Function at 0x180002bd0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [0x180000000]
lea rcx, [r11 - 0x38]
mov rax, qword [rdx + 0x7468]
mov qword [rcx], rax
movzx eax, byte [rdx + 0x7470]
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x7478]
lea rcx, [r11 - 0x28]
mov qword [rcx], rax
movzx eax, word [rdx + 0x7480]
mov word [rcx + 8], ax
mov eax, dword [rdx + 0x7484]
lea rcx, [r11 - 0x44]
mov dword [rcx], eax
movzx eax, word [rdx + 0x7488]
mov word [rcx + 4], ax
call fcn.180002a10
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x64]
mov dword [rsp + 0x50], ebx
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002ca1
lea rdx, [rsp + 0x64]
nop word [rax + rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x64]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002c80
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002cea
lea rdx, [rsp + 0x80]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002cc6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002d31
lea rdx, [rsp + 0x70]
nop dword [rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002d10
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_s
lea rcx, [0x18000a470]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a470]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000328a
lea rax, [rsp + 0x60]
lea rdx, [0x18000a470]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180003273
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c0c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c10]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c14]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c18]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c1c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a610]
xor eax, eax
mov rdi, rdx
xor r8d, r8d
repne scasb al, byte [rdi]
lea r9d, [rax + 1]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009c24]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c28]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c2c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x180009c30]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c34]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c38]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a620]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009c3c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c40]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c44]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c4c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x18000a630]
mov rdi, rdx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r9d, [rax + 1]
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009c54]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c58]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a420]
xor eax, eax
mov rdi, rdx
lea r9d, [rax + 1]
xor r8d, r8d
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009c5c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a454]
lea rdx, [0x180009c60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a458]
lea rdx, [0x180009c64]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a45c]
lea rdx, [0x180009c68]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a460]
lea rdx, [0x180009c6c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180003283
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x18000329c
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000329a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180005850
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret