Function at 0x1800106a0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov r13, r8
mov rsi, rdx
mov r12, rcx
xor r15d, r15d
mov qword [r11 - 0x60], r15
mov dword [r11 - 0x58], r15d
mov rax, qword [rdx]
or ebx, 0xffffffff
cmp dword [rax - 0x10], r15d
je 0x18001072a
mov r8, rdx
lea rdx, [0x180024a78]
lea rcx, [r11 - 0x80]
call fcn.18000ef10
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800028e0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001072a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x68]
call fcn.1800101a0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18000ee60
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1800107a4
mov edi, r15d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], r15d
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800107c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800107e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x180010844
mov rbp, qword [r13]
mov r14, qword [r12]
mov eax, r15d
test rbp, rbp
setne al
mov rdi, qword [rsp + 0x78]
test eax, eax
je 0x18001082c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x180010849
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov qword [rsp + 0x78], r15
jmp 0x180010849
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x180010858
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180010877
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180010895
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1800108b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret