Function at 0x1800174c0
Capabilities:
Create thread
Set registry value

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x1140
call fcn.180082cd0
sub rsp, rax
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rsp + 0x1168], rbx
mov qword [rsp + 0x1170], rbp
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x1130], rax
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x38], esi
lea rbp, [0x1800bf228]
mov qword [rsp + 0xb8], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
test rbx, rbx
jne 0x180017535
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1800180c9
mov rcx, rbx
call fcn.180016540
test eax, eax
je 0x18001754a
mov byte [0x1800bf2f9], 1
jmp 0x180017556
lea rcx, str._SaveKeyRule_failed
call fcn.18002f4e4
lea r12, [0x1800bfb90]
mov rcx, r12
call fcn.180005680
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x180095c90]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.AllowedCopyLimits
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.18000fff0
nop
cmp byte [rsp + 0x98], 7
je 0x18001760a
lea rcx, [rsp + 0x90]
call fcn.180055f84
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1800180c9
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, 0xc
lea rdx, str.CryptEnabled
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
xor dil, dil
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800100a0
movzx ecx, byte [rsp + 0x70]
test al, al
je 0x1800176e0
cmp cl, 7
jne 0x1800176e0
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.180057620
test al, al
jne 0x1800176ad
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x180017748
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.1800562e4
cmp eax, 1
sete dil
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x180017748
movsx eax, cl
cmp eax, 4
je 0x18001770c
add eax, 0xfffffffa
cmp eax, 1
ja 0x18001771e
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x18001771e
mov rcx, rbx
call fcn.18005a3b8
mov rcx, rbx
call fcn.18006e998
jmp 0x18001771e
bt dword [rsp + 0x70], 8
jae 0x18001771e
mov rcx, qword [rsp + 0x68]
call fcn.18006fc10
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180017748
lea rbx, [rcx - 8]
lea r9, [0x18005595c]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18007ace4
mov rcx, rbx
call fcn.18007a6f4
mov eax, esi
test dil, dil
setne al
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x180095c90]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x18001779a
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, 0xa
lea rdx, [0x1800958c8]
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
xor dil, dil
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800100a0
movzx ecx, byte [rsp + 0x70]
test al, al
je 0x180017870
cmp cl, 7
jne 0x180017870
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.180057620
test al, al
jne 0x18001783d
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x1800178d8
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.1800562e4
cmp eax, 1
sete dil
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x1800178d8
movsx eax, cl
cmp eax, 4
je 0x18001789c
add eax, 0xfffffffa
cmp eax, 1
ja 0x1800178ae
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1800178ae
mov rcx, rbx
call fcn.18005a3b8
mov rcx, rbx
call fcn.18006e998
jmp 0x1800178ae
bt dword [rsp + 0x70], 8
jae 0x1800178ae
mov rcx, qword [rsp + 0x68]
call fcn.18006fc10
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800178d8
lea rbx, [rcx - 8]
lea r9, [0x18005595c]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18007ace4
mov rcx, rbx
call fcn.18007a6f4
mov eax, esi
test dil, dil
setne al
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.CryptoMode
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x18001792a
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, socket
lea rdx, [0x180096808]
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
mov edi, esi
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800100a0
movzx ecx, byte [rsp + 0x70]
test al, al
je 0x180017a00
cmp cl, 7
jne 0x180017a00
lea r8, [0x1800957a4]
lea rdx, str.value_number
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.180057620
test al, al
jne 0x1800179cf
lea rcx, [rsp + 0x68]
call fcn.180055f84
xor r11b, r11b
jmp 0x180017a6b
lea r8, [0x1800957a4]
lea rdx, str.value_number
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.1800562e4
mov edi, eax
lea rcx, [rsp + 0x68]
call fcn.180055f84
mov r11b, 1
jmp 0x180017a6b
movsx eax, cl
cmp eax, 4
je 0x180017a2c
add eax, 0xfffffffa
cmp eax, 1
ja 0x180017a3e
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x180017a3e
mov rcx, rbx
call fcn.18005a3b8
mov rcx, rbx
call fcn.18006e998
jmp 0x180017a3e
bt dword [rsp + 0x70], 8
jae 0x180017a3e
mov rcx, qword [rsp + 0x68]
call fcn.18006fc10
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180017a68
lea rbx, [rcx - 8]
lea r9, [0x18005595c]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18007ace4
mov rcx, rbx
call fcn.18007a6f4
xor r11b, r11b
mov eax, esi
test r11b, r11b
cmovne eax, edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.BanScreenshotAction
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180017abd
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, sendto
lea rdx, str.EncryptClipboard
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
xor dil, dil
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800100a0
movzx ecx, byte [rsp + 0x70]
test al, al
je 0x180017b93
cmp cl, 7
jne 0x180017b93
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.180057620
test al, al
jne 0x180017b60
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x180017bfb
lea r8, [0x180095792]
lea rdx, str.value_bool
lea rcx, [rsp + 0x68]
call fcn.180056f38
mov rcx, rax
call fcn.1800562e4
cmp eax, 1
sete dil
lea rcx, [rsp + 0x68]
call fcn.180055f84
jmp 0x180017bfb
movsx eax, cl
cmp eax, 4
je 0x180017bbf
add eax, 0xfffffffa
cmp eax, 1
ja 0x180017bd1
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x180017bd1
mov rcx, rbx
call fcn.18005a3b8
mov rcx, rbx
call fcn.18006e998
jmp 0x180017bd1
bt dword [rsp + 0x70], 8
jae 0x180017bd1
mov rcx, qword [rsp + 0x68]
call fcn.18006fc10
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180017bfb
lea rbx, [rcx - 8]
lea r9, [0x18005595c]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18007ace4
mov rcx, rbx
call fcn.18007a6f4
mov eax, esi
test dil, dil
setne al
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x180096848]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180017c4d
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, sendto
lea rdx, str.MaxOfflineEnabled
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
lea r8, [0x1800bf2f8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.180010480
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180017ca4
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
cmp byte [0x1800bf2f8], 0
je 0x180017d15
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, sendto
lea rdx, str.MaxOfflineHours
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
lea r8, [0x1800bc648]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800105a0
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180017d04
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov eax, dword [0x1800bc648]
imul eax, eax, 0x3c
mov dword [0x1800bc648], eax
jmp 0x180017d1f
mov dword [0x1800bc648], 0xea24
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, sendto
lea rdx, str.AllowedCopyLimit
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.180010480
test al, al
je 0x180017d75
cmp byte [rsp + 0x30], 0
je 0x180017d75
mov bl, 1
jmp 0x180017d77
xor bl, bl
cmp qword [rsp + 0x60], 0x10
jb 0x180017d89
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
test bl, bl
je 0x180017e33
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, socket
lea rdx, str.AllowedCopyLimitChars
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
mov dword [rsp + 0x38], esi
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1800105a0
mov ebx, esi
test al, al
cmovne ebx, dword [rsp + 0x38]
cmp qword [rsp + 0x60], 0x10
jb 0x180017df2
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov eax, 0x3e7
cmp ebx, eax
cmovg ebx, eax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.AllowedCopyLimits
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, sendto
lea rdx, str.EnableWhitePath
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.180010480
test al, al
je 0x180017e89
cmp byte [rsp + 0x30], 0
je 0x180017e89
mov bl, 1
jmp 0x180017e8b
xor bl, bl
cmp qword [rsp + 0x60], 0x10
jb 0x180017e9d
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
test bl, bl
je 0x180017f89
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov r8d, 0xd
lea rdx, str.DteWhitePaths
lea rcx, [rsp + 0x40]
call fcn.180006440
nop
lea rax, [0x180095708]
mov qword [rsp + 0x68], rax
lea rax, [fcn.1800013c0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf8]
call fcn.1800107f0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.18000ac20
nop
cmp r12, rax
je 0x180017f41
mov rdx, rax
mov rcx, r12
call fcn.180004090
nop
lea rcx, [rsp + 0xc8]
call fcn.180005860
mov rcx, qword [rsp + 0xc8]
call fcn.18006e998
nop
lea rcx, [rsp + 0xf8]
call fcn.1800051c0
mov rcx, qword [rsp + 0xf8]
call fcn.18006e998
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180017f89
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
lea rcx, [rsp + 0x90]
call fcn.180012060
cmp dword [0x1800bcc40], 0
je 0x1800180b2
mov dword [0x1800bcc40], esi
lea rax, str._OfflineMonitorThread
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x267
lea r9, str..dterule.cpp
lea r8, str._s._d:_s
mov edx, 0x800
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180013e80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x180018024
lea r8, [rsp + 0x130]
mov edx, dword [rsp + 0x38]
lea rcx, str.thread__d_created:__s
call fcn.18002f1b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, str._DteWorkMonitor
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x268
lea r9, str..dterule.cpp
lea r8, str._s._d:_s
mov edx, 0x800
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180014950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1800180a8
lea r8, [rsp + 0x130]
mov edx, dword [rsp + 0x38]
lea rcx, str.thread__d_created:__s
call fcn.18002f1b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x90]
call fcn.180055f84
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x1130]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x1140]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret