Function at 0x18000be30
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x58]
sub rsp, 0x150
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
call fcn.18000d9a0
movdqa xmm0, xmmword [0x180040ba0]
test al, al
je 0x18000c002
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], 0
mov qword [rsp + 0x58], 0xffffffff80000001
mov dword [rsp + 0x50], 1
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x68], xmm0
xor edi, edi
mov word [rbp - 0x78], di
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
lea r8d, [rdi + 2]
lea rdx, [0x180040578]
lea rcx, [rsp + 0x68]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], di
lea r8d, [rdi + 0x18]
lea rdx, str.SOFTWAREMicrosoftkantu
lea rcx, [rbp - 0x58]
call fcn.180003d10
nop
mov dword [rsp + 0x28], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.180010720
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000bf5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c74c
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], di
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x18000bfaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bfaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c752
call fcn.180017cb8
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.180002770
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x18000bffd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bff7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c758
call fcn.180017cb8
nop
jmp 0x18000c718
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov qword [rsp + 0x58], 0xffffffff80000001
mov dword [rsp + 0x50], 1
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 8], xmm0
xor edi, edi
mov word [rbp - 0x18], di
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
lea r8d, [rdi + 2]
lea rdx, [0x180040578]
lea rcx, [rsp + 0x68]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], di
lea r8d, [rdi + 0x18]
lea rdx, str.SOFTWAREMicrosoftkantu
lea rcx, [rbp - 0x78]
call fcn.180003d10
nop
mov dword [rsp + 0x28], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call fcn.180010720
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x18000c0e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c0db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c75e
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], di
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x18000c132
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c12d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c764
call fcn.180017cb8
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 8]
call fcn.180002770
lea rcx, [rbp - 0x58]
cmp rcx, rax
je 0x18000c166
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x18000c1a1
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c19c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c76a
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 5
lea rdx, str.kantu
lea rcx, [rsp + 0x68]
call fcn.1800022e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.1800031d0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18000c21b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c770
call fcn.180017cb8
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x18000c31b
lea rax, [rbp - 0x38]
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x20]
cmp r9, 0x10
cmovae rax, r8
nop dword [rax]
lea rcx, [rbp - 0x38]
cmp r9, 0x10
cmovae rcx, r8
add rcx, rdx
cmp rax, rcx
je 0x18000c268
movzx ecx, byte [rax]
sub cl, 0x30
cmp cl, 9
ja 0x18000c31b
inc rax
jmp 0x18000c240
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x18000c2c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c2c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c776
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], di
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18000c718
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c713
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c746
jmp 0x18000c713
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 5
lea rdx, str.kantu
lea rcx, [rbp - 0x78]
call fcn.1800022e0
nop
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 5
lea rdx, str.86688
lea rcx, [rsp + 0x68]
call fcn.1800022e0
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x28]
call fcn.180003070
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18000c3be
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c3b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c77c
call fcn.180017cb8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x18000c3f9
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c3f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c782
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
mov r8d, 2
lea rdx, [0x180040578]
lea rcx, [rsp + 0x68]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], di
mov r8d, 0x18
lea rdx, str.SOFTWAREMicrosoftkantu
lea rcx, [rbp - 0x78]
call fcn.180003d10
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.1800028e0
mov rsi, rax
mov qword [rsp + 0x50], rdi
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2011b
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000c4f1
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x18000c4b2
mov rsi, qword [rsi]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x18000c531
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c52c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c788
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], di
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x18000c582
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c57d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c78e
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], di
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x18000c5d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c5cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c794
call fcn.180017cb8
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov r8d, 5
lea rdx, str.86688
mov rcx, rbx
call fcn.1800022e0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x18000c634
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c62f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c79a
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x18000c680
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c67b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c7a0
call fcn.180017cb8
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x18000c6d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c6cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c7a6
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], di
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18000c718
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c713
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c740
call fcn.180017cb8
mov rax, rbx
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.180017e50
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18001c32c
int3
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
int3
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
int3