Function at 0x18011df20
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11a8
call fcn.1802b8650
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rbp
mov qword [rbp + 0x1160], rax
mov rsi, r8
mov qword [rbp + 0x10], r8
mov r13, rdx
mov qword [rbp + 0x30], rdx
mov r14, rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], r9
xor r15d, r15d
mov word [rbp], r15w
lea rdx, [rbp + 0x160]
call fcn.180120b00
test eax, eax
js 0x18011e478
lea rdx, [rbp]
lea rcx, [rbp + 0x160]
call fcn.180123d00
test eax, eax
jne 0x18011dfb3
mov eax, 0x80020009
jmp 0x18011e478
movabs rbx, 0x100002600
nop dword [rax]
mov rcx, qword [r14]
movzx eax, byte [rcx]
cmp al, 0x20
ja 0x18011dfdb
bt rbx, rax
jae 0x18011dfdb
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18011dfc0
lea rdx, [rbp + 0x160]
mov rcx, r14
call fcn.180120b00
test eax, eax
js 0x18011e478
movzx eax, word [rbp]
cmp eax, 8
je 0x18011e418
cmp eax, 0x11
je 0x18011e2be
cmp eax, 0x13
je 0x18011e139
cmp eax, 0x4008
jne 0x18011e463
lea rdx, [rbp + 0x160]
or rcx, 0xffffffffffffffff
mov rax, rcx
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], r15b
jne 0x18011e030
add eax, 2
mov qword [rbp + 0x50], r15
movsxd r8, eax
test eax, eax
je 0x18011e076
xor edx, edx
mov rax, rcx
div r8
cmp rax, 1
jae 0x18011e05f
mov ecx, 0x80070216
call fcn.18011e9e0
cmp r8, 0x100
jbe 0x18011e076
mov rdx, r8
lea rcx, [rbp + 0x50]
call fcn.18011e4a0
jmp 0x18011e07e
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
jmp 0x18011e08f
mov rdi, qword [rbp + 0x50]
test rdi, rdi
je 0x18011e118
lea rbx, [rbp + 0x160]
cmp byte [rbp + 0x160], 0
je 0x18011e100
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
movzx ecx, byte [rbx]
cmp cl, 0x5c
jne 0x18011e0d7
cmp byte [rax], 0x30
jne 0x18011e0d7
mov byte [rdi], 0
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
jmp 0x18011e0f8
mov byte [rdi], cl
movzx ecx, byte [rbx]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x18011e0f5
inc rdi
inc rbx
movzx eax, byte [rbx]
test al, al
je 0x18011e100
mov byte [rdi], al
inc rbx
inc rdi
cmp byte [rbx], 0
jne 0x18011e0b0
mov word [rdi], 0
mov r8, qword [rbp + 0x50]
mov rdx, rsi
mov rcx, r13
call fcn.180122f40
mov edi, eax
jmp 0x18011e11d
mov edi, recv
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x18011e456
lea rcx, [rbp + 0x50]
call fcn.18011f670
jmp 0x18011e456
mov rbx, r15
mov qword [rbp + 8], rbx
lea rax, [rbp + 0x160]
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x18011e150
inc ecx
movsxd rsi, ecx
add rsi, rsi
mov eax, 0x80000000
add rax, rsi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18011e294
cmp esi, 0x400
jg 0x18011e1b4
movsxd rdi, esi
mov rcx, rdi
call fcn.180123e40
test al, al
je 0x18011e1b4
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x18011e1a1
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1802b8650
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x18011e1e8
movsxd rdi, esi
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x18011e289
lea rcx, [rdi + 0x10]
call fcn.1802d7b48
test rax, rax
jne 0x18011e1da
mov rcx, r15
jmp 0x18011e1e8
mov qword [rax], r15
mov rbx, rax
mov qword [rbp + 8], rax
lea rcx, [rax + 0x10]
shr rdi, 1
mov r9d, 3
mov r8d, edi
lea rdx, [rbp + 0x160]
call fcn.18011e5a0
test rax, rax
je 0x18011e294
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov edi, eax
test eax, eax
jns 0x18011e24b
test rbx, rbx
je 0x18011e244
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.1802d0c88
test rbx, rbx
jne 0x18011e230
mov eax, edi
jmp 0x18011e478
mov r8d, dword [rbp]
mov rdx, qword [rbp + 0x10]
mov rcx, r13
call fcn.180122f00
mov edi, eax
test rbx, rbx
je 0x18011e456
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.1802d0c88
test rbx, rbx
jne 0x18011e270
jmp 0x18011e456
mov ecx, 0x80070216
call fcn.18011e9e0
nop
test rbx, rbx
je 0x18011e2b4
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.1802d0c88
test rbx, rbx
jne 0x18011e2a0
mov eax, 0x8007000e
jmp 0x18011e478
lea rax, [rbp + 0x160]
or rcx, 0xffffffffffffffff
mov rbx, rcx
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x18011e2d0
mov dword [rbp], ebx
test bl, 1
jne 0x18011e376
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
mov dword [rbp + 8], r12d
mov qword [rbp + 0x50], r15
mov r8, r12
test eax, eax
jne 0x18011e303
mov r8, r15
jmp 0x18011e31b
xor edx, edx
mov rax, rcx
div r8
cmp rax, 1
jae 0x18011e31b
mov ecx, 0x80070216
call fcn.18011e9e0
cmp r8, 0x100
jbe 0x18011e332
mov rdx, r8
lea rcx, [rbp + 0x50]
call fcn.18011e4a0
jmp 0x18011e33a
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
jmp 0x18011e35a
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x18011e380
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x18011e376
lea rcx, [rbp + 0x50]
call fcn.18011f670
mov eax, 0x80004005
jmp 0x18011e478
movsxd r8, r12d
xor edx, edx
call fcn.1802c7550
mov edi, r15d
movsxd r13, ebx
mov rsi, r15
test ebx, ebx
jle 0x18011e3d9
mov eax, edi
test edi, edi
jns 0x18011e3a0
lea eax, [rdi + 1]
sar eax, 1
movsxd rbx, eax
add rbx, qword [rbp + 0x50]
movzx ecx, byte [rbp + rsi + 0x160]
call fcn.18011ea70
movzx edx, al
mov ecx, edi
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
movzx ecx, al
shl dl, cl
or byte [rbx], dl
inc edi
inc rsi
cmp rsi, r13
jl 0x18011e397
mov dword [rsp + 0x28], r12d
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x18011e456
lea rcx, [rbp + 0x50]
call fcn.18011f670
jmp 0x18011e456
lea rax, [rbp + 0x160]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r15b
jne 0x18011e423
inc ecx
mov dword [rsp + 0x28], ecx
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x18011e463
mov ecx, edi
call fcn.18011e800
jmp 0x18011e478
mov rdx, qword [rbp + 0x38]
mov rcx, r14
call fcn.180120b00
test eax, eax
cmovs r15d, eax
mov eax, r15d
mov rcx, qword [rbp + 0x1160]
xor rcx, rbp
call fcn.1802b85a0
lea rsp, [rbp + 0x1178]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret