Function at 0x180067a40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x18007cd08]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, qword [rsp + 0x58]
lea r12d, [rdx - 0x12]
xor ebx, ebx
mov qword [rsp + 0x50], r8
mov qword [rbp - 0x69], rcx
mov rdi, r9
mov r15d, edx
mov r14, rcx
lea r9d, [rbx + 0x65]
cmp edx, r12d
jbe 0x180067f5b
mov rax, qword [rsp + 0x58]
lea r14d, [rdx - 0x86]
mov r13d, dword [rsp + 0x50]
lea rdx, [0x180000000]
mov qword [rsp + 0x40], rax
lea r9d, [rbx + 0x77]
lea r10d, [rbx + 0x74]
lea r11d, [rbx + 0x54]
nop dword [rax]
cmp r14d, 0x3b
ja case.0x180067add.18
movzx eax, byte [rdx + r14 + 0x68428]
mov ecx, dword [rdx + rax*4 + 0x683dc]
add rcx, rdx
jmp rcx
mov eax, r13d
lea rdx, [rsp + 0x48]
add rax, rdi
mov dword [rsp + 0x28], 0xb1
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call fcn.180069980
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov r8, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov r9d, 0x77
lea r10d, [r9 - 3]
lea r11d, [r9 - 0x23]
jmp case.0x180067add.18
mov r9d, 0xce
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0xc], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0xe], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x10], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x12], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0x14], ax
jmp 0x180067b10
mov word [rbp + 9], r9w
jmp case.0x180067add.18
mov dword [rbp - 7], 0x4f0069
mov dword [rbp - 3], 0x790072
mov dword [rbp + 1], 0x650032
jmp case.0x180067add.18
mov word [rbp - 0x51], 0x5448
mov byte [rbp - 0x4f], bl
jmp case.0x180067add.18
mov word [rbp - 0x19], r10w
jmp case.0x180067add.18
mov rax, qword [rbp - 0x69]
xorps xmm0, xmm0
xor ecx, ecx
lea rdx, [rax + 0x1f8]
movups xmmword [rdx], xmm0
mov qword [rsp + 0x40], rdx
movups xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], ecx
mov r13d, dword [rax + 0x94]
test r13d, r13d
je 0x180067f19
lea ecx, [r13 + 0x24]
cmp rcx, qword [r8]
ja 0x180067f0c
lea rdx, [0x180000000]
jmp case.0x180067add.18
mov eax, 0x41
mov dword [rbp - 0x15], 0x45004e
mov word [rbp - 0x17], ax
jmp case.0x180067add.18
mov eax, 0x65
mov dword [rbp - 0x11], 0x670030
mov word [rbp - 0xd], ax
mov dword [rbp - 0xb], 0x53005a
jmp case.0x180067add.18
mov r8d, 4
lea rdx, [0x180074136]
lea rcx, [rbp - 0x4f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x312e
mov byte [rbp - 0x49], bl
mov r8d, 3
mov word [rbp - 0x4b], ax
lea rdx, str.HostsAndVisitsForPeriod
lea rcx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180067b10
mov r9d, 0xce
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x1a], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x1c], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x1e], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0x20], ax
jmp 0x180067b10
mov rdx, qword [rbp - 0x69]
test rdx, rdx
je 0x180067f22
test rdi, rdi
je 0x180067f22
mov rsi, rdx
lea rdx, [0x180000000]
jmp case.0x180067add.18
mov dword [rbp + 5], 0x540041
jmp case.0x180067add.18
mov rdx, qword [rbp - 0x69]
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
lea rdx, [0x180000000]
jmp case.0x180067add.18
mov r9d, 0xce
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 0x16], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0x18], ax
jmp 0x180067b10
mov r9d, 0xce
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 4], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 6], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0xce
xor edx, edx
mov word [rcx + 8], ax
xor ecx, ecx
call fcn.18006e2f0
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0xa], ax
jmp 0x180067b10
mov dword [rbp + 0xb], 0x490035
mov dword [rbp + 0xf], 0x410076
mov word [rbp + 0x13], bx
dec r14d
lea eax, [r14 + 0x86]
cmp eax, r12d
ja 0x180067ac0
mov r14, qword [rbp - 0x69]
mov r9d, 0x65
mov rsi, qword [rsp + 0x40]
lea r13d, [r15 + 0x762]
cmp r15d, r13d
jae 0x1800683ae
movzx r12d, byte [rbp - 0x79]
mov eax, 0x2d
mov ecx, 0x6e6f
mov edx, 0x7463
lea r10d, [rax + 0x46]
lea r11d, [rax + 0x41]
lea r8d, [rax + 0x3a]
nop dword [rax]
cmp r15d, 0x3a0
ja 0x18006802d
je 0x18006800d
cmp r15d, 0x193
ja 0x180067fc4
je 0x180067f8f
mov eax, r15d
sub eax, 0x8b
je 0x180067f70
sub eax, 0x36
je 0x180067f65
sub eax, 0x33
je 0x1800683ae
cmp eax, 0x36
jne 0x180068381
lea r8d, [rax - 0x34]
mov byte [rbp - 0x5d], bl
lea rdx, [0x180074178]
lea rcx, [rbp - 0x5d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180068377
mov dword [rsp + 0x58], 0x70004
jmp 0x1800683ae
mov dword [rsp + 0x58], ebx
jmp 0x1800683ae
cmp rdx, rdi
je 0x180067f4a
mov eax, 1
jmp 0x1800683b3
mov rcx, rbx
movzx eax, byte [rsi]
cmp al, byte [rdi]
jne 0x180067f52
test al, al
je 0x180067f4a
inc rsi
inc rdi
inc rcx
jmp 0x180067f34
mov rax, rbx
jmp 0x1800683b3
lea rax, [rcx + 1]
jmp 0x1800683b3
mov qword [rsp + 0x40], rsi
jmp 0x180067e6d
mov word [rbp - 0x3e], 0x74
jmp 0x180068381
xor edx, edx
lea rcx, [rsp + 0x48]
mov r8d, 0x90
call fcn.180069710
mov word [rsi + 0x22], ax
mov dword [rsp + 0x58], ebx
jmp 0x180068377
lea rcx, [rbp - 0x5d]
dec rcx
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x180067f96
movzx eax, word [0x180074170]
mov word [rcx], ax
mov word [rbp - 0x5a], r10w
mov dword [rbp - 0x39], 0x6e6f43
mov word [rbp - 0x59], r9w
mov word [rbp - 0x36], r11w
jmp 0x18006837c
mov eax, r15d
sub eax, 0x1fc
je 0x180068003
sub eax, 0x69
je 0x180067ff7
sub eax, 0x69
je 0x180067fee
cmp eax, 0x69
mov eax, 0x2d
jne 0x180068386
mov byte [rbp - 0x2f], bl
jmp 0x180068386
mov word [rbp - 0x31], cx
jmp 0x180068381
mov dword [rbp - 0x34], 0x697463
jmp 0x180068381
mov word [rbp - 0x35], r9w
jmp 0x180068381
mov r9d, 0x41
mov word [rbp - 0x25], ax
mov word [rbp - 0x24], r9w
mov word [rbp - 0x23], r8w
mov dword [rbp - 0x29], 0x72657355
jmp 0x180068386
cmp r15d, 0x5ad
ja 0x180068293
je 0x180068242
mov eax, r15d
sub eax, 0x409
je 0x1800681cd
sub eax, 0x69
je 0x180068135
sub eax, 0x69
je 0x18006811a
cmp eax, 0x69
jne 0x180068381
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180068092
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18006808a
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800680a4
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.18003e9b0
mov dword [rbp - 0x75], ebx
lea rax, [rbp - 0x51]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], bl
jne 0x1800680b2
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1800680fe
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800680e2
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp - 0x51]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], bl
jmp 0x180068377
lea r9, [rbp - 0x51]
mov qword [rsp + 0x20], r14
mov rdx, r14
xor r8d, r8d
mov rcx, rdi
call fcn.18003eb10
jmp 0x180068377
cmp qword [r14 + 0x38], 0x10
lea rdx, [r14 + 0x20]
mov dword [rbp - 0x71], ebx
jb 0x18006812c
mov rdx, qword [r14 + 0x20]
mov r8, qword [r14 + 0x30]
jmp 0x18006836f
mov rcx, qword [rdi + 0x10]
mov r12b, 1
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180068161
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180068159
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x180068173
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.18003e9b0
cmp qword [r14 + 0x38], 0x10
lea rax, [r14 + 0x20]
jb 0x180068181
mov rax, qword [rax]
cmp byte [rax], 0x2f
je 0x180068377
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800681b6
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800681ab
mov rax, qword [rdi]
mov word [rax + rcx], 0x2f
jmp 0x180068377
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.18003e9b0
jmp 0x180068377
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
mov dword [rbp - 0x22], 0x746e65
cmp rax, 3
jb 0x18006821d
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800681fc
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 3
mov rcx, rsi
lea rdx, [0x180074174]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + 3], bl
jmp 0x180068377
lea r9, [0x180074174]
mov qword [rsp + 0x20], 3
mov edx, 3
xor r8d, r8d
mov rcx, rdi
call fcn.18003eb10
jmp 0x180068377
cmp qword [0x18007c8e8], 0x10
lea rdx, [0x18007c8d0]
mov r8, qword [0x18007c8e0]
mov rcx, rdi
cmovae rdx, qword [0x18007c8d0]
mov dword [rsp + 0x50], ebx
call fcn.18004fa00
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
mov dword [rbp - 0x61], ebx
jb 0x18006827c
mov rdx, qword [r14]
mov r9, rdi
lea rcx, [rbp - 0x41]
mov r8d, 0x2e
call fcn.18005b3f0
jmp 0x180068377
mov eax, r15d
sub eax, 0x616
je 0x1800682e0
sub eax, 0x69
je 0x1800682b0
cmp eax, 0x69
jne 0x180068381
jmp 0x180068351
test r12b, r12b
je 0x180068381
mov eax, dword [rbp - 0x75]
lea rcx, [rbp - 0x19]
mov r8d, dword [rbp - 0x71]
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
jmp 0x180068377
mov r9, rdi
lea rdx, [rbp - 0x5d]
mov r8d, 0x2e
lea rcx, [rbp - 0x39]
call fcn.18005b3f0
mov eax, dword [rbp - 0x61]
lea r8, [rbp - 0x71]
mov dword [rsp + 0x38], eax
lea rcx, [rbp - 0x19]
mov eax, dword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x75]
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHRegGetUSValueW
cmp qword [r14 + 0x58], 0x10
lea rdx, [r14 + 0x40]
mov esi, eax
jb 0x180068335
mov rdx, qword [rdx]
mov r9, rdi
lea rcx, [rbp - 0x29]
mov r8d, 0x2e
call fcn.18005b3f0
test esi, esi
movzx r12d, r12b
cmovne r12d, ebx
cmp qword [0x18007c8e8], 0x10
lea rdx, [0x18007c8d0]
mov r8, qword [0x18007c8e0]
cmovae rdx, qword [0x18007c8d0]
mov rcx, rdi
call fcn.18004fa00
mov edx, 0x7463
mov ecx, 0x6e6f
mov eax, 0x2d
mov r14, qword [rbp - 0x69]
mov r8d, 0x67
mov rsi, qword [rsp + 0x40]
add r15d, 0x69
lea r9d, [r8 - 2]
lea r10d, [r8 + 0xc]
lea r11d, [r8 + 7]
cmp r15d, r13d
jb 0x180067ea0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18006edc0
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret