Function at 0x180016d70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13, rcx
and dword [rbp + 0x6f], 0
lea rcx, [0x18003d858]
mov rax, qword [0x18003d858]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x7f], rbx
lea rdx, str.LastUserId
lea rcx, [rbp - 9]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.1800153cc
nop
mov esi, 0x104
mov dword [rbp + 0x77], esi
lea rcx, [rbp - 1]
call fcn.180015d0c
mov rdi, rax
mov r8d, 1
sub r8d, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, esi
or ecx, r8d
jge 0x180016e05
mov edx, esi
lea rcx, [rbp + 0x7f]
call fcn.1800026b0
mov rbx, qword [rbp + 0x7f]
lea r9, [rbp + 0x77]
mov r8, rbx
mov rdx, qword [rbp - 0x51]
mov rcx, rdi
call fcn.180012a6c
nop
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x180016e28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.180019134
test eax, eax
js 0x180017159
cmp eax, dword [rbx - 0xc]
jg 0x180017159
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
cmp dword [rbx - 0x10], 0
je 0x180016eaa
lea rcx, [rbx - 0x18]
call fcn.180003060
add rax, 0x18
mov qword [r13], rax
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180016e87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rbx - 8], eax
add eax, edi
test eax, eax
jg 0x180016ea2
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r13
jmp 0x180017164
call fcn.180017d10
test al, al
je 0x180017016
call fcn.180017d24
mov esi, eax
or edi, 0xffffffff
cmp eax, 2
jne 0x180016fd3
lea rcx, [rbp - 0x59]
call fcn.1800160f0
nop
mov rcx, qword [rbp - 0x59]
cmp dword [rcx - 0x10], 0
jle 0x180016fad
lea edx, [rsi + 0x2c]
call fcn.18001b1d4
test rax, rax
je 0x180016fa9
mov rcx, qword [rbp - 0x59]
sub eax, ecx
test eax, eax
jle 0x180016fad
mov r8d, eax
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x59]
call fcn.180012f18
mov rcx, qword [rax]
call fcn.18001b3f4
mov ebx, eax
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x180016f3a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
cmp ebx, 8
jl 0x180016fa9
lea rdx, [0x18002f554]
lea rcx, [rbp - 0x11]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1800166cc
nop
mov rax, qword [rbp - 0x49]
cmp dword [rax - 0x10], 0
je 0x180016f8f
lea rdx, [0x18002efd8]
mov rcx, rax
call fcn.18001a458
test eax, eax
setne al
test al, al
je 0x180016f8b
lea rdx, [rbp - 0x49]
lea rcx, [rbp + 0x7f]
call fcn.18000bdf0
mov rax, qword [rbp - 0x49]
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180016fa9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x59]
lea rdx, [rcx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180016fcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x7f]
jmp 0x180016fd3
mov rbx, qword [rbp + 0x7f]
jmp 0x180016fdc
cmp esi, 3
je 0x180017065
cmp dword [rbx - 0x10], 0
jne 0x18001706b
lea rdx, [0x18002f554]
lea rcx, [rbp - 0x21]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.180016378
nop
mov rdx, rax
lea rcx, [rbp + 0x7f]
call fcn.18000bdf0
nop
mov rdx, qword [rbp - 0x39]
jmp 0x180017047
lea rdx, [0x18002f554]
lea rcx, [rbp - 0x19]
call fcn.180003f80
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.180016378
nop
mov rdx, rax
lea rcx, [rbp + 0x7f]
call fcn.18000bdf0
nop
mov rdx, qword [rbp - 0x31]
or edi, 0xffffffff
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180017061
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x7f]
cmp dword [rbx - 0x10], 0
je 0x180017083
lea rdx, [0x18002efd8]
mov rcx, rbx
call fcn.18001a458
test eax, eax
sete al
test al, al
je 0x1800170d0
and dword [rbp + 0x6f], 0
lea rcx, [rbp + 0x6f]
call fcn.18001bfe4
mov r8d, dword [rbp + 0x6f]
mov eax, 0x12e0be83
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1c
imul ecx, ecx, 0x1dcd6500
mov eax, 0x1dcd6500
sub eax, ecx
add r8d, eax
mov dword [rbp + 0x6f], r8d
lea rdx, [0x18002f550]
lea rcx, [rbp + 0x7f]
call fcn.180013308
mov rbx, qword [rbp + 0x7f]
lea rcx, [rbp + 0x17]
call fcn.180015d0c
mov rsi, rax
mov r12, qword [rbp - 0x51]
xor ecx, ecx
test rbx, rbx
setne cl
test ecx, ecx
je 0x180017115
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x180017124
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbx - 0x18]
call fcn.180003060
add rax, 0x18
mov qword [r13], rax
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x180017154
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x180016e87
mov ecx, 0x80070057
call fcn.1800010d0
nop
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret