Function at 0x18001ce60
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r12
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rbp], rax
xor r12d, r12d
mov r15, rcx
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], r12
test rcx, rcx
je 0x18001d434
lea rdx, [r12 - 2]
call fcn.180053398
test rax, rax
je 0x18001d434
mov qword [rsp + 0x150], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x158], rsi
lea rdx, str.SoftwareMalwarebytesAnti_ExploitOfficeMacroSettingsBackup
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x110], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, 2
jne 0x18001d13f
movaps xmm0, xmmword [str.SoftwareMalwarebytesAnti_ExploitOfficeMacroSettingsBackup]
movaps xmm1, xmmword [0x18008d910]
movzx eax, word [0x18008d978]
mov word [rbp - 8], ax
movaps xmmword [rbp - 0x80], xmm0
movaps xmm0, xmmword [0x18008d920]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [0x18008d930]
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmmword [0x18008d940]
movaps xmmword [rbp - 0x50], xmm1
movaps xmm1, xmmword [0x18008d950]
movaps xmmword [rbp - 0x40], xmm0
movaps xmm0, xmmword [0x18008d960]
movaps xmmword [rbp - 0x30], xmm1
movsd xmm1, qword [0x18008d970]
movsd qword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1000a
mov qword [rsp + 0x50], r12
lea esi, [rax + 0x1e]
call fcn.180053ad4
mov ecx, 0x2000a
mov rdi, rax
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18001d049
test rax, rax
je 0x18001d049
lea r9, [rbp - 0x80]
lea r8, str._MM__Creating_backup_tree_for__s...
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001d032
lea rdx, [r12 - 2]
mov rcx, rbx
mov word [rbx + 0x1fffe], r12w
call fcn.180053398
lea rcx, [rsp + 0x50]
mov r9, rbx
lea r8, [rax + 1]
mov rdx, rdi
mov qword [rsp + 0x20], 0xffffffffffffffff
call fcn.180054798
test eax, eax
je 0x18001d009
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
mov r8d, esi
mov rdx, rbx
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r9, str._BackUpOfficeMacroSetting
lea rcx, str...MacroManager.cpp
mov edx, 0x13b
mov r8d, 3
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.180001b40
jmp 0x18001d062
lea rcx, str.Error__d_in_swprintf_s_n
mov edx, esi
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001d05c
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18001d06f
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18001d07c
mov rcx, rbx
call fcn.180053a94
lea r8, [rsp + 0x68]
lea rdx, [0x180088bec]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x68], r12
mov rbx, 0xffffffff80000002
mov qword [rsp + 0x50], r12
call fcn.180055e24
test rax, rax
je 0x18001d118
nop word [rax + rax]
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x18001d127
cmp rbx, 0xffffffff80000002
je 0x18001d0fb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rdx, [0x180088bec]
xor ecx, ecx
call fcn.180055e24
test rax, rax
jne 0x18001d0b0
mov rax, qword [rsp + 0x50]
mov edi, r12d
mov qword [rsp + 0x58], rax
jmp 0x18001d144
test rbx, rbx
je 0x18001d135
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r12
mov qword [rsp + 0x58], rax
jmp 0x18001d144
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x18001d2ea
test edi, edi
jne 0x18001d2ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1000a
mov qword [rsp + 0x70], r12
lea esi, [rax + 0x1e]
call fcn.180053ad4
mov ecx, 0x2000a
mov rdi, rax
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18001d241
test rax, rax
je 0x18001d241
lea r9, str.SoftwareMalwarebytesAnti_ExploitOfficeMacroSettingsBackup
lea r8, str._MM__Backup_tree__s_created_or_opened_succesfuly.
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001d22a
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
mov word [rbx + 0x1fffe], r12w
call fcn.180053398
lea rcx, [rsp + 0x70]
mov r9, rbx
lea r8, [rax + 1]
mov rdx, rdi
mov qword [rsp + 0x20], 0xffffffffffffffff
call fcn.180054798
test eax, eax
je 0x18001d201
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
mov r8d, esi
mov rdx, rbx
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r9, str._BackUpOfficeMacroSetting
lea rcx, str...MacroManager.cpp
mov edx, 0x140
mov r8d, 3
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.180001b40
jmp 0x18001d25a
lea rcx, str.Error__d_in_swprintf_s_n
mov edx, esi
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001d254
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18001d267
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18001d274
mov rcx, rbx
call fcn.180053a94
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18001d2b4
mov edi, 0x4da
jmp 0x18001d2df
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1000a
mov qword [rsp + 0x70], r12
lea r14d, [rax + 0x1e]
call fcn.180053ad4
mov ecx, 0x2000a
mov rsi, rax
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18001d3dd
test rax, rax
je 0x18001d3dd
mov ecx, dword [rsp + 0x60]
lea r8, str._MM__Key__s_succesfully_Backed_up_with_value__d...
mov r9, r15
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov edx, 0xffff
call fcn.180053a4c
test eax, eax
jle 0x18001d3c5
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
mov word [rbx + 0x1fffe], r12w
call fcn.180053398
lea rcx, [rsp + 0x70]
mov r9, rbx
lea r8, [rax + 1]
mov rdx, rsi
mov qword [rsp + 0x20], 0xffffffffffffffff
call fcn.180054798
test eax, eax
je 0x18001d39b
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
mov r8d, r14d
mov rdx, rbx
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r9, str._BackUpOfficeMacroSetting
lea rcx, str...MacroManager.cpp
mov edx, 0x14e
mov r8d, 3
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call fcn.180001b40
jmp 0x18001d3f6
lea rcx, str.Error__d_in_swprintf_s_n
mov edx, r14d
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001d3f0
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r14, qword [rsp + 0x110]
test rsi, rsi
je 0x18001d40b
mov rcx, rsi
call fcn.180053a94
mov rsi, qword [rsp + 0x158]
test rbx, rbx
je 0x18001d420
mov rcx, rbx
call fcn.180053a94
mov rbx, qword [rsp + 0x150]
mov eax, edi
mov rdi, qword [rsp + 0x118]
jmp 0x18001d439
mov eax, 0x57
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x120
pop r15
pop r12
pop rbp
ret