Function at 0x1800034f0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2190
call fcn.180038bd0
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rsp + 0x2180], rax
mov r13, r8
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x60], r9
lea rdx, [rsp + 0x180]
call fcn.180003338
xor ebx, ebx
test eax, eax
js 0x1800039ac
lea rdx, str.SMDB
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180003576
lea edi, [rbx + 8]
jmp 0x1800035d4
lea rdx, [0x180073df8]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180003596
mov edi, 0x4008
jmp 0x1800035d4
lea rdx, [0x180073dfc]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800035b4
lea edi, [rax + 0x13]
jmp 0x1800035d4
lea rdx, [0x180073e00]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800039a7
lea edi, [rax + 0x11]
mov esi, 0xd
mov rcx, qword [r15]
cmp word [rcx], 9
jb 0x1800035fe
cmp word [rcx], 0xa
jbe 0x1800035f3
cmp word [rcx], si
je 0x1800035f3
cmp word [rcx], 0x20
jne 0x1800035fe
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r15], rax
jmp 0x1800035d9
lea rdx, [rsp + 0x180]
mov rcx, r15
call fcn.180003338
test eax, eax
js 0x1800039ac
cmp edi, 8
je 0x180003947
cmp edi, 0x11
je 0x1800037ca
cmp edi, 0x13
je 0x18000376d
cmp edi, 0x4008
jne 0x180003991
lea rcx, [rsp + 0x180]
call fcn.180042f9c
add eax, 2
mov qword [rsp + 0x70], rbx
movsxd rcx, eax
test eax, eax
je 0x180003685
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800039cf
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x180003685
lea rcx, [rsp + 0x70]
call fcn.1800060ac
jmp 0x18000368f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1800036a5
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x180003749
lea r14, [rsp + 0x180]
cmp word [rsp + 0x180], bx
je 0x180003700
mov rcx, r14
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [r14]
cmp cx, 0x5c
jne 0x1800036ef
cmp word [rax], 0x30
jne 0x1800036ef
mov word [rdi], bx
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r14, rax
jmp 0x1800036f6
mov word [rdi], cx
add r14, 2
add rdi, 2
cmp word [r14], bx
jne 0x1800036c5
and dword [rdi], 0
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x18000374e
mov esi, ebx
mov r14, rdi
mov rcx, r14
call fcn.180042f9c
inc eax
lea r14, [r14 + rax*2]
lea esi, [rsi + rax*2]
cmp eax, 1
jne 0x180003712
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x18000374e
mov esi, 0xe
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180003984
lea rcx, [rsp + 0x70]
call fcn.1800060a4
jmp 0x180003984
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x180]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
jns 0x180003793
jmp 0x1800039ac
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x180003984
lea rcx, [rsp + 0x180]
call fcn.180042f9c
mov rdi, rax
mov dword [rsp + 0x38], eax
test al, 1
je 0x1800037ec
mov eax, 0x80004005
jmp 0x1800039ac
cdq
sub eax, edx
sar eax, 1
movsxd rsi, eax
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x70], rbx
mov rcx, rsi
test eax, eax
jne 0x180003809
mov rcx, rbx
jmp 0x18000381c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x1800039da
cmp rcx, 0x100
jbe 0x180003834
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.1800060ac
jmp 0x18000383e
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180003859
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x180003882
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1800037e2
lea rcx, [rsp + 0x70]
call fcn.1800060a4
jmp 0x1800037e2
movsxd r8, esi
xor edx, edx
call fcn.180039b90
mov r9d, ebx
movsxd r11, edi
test edi, edi
jle 0x180003909
mov r8, rbx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
movsxd r10, eax
add r10, qword [rsp + 0x70]
movzx edx, word [rsp + r8*2 + 0x180]
cmp dx, 0x30
jb 0x1800038e5
cmp dx, 0x39
jbe 0x1800038e0
cmp dx, 0x40
jbe 0x1800038e5
cmp dx, 0x46
jbe 0x1800038db
cmp dx, 0x60
jbe 0x1800038e5
cmp dx, 0x66
ja 0x1800038e5
sub dl, 0x57
jmp 0x1800038e7
sub dl, 0x37
jmp 0x1800038e7
sub dl, 0x30
jmp 0x1800038e7
mov dl, bl
mov ecx, r9d
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
mov cl, al
shl dl, cl
or byte [r10], dl
inc r9d
inc r8
cmp r8, r11
jl 0x180003899
mov dword [rsp + 0x28], esi
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180003984
lea rcx, [rsp + 0x70]
call fcn.1800060a4
jmp 0x180003984
lea rcx, [rsp + 0x180]
call fcn.180042f9c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x180003991
mov ecx, esi
call fcn.180002418
jmp 0x1800039ac
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call fcn.180003338
test eax, eax
cmovs ebx, eax
mov eax, ebx
jmp 0x1800039ac
mov eax, 0x80020009
mov rcx, qword [rsp + 0x2180]
xor rcx, rsp
call fcn.180037bd0
add rsp, 0x2190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.1800023d4
nop
mov ecx, 0x80070216
call fcn.1800023d4
int3