Function at 0x180005980
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rdx
mov edi, ecx
mov qword [rsp + 0x78], rdx
mov dword [rbp - 0x80], r8d
xor esi, esi
mov dword [rsp + 0x50], esi
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x50]
call fcn.180001c90
nop
lea rdx, [0x1800085d4]
lea rcx, [rbp - 0x40]
call fcn.180002300
mov rcx, rax
lea rdx, str.twar
call fcn.180002300
mov rcx, rax
lea rdx, str.eMic
call fcn.180002300
mov rcx, rax
lea rdx, str.roso
call fcn.180002300
mov rcx, rax
lea rdx, str.ftWi
call fcn.180002300
mov rcx, rax
lea rdx, str.ndow
call fcn.180002300
mov rcx, rax
lea rdx, str.sCu
call fcn.180002300
mov rcx, rax
lea rdx, [0x18000860c]
call fcn.180002300
mov rcx, rax
lea rdx, str.ntVe
call fcn.180002300
mov rcx, rax
lea rdx, str.rsio
call fcn.180002300
mov rcx, rax
lea rdx, str.nPol
call fcn.180002300
mov rcx, rax
lea rdx, [0x1800085f0]
call fcn.180002300
mov rcx, rax
lea rdx, [0x1800085ec]
call fcn.180002300
cmp edi, 1
jne 0x180005ac8
lea rdx, [0x180008620]
lea rcx, [rbp - 0x40]
call fcn.180002300
mov rcx, rax
lea rdx, [0x18000861c]
call fcn.180002300
lea rdx, [0x180008618]
jmp 0x180005af3
cmp edi, 2
jne 0x180005afc
lea rdx, [0x18000862c]
lea rcx, [rbp - 0x40]
call fcn.180002300
mov rcx, rax
lea rdx, [0x180008628]
call fcn.180002300
lea rdx, [0x180008624]
mov rcx, rax
call fcn.180002300
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x180008b00]
movdqu xmmword [rbp - 0x68], xmm1
mov byte [rbp - 0x78], 0
mov dword [rsp + 0x50], 2
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [rbp + 0x38]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x180005b4e
mov rax, qword [rbp + 8]
mov r8, qword [rax]
test r8, r8
je 0x180005b4e
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x30]
cmovb r8, qword [rbp + 0x30]
sub r8, rdx
jmp 0x180005b7f
test cl, 4
jne 0x180005b75
mov rax, qword [rbp]
mov rcx, qword [rax]
test rcx, rcx
je 0x180005b75
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x18]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x180005b7f
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180005b8e
lea rcx, [rbp - 0x78]
call fcn.1800021a0
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180005be0
mov rdx, qword [rbx]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x180005c43
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005c3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800028ac
movdqa xmm0, xmmword [0x180008b00]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x54], edx
lea rcx, [rbp - 0x38]
call fcn.180001bd0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180005cce
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180005cc9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180005cff
mov rcx, r8
call fcn.1800028ac
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180002850
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3