Function at 0x180001ed4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
and dword [rsp + 0x50], 0
lea rdx, [0x180000000]
lea rcx, [r11 - 0x38]
mov rax, qword [rdx + 0x63f8]
or r12, 0xffffffffffffffff
lea rdi, [r11 - 0x44]
mov qword [rcx], rax
mov al, byte [rdx + 0x6400]
xor r8d, r8d
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x6408]
lea rcx, [r11 - 0x28]
mov qword [rcx], rax
movzx eax, word [rdx + 0x6410]
mov r9b, 7
mov word [rcx + 8], ax
mov eax, dword [rdx + 0x6414]
lea rcx, [r11 - 0x44]
mov dword [rcx], eax
movzx eax, word [rdx + 0x6418]
mov word [rcx + 4], ax
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
lea esi, [rax + 1]
not rcx
sub rcx, rsi
test ecx, ecx
jle 0x180001f97
lea rdx, [r11 - 0x44]
add byte [rdx], r9b
xor eax, eax
lea rdi, [rsp + 0x64]
mov rcx, r12
add r8d, esi
add rdx, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
cmp r8d, ecx
jl 0x180001f77
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, r12
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
sub rcx, rsi
test ecx, ecx
jle 0x180001fde
lea rdx, [rsp + 0x80]
add byte [rdx], r9b
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, r12
add r8d, esi
add rdx, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
cmp r8d, ecx
jl 0x180001fbb
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r12
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
sub rcx, rsi
test ecx, ecx
jle 0x18000201c
lea rdx, [rsp + 0x70]
add byte [rdx], r9b
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r12
add r8d, esi
add rdx, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
cmp r8d, ecx
jl 0x180001ffc
lea rax, [rsp + 0x64]
lea rdi, [0x180007b00]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_s
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov rbx, 0xffffffff80000002
mov r9d, 0xf003f
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800024e2
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov rdx, rdi
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, rbx
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800024ce
and dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
lea ebx, [rax + 4]
lea rax, [rsp + 0x50]
lea rdx, [0x18000729c]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072a0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072a4]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072a8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072ac]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072b0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x180007c98]
mov rdi, rdx
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
mov r9d, esi
xor r8d, r8d
not rcx
sub rcx, rsi
add ecx, esi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x1800072b4]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072b8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072bc]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072c0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072c4]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072c8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x180007ca8]
xor eax, eax
mov rcx, r12
mov rdi, rdx
mov r9d, esi
xor r8d, r8d
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
add ecx, esi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x1800072cc]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072d0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072d4]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072d8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072dc]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072e0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov rcx, r12
lea rdx, [0x180007cb8]
mov r9d, esi
xor r8d, r8d
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
add ecx, esi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x1800072e4]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1800072e8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x180007ab0]
xor eax, eax
mov rcx, r12
mov rdi, rdx
mov r9d, esi
xor r8d, r8d
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
add ecx, esi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x1800072ec]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180007ae4]
lea rdx, [0x1800072f0]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180007ae8]
lea rdx, [0x1800072f4]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180007aec]
lea rdx, [0x1800072f8]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180007af0]
lea rdx, [0x1800072fc]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800024de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1800024f4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800024f2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800047b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret