Function at 0x14001ceb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x48], rcx
lea r14, [rcx + 0x10]
mov r13, qword [r14 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, 0xd
jb 0x14001d580
cmp qword [r14 + 0x18], 8
jb 0x14001cf19
mov r14, qword [r14]
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea r12, [r13 + 0xd]
lea ebx, [rax + 7]
lea r15, [rsp + 0x78]
lea eax, [rbx + 3]
lea rsi, [rbx - 8]
movabs rdx, 0x7fffffffffffffff
cmp r12, rbx
jbe 0x14001cf89
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14001cf5b
mov rbx, rcx
jmp 0x14001cf62
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rsi
cmp rcx, rdx
ja 0x14001d586
lfence
add rcx, rcx
call fcn.140012d70
mov r15, rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.1401a9040
movups xmm0, xmmword [str.HealthEvents]
movups xmmword [r15 + rbx], xmm0
movsd xmm1, qword [0x14020ad28]
movsd qword [r15 + rbx + 0x10], xmm1
movzx eax, word [0x14020ad30]
mov word [r15 + rbx + 0x18], ax
xor eax, eax
mov word [r15 + r12*2], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor r15d, r15d
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], r15d
mov qword [rbp - 0x38], r15
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r8, qword [rsp + 0x78]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], r15d
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + 8]
lea rcx, [rbp - 0x48]
call fcn.140018690
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x14001d44a
mov rcx, rdi
mov rbx, qword [rdi + 0x18]
cmp rbx, 8
jb 0x14001d03c
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001d07d
mov rax, rsi
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14001d044
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Context
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rdi + 0x18]
mov r14, qword [rdi + 0x10]
mov r11, rdi
cmp rbx, 8
jb 0x14001d08d
mov r11, qword [rdi]
mov rdx, r14
mov eax, 0xe
cmp r14, rax
cmova rdx, rax
mov r9, rdx
lea rax, str.rebootoptional
mov r8d, 0x72
test rdx, rdx
je 0x14001d0e5
movzx ecx, word [r11]
mov r10d, r8d
cmp cx, r8w
jb 0x14001d0eb
sub r11, rax
cmp cx, r10w
ja 0x14001d0eb
cmp r9, 1
je 0x14001d0e5
dec r9
add rax, 2
movzx ecx, word [rax + r11]
movzx r10d, word [rax]
cmp cx, r10w
jae 0x14001d0c5
jmp 0x14001d0eb
cmp r14, 0xe
je 0x14001d146
mov r9, rdi
cmp rbx, 8
jb 0x14001d0f7
mov r9, qword [rdi]
lea rax, str.rebootrequired
test rdx, rdx
je 0x14001d139
movzx ecx, word [r9]
cmp cx, r8w
jb 0x14001d13f
sub r9, rax
cmp cx, r8w
ja 0x14001d13f
cmp rdx, 1
je 0x14001d139
dec rdx
add rax, 2
movzx ecx, word [rax + r9]
movzx r8d, word [rax]
cmp cx, r8w
jae 0x14001d114
mov dword [rsp + 0x44], r15d
jmp 0x14001d14e
cmp r14, 0xe
je 0x14001d146
mov dword [rsp + 0x44], r15d
jmp 0x14001d14e
mov dword [rsp + 0x44], 1
mov r12, qword [rbp - 0x78]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 1
jb 0x14001d58c
lea r13, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r13, qword [rsp + 0x78]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea r15, [r12 + 1]
mov ebx, 7
lea r14, [rsp + 0x50]
cmp r15, rbx
jbe 0x14001d1ee
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14001d1b0
mov rbx, rcx
jmp 0x14001d1bd
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rsi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001d592
lfence
add rcx, rcx
call fcn.140012d70
mov r14, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.1401a9040
mov eax, 0x5c
mov word [r14 + rbx], ax
xor r12d, r12d
mov word [r14 + r15*2], r12w
mov rax, qword [rsp + 0x70]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14001d22f
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000fc30
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001d2a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d2a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d598
call fcn.1401853a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x30], r12
mov dword [rbp - 0x28], r12d
mov qword [rbp - 0x20], r12
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x28], 0x20206
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 8]
lea rcx, [rbp - 0x30]
call fcn.140018690
mov dword [rsp + 0x40], eax
mov r14, qword [rbp - 0x30]
test eax, eax
jne 0x14001d34b
cmp qword [rdi + 0x18], 8
jb 0x14001d307
mov rdi, qword [rdi]
test rdi, rdi
je 0x14001d344
nop dword [rax]
lea rsi, [rsi + 1]
cmp word [rdi + rsi*2], 0
jne 0x14001d310
lea eax, [rsi*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.Context
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bl, 1
jmp 0x14001d3e5
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x10]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 3
lea rcx, [rbp]
call fcn.14000f010
nop
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rbp - 8], eax
setl byte [rbp + 0xf8]
jl 0x14001d3da
lea rdx, str.Could_not_create
lea rcx, [rbp - 0x10]
call fcn.140021ad0
lea rdx, [rbp - 0x68]
mov rcx, rax
call fcn.140021890
lea rdx, str._with_error:
mov rcx, rax
call fcn.140021b30
mov rcx, rax
call fcn.140021490
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400214d0
mov byte [rbp + 0xf8], 1
lea rcx, [rbp - 0x10]
call fcn.14000afe0
xor bl, bl
test r14, r14
je 0x14001d3f4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14001d434
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d42f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d59e
call fcn.1401853a0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
jmp 0x14001d4fd
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x100]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], 3
lea rcx, [rbp + 0x110]
call fcn.14000f010
nop
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rbp + 0x108], eax
setl byte [rbp + 0x208]
jl 0x14001d4ef
lea rdx, str.Could_not_create
lea rcx, [rbp + 0x100]
call fcn.140021ad0
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140021890
lea rdx, str._with_error:
mov rcx, rax
call fcn.140021b30
mov rcx, rax
call fcn.140021490
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400214d0
mov byte [rbp + 0x208], 1
lea rcx, [rbp + 0x100]
call fcn.14000afe0
xor bl, bl
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x14001d510
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x14001d54d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d57a
call fcn.1401853a0
movzx eax, bl
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0x378]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401b3c00
int3
call fcn.140008810
int3
call fcn.140008770
nop
call fcn.140008810
nop
call fcn.140008770
nop
call fcn.1401b3c00
nop
call fcn.1401b3c00
int3