Function at 0x140051cf0
Capabilities:
Set registry value

Disassembly:
push rax
pushf
mov eax, 0x586a11e4
pushf
not eax
add eax, 0x57c3670c
xor eax, 0x5fef05dc
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x1326e1a6
xor eax, 0x24a40862
rol eax, 0x7e
popf
cmp eax, 7
jne 0x140051d2d
popf
pop rax
jmp 0x1400522cd
cmp eax, 4
jne 0x140051d3c
popf
pop rax
jmp 0x140052180
cmp eax, 1
jne 0x140051d4b
popf
pop rax
jmp 0x140051e9d
cmp eax, 9
jne 0x140051d5a
popf
pop rax
jmp 0x1400523ca
cmp eax, 8
jne 0x140051d69
popf
pop rax
jmp 0x140052362
cmp eax, 0xb
jne 0x140051d78
popf
pop rax
jmp 0x140052513
cmp eax, 6
jne 0x140051d87
popf
pop rax
jmp 0x14005224f
cmp eax, 5
jne 0x140051d96
popf
pop rax
jmp 0x140052201
cmp eax, 0xc
jne 0x140051da5
popf
pop rax
jmp 0x140052569
cmp eax, 0
jne 0x140051db4
popf
pop rax
jmp 0x140051de1
cmp eax, 0xa
jne 0x140051dc3
popf
pop rax
jmp 0x1400524b1
cmp eax, 2
jne 0x140051dd2
popf
pop rax
jmp 0x140051f9b
cmp eax, 3
jne 0x140051de1
popf
pop rax
jmp 0x140052032
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rbx, rcx
lea rdx, [rbp + 0x180]
xor edi, edi
xor ecx, ecx
mov qword [rbp + 0x180], rdi
mov qword [rbp + 0x178], rdi
call fcn.140074589
test eax, eax
js 0x140051e57
push rax
pushf
mov eax, 0x22ae4e94
pushf
not eax
add eax, 0x3205fa2a
xor eax, 0x48d4b8c6
rol eax, 0x62
popf
pushf
not eax
add eax, 0x43046200
xor eax, 0x24b814b2
rol eax, 0x8a
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0x5f38ca3
pushf
not eax
add eax, 0x207a4d9f
xor eax, 0x30bef8c1
rol eax, 0x18
popf
pushf
not eax
add eax, 0x5f6dc6a2
xor eax, 0x7e285dbf
rol eax, 0x26
popf
pushf
not eax
add eax, 0x15bf61bd
xor eax, 0x3b4a6c26
rol eax, 0xb
popf
jmp 0x140051d1e
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x178]
mov qword [rsp + 0x40], rdi
lea rdx, [0x1aaf26829]
pushf
sub rdx, 0x6aefef51
popf
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], edi
jmp 0x140051edf
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140051f42
push rax
pushf
mov eax, 0x3ed4beb0
pushf
not eax
add eax, 0x169357d0
xor eax, 0x1e493976
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xc78521f
xor eax, 0x2844794a
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x27710fc
xor eax, 0x525715cd
rol eax, 0x32
popf
pushf
not eax
add eax, 0x70e945e8
xor eax, 0x6112cc7e
rol eax, 0x93
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0x9081fced
pushf
not eax
add eax, 0x9b8eff1
xor eax, 0x1c013af1
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x58b178cc
xor eax, 0x3fbe847e
rol eax, 0xea
popf
pushf
not eax
add eax, 0x15ae970b
xor eax, 0x4b271f59
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x29a10a8d
xor eax, 0x652ce967
rol eax, 0xb2
popf
jmp 0x140051d1e
mov rcx, qword [rbp + 0x178]
lea r9d, [rdi + 1]
mov dword [rsp + 0x28], edi
lea rdx, [0x18d236f05]
pushf
sub rdx, 0x4d20f5f5
popf
xor r8d, r8d
mov qword [rsp + 0x20], rdi
jmp 0x140051fc5
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x178]
jmp 0x140051fd3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
push rax
pushf
mov eax, 0xffa02027
pushf
not eax
add eax, 0x6f2f8212
xor eax, 0x69b3c8c4
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x2257cd9a
xor eax, 0x4d542139
rol eax, 0x90
popf
pushf
not eax
add eax, 0x6dc7ee18
xor eax, 0x6d92ea9f
rol eax, 0x99
popf
pushf
not eax
add eax, 0x8ccaaea
xor eax, 0x390074d2
rol eax, 0x29
popf
jmp 0x140051d1e
lea rdx, [0x1969ae8ab]
pushf
sub rdx, 0x56986fd3
popf
lea rcx, [rsp + 0x50]
call fcn.140041acc
lea rdx, [0x19de0e1f0]
pushf
sub rdx, 0x5dde68c0
popf
lea rcx, [rsp + 0x50]
call fcn.1400415c6
lea rdx, [0x1b838d310]
pushf
sub rdx, 0x78365d50
popf
lea rcx, [rsp + 0x50]
call fcn.1400415c6
lea rdx, [0x1aaf831e4]
pushf
sub rdx, 0x6af5b89c
popf
lea rcx, [rsp + 0x50]
call fcn.1400415c6
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x178]
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], edi
jmp 0x1400520d7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14005213a
push rax
pushf
mov eax, 0xb8658c1e
pushf
not eax
add eax, 0x48730af7
xor eax, 0x2e4cd5f
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x174a15fb
xor eax, 0x59720790
rol eax, 0x97
popf
pushf
not eax
add eax, 0x2e370dce
xor eax, 0x7c1320ea
rol eax, 0x80
popf
pushf
not eax
add eax, 0x2bd6580f
xor eax, 0x77e0b09b
rol eax, 0x34
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0x6dd57b94
pushf
not eax
add eax, 0x353a03ff
xor eax, 0x601e3ae7
rol eax, 0x13
popf
pushf
not eax
add eax, 0x63130ccc
xor eax, 0x521b79c8
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x7fbe576c
xor eax, 0x57ea9796
rol eax, 0xf6
popf
jmp 0x140051d1e
mov rax, rbx
test rbx, rbx
jne 0x1400521bb
push rax
pushf
mov eax, 0x6527544c
pushf
not eax
add eax, 0xa24cffe
xor eax, 0x3dbc1b19
rol eax, 0x58
popf
pushf
not eax
add eax, 0x2dac67d9
xor eax, 0x513267a
rol eax, 0xc1
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0x4993a199
pushf
not eax
add eax, 0x48ee23ce
xor eax, 0x4ee7011
rol eax, 0x99
popf
pushf
not eax
add eax, 0x1c1a75b
xor eax, 0xa7800ee
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x4e41ba9
xor eax, 0x9c3421d
rol eax, 0x11
popf
jmp 0x140051d1e
mov rax, rdi
jmp 0x1400523ca
cmp word [rbx], di
je 0x140052287
push rax
pushf
mov eax, 0xe5656b55
pushf
not eax
add eax, 0x2b60e5b5
xor eax, 0x3b13f71e
rol eax, 0xff
popf
pushf
not eax
add eax, 0x2a87f15b
xor eax, 0x6b2baaba
rol eax, 0xcd
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0x76f61305
pushf
not eax
add eax, 0x104bfbcc
xor eax, 0x7eaf40c8
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x7b268c6a
xor eax, 0x4cbf5d6f
rol eax, 0x36
popf
pushf
not eax
add eax, 0x71c20cef
xor eax, 0x30e734dd
rol eax, 0x37
popf
jmp 0x140051d1e
add rax, 2
cmp word [rax], di
jne 0x14005231c
push rax
pushf
mov eax, 0x9e7c837d
pushf
not eax
add eax, 0x301c6978
xor eax, 0x7c1ec7be
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x1888f1a1
xor eax, 0x2febffc5
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x2a45e432
xor eax, 0x2f9c4a9d
rol eax, 0x47
popf
jmp 0x140051d1e
push rax
pushf
mov eax, 0xcdb76d0e
pushf
not eax
add eax, 0x3631091a
xor eax, 0x576aa10a
rol eax, 0x89
popf
pushf
not eax
add eax, 0x2ceb410b
xor eax, 0x3c258a6c
rol eax, 0x58
popf
pushf
not eax
add eax, 0x421a87d5
xor eax, 0x61e3b320
rol eax, 0x91
popf
jmp 0x140051d1e
push rbx
not rbx
add rax, rbx
pop rbx
add rax, 1
sar rax, 1
push rax
pushf
mov eax, 0x81172ecd
pushf
not eax
add eax, 0x2cff408e
xor eax, 0x1e616428
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x788fda
xor eax, 0x5bed4703
rol eax, 0x17
popf
pushf
not eax
add eax, 0x39041e0
xor eax, 0x222292dd
rol eax, 0x11
popf
pushf
not eax
add eax, 0x529fc68b
xor eax, 0x4a6666b7
rol eax, 0x32
popf
jmp 0x140051d1e
mov rcx, qword [rbp + 0x178]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x199cd293b]
pushf
sub rdx, 0x59cab1c3
popf
mov r9d, 0x61806912
pushf
not r9d
add r9d, 0x1906a88e
xor r9d, 0x6c49cc57
rol r9d, 0x8a
popf
pushf
not r9d
add r9d, 0x164a6a28
xor r9d, 0x865962c
rol r9d, 8
popf
pushf
not r9d
add r9d, 0x2c16b5dd
xor r9d, 0x13f622fe
rol r9d, 0x17
popf
mov qword [rsp + 0x20], rbx
xor r8d, r8d
jmp 0x140052448
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x178]
mov ebx, eax
jmp 0x140052458
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
push rbx
not ebx
add edi, ebx
pop rbx
add edi, 1
neg edi
sbb ebx, ebx
not ebx
xor ebx, 0xc000014d
and ebx, 0xc000014d
jmp 0x140052513
mov ebx, 0xb023e381
pushf
not ebx
add ebx, 0x4a4b0a01
xor ebx, 0x785a98cb
rol ebx, 0xf0
popf
pushf
not ebx
add ebx, 0x2e8554e6
xor ebx, 0x6ff9ca68
rol ebx, 0xb3
popf
push rax
pushf
mov eax, 0xd14cc3bb
pushf
not eax
add eax, 0xb381303
xor eax, 0x6aea980d
rol eax, 0x89
popf
pushf
not eax
add eax, 0x16d78d22
xor eax, 0x528f87b
rol eax, 7
popf
jmp 0x140051d1e
mov rcx, qword [rbp + 0x180]
jmp 0x14005251b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
push rax
pushf
mov eax, 0x803d4393
pushf
not eax
add eax, 0xf17b795
xor eax, 0x35af2840
rol eax, 0x49
popf
pushf
not eax
add eax, 0x610fd833
xor eax, 0x28f5da8f
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x2dc7464c
xor eax, 0x1160891e
rol eax, 0x9f
popf
jmp 0x140051d1e
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret