x38]
call fcn.1400617f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp + 0x38]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x48]
call fcn.140067440
nop
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006ed99
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x48]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_45
lea rax, [rbp - 0x48]
jmp 0x14006edb9
mov qword [rsp + 0x20], 1
lea r9, [0x14026c360]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x48]
call fcn.1400617f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x18]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140067440
nop
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006ee22
lea rax, [rcx + 1]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x68]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x68]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_45
lea rax, [rbp - 0x68]
jmp 0x14006ee42
mov qword [rsp + 0x20], 1
lea r9, [0x14026c360]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x68]
call fcn.1400617f0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp - 8]
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006eeaf
lea rax, [rcx + 1]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x78]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_45
lea rax, [rsp + 0x78]
jmp 0x14006eed0
mov qword [rsp + 0x20], 1
lea r9, [0x14026c360]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x78]
call fcn.1400617f0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r14
lea r8, [rbp - 0x28]
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140067440
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006ef40
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x7d
lea rax, [rsp + 0x58]
jmp 0x14006ef61
mov qword [rsp + 0x20], 1
lea r9, [0x14026c35c]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x58]
call fcn.1400617f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14006efd7
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006efd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4e0
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14006f026
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f020
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4e6
call fcn.140222bac
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14006f062
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f05d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4ec
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14006f0b0
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f0aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4f2
call fcn.140222bac
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14006f0eb
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f0e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4f8
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14006f138
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f132
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4fe
call fcn.140222bac
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14006f173
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f16e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f504
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x14006f1c0
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f1ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f50a
call fcn.140222bac
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14006f1fd
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f1f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f510
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x14006f24b
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f246
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f516
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14006f29a
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f295
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f51c
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x14006f2ef
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f2ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f522
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp + 0xa8], xmm0
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x14006f347
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f528
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp + 0xc8], xmm0
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x14006f39f
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f39a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f52e
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
mov qword [rbp + 0xf8], r15
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x14026c368]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0xf
cmova rdx, qword [rbp + 0x100]
lea r8, [rbp + 0x100]
cmova r8, qword [rbp + 0x100]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14006f413
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
lea rdx, str.MachineId
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Success..__n
lea rcx, [0x140412ac0]
call fcn.14005bdd0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14006f4ae
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f4a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4da
call fcn.140222bac
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140222c70
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
nop
call fcn.140238238
int3