Function at 0x180009590
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov qword [rsp + 0xd0], 0xfffffffffffffffe
lea rcx, [0x18002f9d0]
mov rax, qword [0x18002f9d0]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
lea rdx, str.FEFE89E5_A43F_4f4b_8211_B11D91D02135
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x180009606
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.1800010c0
test rax, rax
je 0x180009627
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180002540
mov rdi, qword [rsp + 0x40]
jmp 0x180009627
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1800020b0
mov rdi, qword [rsp + 0x40]
xor ecx, ecx
mov r13, rcx
mov r12, rcx
mov r15, rcx
mov rsi, rcx
mov qword [rsp + 0x90], rcx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x130], cl
xor r14b, r14b
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2021f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExt
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009772
mov r13, qword [rsp + 0x78]
test r13, r13
je 0x180009772
mov qword [rsp + 0xa0], rbp
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.Stats
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009772
mov r15, qword [rsp + 0xa0]
test r15, r15
je 0x180009772
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009772
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180009772
mov qword [rsp + 0x98], rbp
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.iexplore
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009772
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x30], rcx
mov eax, dword [rsp + 0x130]
movzx eax, al
test rcx, rcx
mov ecx, 1
cmovne eax, ecx
mov dword [rsp + 0x130], eax
mov qword [rsp + 0x88], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExt
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009897
mov r12, qword [rsp + 0x88]
test r12, r12
je 0x18000989e
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.Stats
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009890
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1800098a5
mov qword [rsp + 0x70], rbp
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009889
mov rbp, qword [rsp + 0x70]
test rbp, rbp
je 0x1800098ac
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.iexplore
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180009882
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
movzx r14d, r14b
test rax, rax
mov ecx, 1
cmovne r14d, ecx
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
jmp 0x1800098b1
mov ecx, 1
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0xac], 0xffffffff
mov dword [rsp + 0xb0], 0xffffffff
mov dword [rsp + 0xb4], 0xffffffff
mov dword [rsp + 0xb8], 0xffffffff
mov dword [rsp + 0xbc], 0xffffffff
mov dword [rsp + 0xc0], 0xffffffff
mov dword [rsp + 0xc4], 0xffffffff
xor eax, eax
mov qword [rsp + 0xc8], rax
cmp byte [rsp + 0x130], al
je 0x180009a68
mov dword [rsp + 0x130], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Blocked
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
mov dword [rsp + 0x138], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 3]
xor r8d, r8d
lea rdx, str.Count
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 1
mov dword [rsp + 0x140], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x148], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x28
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.NavTimeArray
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x28
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.LoadTimeArray
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r14b, r14b
je 0x180009ba3
mov eax, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Blocked
mov r14, qword [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Count
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x28
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.NavTimeArray
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x28
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.LoadTimeArray
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x180009ba8
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x180009bb6
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180009bc9
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x180009bd7
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x180009bed
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x180009bfb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x180009c09
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
je 0x180009c17
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13, r13
je 0x180009c25
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x180009c3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret