Function at 0x180003b10
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r13d, r8d
mov r12, rdx
mov rbx, rcx
xor r14b, r14b
mov byte [rsp + 0x80], r14b
cmp qword [rcx + 0x78], 8
jb 0x180003b52
mov rbp, qword [rcx + 0x60]
jmp 0x180003b56
lea rbp, [rcx + 0x60]
lea rcx, [0x18002f9d0]
mov rax, qword [0x18002f9d0]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
or rsi, 0xffffffffffffffff
test rbp, rbp
je 0x180003bb8
test rbp, 0xffffffffffff0000
jne 0x180003ba5
movzx edi, bp
xor edx, edx
mov ecx, edi
call fcn.1800010c0
test rax, rax
je 0x180003bcb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180002540
jmp 0x180003bcb
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x180003bba
xor ecx, ecx
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1800020b0
nop
mov rdx, qword [rbx + 0x20]
test rdx, rdx
jne 0x180003bd8
xor ecx, ecx
jmp 0x180003be9
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.180002440
mov r9d, r13d
mov rdi, qword [rsp + 0x30]
mov r8, rdi
mov rdx, 0xffffffff80000003
mov rcx, rbx
call fcn.180001180
mov r15, rax
test rax, rax
je 0x180003d94
mov r9d, r13d
mov r8, qword [rbx + 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.180001180
mov r14, rax
test rax, rax
je 0x180003d82
cmp qword [r12 + 0x20], 8
jb 0x180003c49
mov r8, qword [r12 + 8]
jmp 0x180003c4e
lea r8, [r12 + 8]
mov r9d, r13d
mov rdx, rax
mov rcx, rbx
call fcn.180001180
mov rbp, rax
test rax, rax
je 0x180003d79
mov r9d, r13d
mov r8, qword [rbx + 0x40]
mov rdx, rax
mov rcx, rbx
call fcn.180001180
mov rbx, rax
test rax, rax
je 0x180003d70
mov dword [rsp + 0x98], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Blocked
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Count
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x98], 0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x98], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x80], 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx r14d, byte [rsp + 0x80]
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180003db1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, r14b
jmp 0x180003db4
mov al, r14b
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret