Function at 0x1400059b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, rdx
mov qword [rbp - 0x40], rcx
xor eax, eax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400137ec]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rbx
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400137f0]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400137f8]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
movdqa xmm1, xmmword [0x140013ea0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140013eb0]
movdqu xmmword [rsp + 0x60], xmm2
xor cl, cl
mov dl, 0xb
mov r8b, 0x11
mov r9b, 0x33
xor r10b, r10b
mov bl, 0x17
mov dil, 0x16
mov sil, 0xc
mov r14b, 0xa
movzx r15d, dl
mov r12b, 0x39
mov r13b, 0x37
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r11b
xor byte [rsp + 0x53], r11b
xor byte [rsp + 0x54], r11b
xor byte [rsp + 0x55], r11b
xor byte [rsp + 0x56], r11b
xor byte [rsp + 0x57], r11b
xor byte [rsp + 0x58], r11b
xor byte [rsp + 0x59], r11b
xor byte [rsp + 0x5a], r11b
xor byte [rsp + 0x5b], r11b
xor byte [rsp + 0x5c], r11b
xor byte [rsp + 0x5d], r11b
xor byte [rsp + 0x5e], r11b
xor byte [rsp + 0x5f], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r11b
xor byte [rsp + 0x62], r11b
xor byte [rsp + 0x63], r11b
xor byte [rsp + 0x64], r11b
xor byte [rsp + 0x65], r11b
xor byte [rsp + 0x66], r11b
xor byte [rsp + 0x67], r11b
xor byte [rsp + 0x68], r11b
xor byte [rsp + 0x69], r11b
xor byte [rsp + 0x6a], r11b
xor byte [rsp + 0x6b], r11b
xor byte [rsp + 0x6c], r11b
xor byte [rsp + 0x6d], r11b
xor byte [rsp + 0x6e], r11b
xor byte [rsp + 0x6f], r11b
xor cl, r11b
mov byte [rsp + 0x70], cl
xor dl, r11b
mov byte [rsp + 0x71], dl
xor r8b, r11b
mov byte [rsp + 0x72], r8b
xor r9b, r11b
mov byte [rsp + 0x73], r9b
xor r10b, r11b
mov byte [rsp + 0x74], r10b
xor bl, r11b
mov byte [rsp + 0x75], bl
xor dil, r11b
mov byte [rsp + 0x76], dil
xor sil, r11b
mov byte [rsp + 0x77], sil
xor r14b, r11b
mov byte [rsp + 0x78], r14b
xor r15b, r11b
mov byte [rsp + 0x79], r15b
xor r12b, r11b
mov byte [rsp + 0x7a], r12b
xor r13b, r11b
mov byte [rsp + 0x7b], r13b
mov al, 0x10
xor al, r11b
mov byte [rsp + 0x7c], al
mov al, 0xb
xor al, r11b
mov byte [rsp + 0x7d], al
mov byte [rsp + 0x7e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x51]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140005be0
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x80]
call fcn.1400079e0
nop
mov r14d, dword [rbp - 0x70]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.1400107b4
mov rsi, rax
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140006b00
mov rcx, rsi
call fcn.140010460
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140005cfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cf6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140005d4a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
mov edi, r15d
test esi, esi
sete dil
test esi, esi
jne 0x140005d9f
lea rax, [rbp - 0x30]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x140005d60
lea ebx, [rbx*2 + 2]
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, r15d
test eax, eax
sete dil
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140005dae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140010440
mov rbx, qword [rsp + 0x540]
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret