Function at 0x140005ff0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x14001a040]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, rdx
mov qword [rbp - 0x40], rcx
xor eax, eax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea r8, [0x14001482c]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rbx
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140014830]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140014838]
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
movdqa xmm1, xmmword [0x140015460]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140015440]
movdqu xmmword [rsp + 0x60], xmm2
mov cl, 0x6d
mov dl, 0x66
mov r8b, 0x7c
mov r9b, 0x5e
movzx r10d, cl
mov bl, 0x7a
mov dil, 0x7b
mov sil, 0x61
mov r14b, 0x67
movzx r15d, dl
mov r12b, 0x54
mov r13b, 0x5a
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], r11b
xor byte [rsp + 0x53], r11b
xor byte [rsp + 0x54], r11b
xor byte [rsp + 0x55], r11b
xor byte [rsp + 0x56], r11b
xor byte [rsp + 0x57], r11b
xor byte [rsp + 0x58], r11b
xor byte [rsp + 0x59], r11b
xor byte [rsp + 0x5a], r11b
xor byte [rsp + 0x5b], r11b
xor byte [rsp + 0x5c], r11b
xor byte [rsp + 0x5d], r11b
xor byte [rsp + 0x5e], r11b
xor byte [rsp + 0x5f], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], r11b
xor byte [rsp + 0x62], r11b
xor byte [rsp + 0x63], r11b
xor byte [rsp + 0x64], r11b
xor byte [rsp + 0x65], r11b
xor byte [rsp + 0x66], r11b
xor byte [rsp + 0x67], r11b
xor byte [rsp + 0x68], r11b
xor byte [rsp + 0x69], r11b
xor byte [rsp + 0x6a], r11b
xor byte [rsp + 0x6b], r11b
xor byte [rsp + 0x6c], r11b
xor byte [rsp + 0x6d], r11b
xor byte [rsp + 0x6e], r11b
xor byte [rsp + 0x6f], r11b
xor cl, r11b
mov byte [rsp + 0x70], cl
xor dl, r11b
mov byte [rsp + 0x71], dl
xor r8b, r11b
mov byte [rsp + 0x72], r8b
xor r9b, r11b
mov byte [rsp + 0x73], r9b
xor r10b, r11b
mov byte [rsp + 0x74], r10b
xor bl, r11b
mov byte [rsp + 0x75], bl
xor dil, r11b
mov byte [rsp + 0x76], dil
xor sil, r11b
mov byte [rsp + 0x77], sil
xor r14b, r11b
mov byte [rsp + 0x78], r14b
xor r15b, r11b
mov byte [rsp + 0x79], r15b
xor r12b, r11b
mov byte [rsp + 0x7a], r12b
xor r13b, r11b
mov byte [rsp + 0x7b], r13b
mov al, 0x7d
xor al, r11b
mov byte [rsp + 0x7c], al
mov al, 0x66
xor al, r11b
mov byte [rsp + 0x7d], al
mov byte [rsp + 0x7e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x51]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140006220
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x80]
call fcn.140008180
nop
mov r14d, dword [rbp - 0x70]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.140011274
mov rsi, rax
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1400072a0
mov rcx, rsi
call fcn.140010f20
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000633b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006336
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006336
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010f20
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000638a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010f20
mov edi, r15d
test esi, esi
sete dil
test esi, esi
jne 0x1400063df
lea rax, [rbp - 0x30]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x1400063a0
lea ebx, [rbx*2 + 2]
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, r15d
test eax, eax
sete dil
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400063ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140010f00
mov rbx, qword [rsp + 0x540]
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret