Function at 0x180002360
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov qword [rsp + 0x208], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x250], rax
call fcn.180038ad4
mov rsi, rax
test rax, rax
je 0x180002d0e
lea r14, [0x1800bf200]
mov qword [rsp + 0x200], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov ecx, 8
call fcn.18006ea94
xor r13d, r13d
test rax, rax
je 0x1800023e1
lea rcx, [rsp + 0x110]
mov qword [rax], rcx
jmp 0x1800023e4
mov rax, r13
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x110]
call fcn.180007350
mov qword [rsp + 0x140], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x140]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x140]
mov qword [rax], rax
mov rax, qword [rsp + 0x140]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x148], r13
mov rax, qword [0x1800bfb50]
mov rdi, qword [rax + 8]
mov rbx, rdi
cmp byte [rdi + 0x1b9], 0
jne 0x1800024a7
nop word [rax + rax]
mov rdx, qword [rbx + 0x10]
lea rcx, [0x1800bfb20]
call fcn.180005e80
mov rbx, qword [rbx]
lea rcx, [rdi + 0x40]
call fcn.180004bf0
cmp qword [rdi + 0x38], 0x10
jb 0x18000247c
mov rcx, qword [rdi + 0x20]
call fcn.18006e998
mov qword [rdi + 0x38], sendto
mov qword [rdi + 0x30], r13
mov byte [rdi + 0x20], 0
mov rcx, rdi
call fcn.18006e998
mov rdi, rbx
cmp byte [rbx + 0x1b9], 0
je 0x180002450
mov rax, qword [0x1800bfb50]
mov qword [rax + 8], rax
mov qword [0x1800bfb58], r13
mov rax, qword [0x1800bfb50]
mov qword [rax], rax
mov rax, qword [0x1800bfb50]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x30], rax
lea rax, [0x180095708]
mov qword [rsp + 0xe8], rax
lea rax, [fcn.1800013c0]
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x100], rax
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.180038cc8
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.18000aaa0
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ac20
nop
lea rcx, [0x1800bfb60]
cmp rcx, rax
je 0x18000254c
mov rdx, rax
call fcn.180004090
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000259a
mov rbx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x180002595
lea rdi, [rcx + 0x20]
cmp qword [rdi], 8
jb 0x180002573
mov rcx, qword [rdi - 0x18]
call fcn.18006e998
mov qword [rdi], 7
mov qword [rdi - 8], r13
mov word [rdi - 0x18], r13w
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rbx
jne 0x180002564
mov rcx, qword [rsp + 0x58]
call fcn.18006e998
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x40]
call fcn.18006e998
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x18000260a
mov rbx, qword [rsp + 0x90]
cmp rcx, rbx
je 0x180002605
lea rdi, [rcx + 0x20]
cmp qword [rdi], 0x10
jb 0x1800025e1
mov rcx, qword [rdi - 0x18]
call fcn.18006e998
mov qword [rdi], sendto
mov qword [rdi - 8], r13
mov byte [rdi - 0x18], 0
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rbx
jne 0x1800025d2
mov rcx, qword [rsp + 0x88]
call fcn.18006e998
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r13
mov rcx, qword [rsp + 0x70]
call fcn.18006e998
nop
mov rax, qword [rsp + 0xd8]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0xd8]
mov qword [rax + 8], rax
mov qword [rsp + 0xe0], r13
mov rcx, qword [rsp + 0xd8]
cmp rdi, rcx
je 0x18000269b
nop dword [rax]
mov rbx, qword [rdi]
cmp qword [rdi + 0x30], 0x10
jb 0x180002673
mov rcx, qword [rdi + 0x18]
call fcn.18006e998
mov qword [rdi + 0x30], sendto
mov qword [rdi + 0x28], r13
mov byte [rdi + 0x18], 0
mov rcx, rdi
call fcn.18006e998
mov rdi, rbx
mov rcx, qword [rsp + 0xd8]
cmp rbx, rcx
jne 0x180002660
call fcn.18006e998
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xb0]
call fcn.18006e998
mov qword [rsp + 0x1c0], 7
mov qword [rsp + 0x1b8], r13
mov word [rsp + 0x1a8], r13w
mov r8d, 7
lea rdx, [0x180095480]
lea rcx, [rsp + 0x1a0]
call fcn.180006960
nop
mov qword [rsp + 0x170], socket
mov qword [rsp + 0x168], r13
mov byte [rsp + 0x158], 0
mov r8d, 1
lea rdx, [0x180095458]
lea rcx, [rsp + 0x150]
call fcn.180006440
nop
lea r9, [rsp + 0x1a0]
lea r8, [rsp + 0x150]
mov rdx, rsi
lea rcx, [rsp + 0x1c8]
call fcn.1800021f0
nop
cmp qword [rsp + 0x170], 0x10
jb 0x18000275d
mov rcx, qword [rsp + 0x158]
call fcn.18006e998
mov qword [rsp + 0x170], socket
mov qword [rsp + 0x168], r13
mov byte [rsp + 0x158], 0
cmp qword [rsp + 0x1c0], 8
jb 0x180002791
mov rcx, qword [rsp + 0x1a8]
call fcn.18006e998
mov qword [rsp + 0x1c0], 7
mov qword [rsp + 0x1b8], r13
mov word [rsp + 0x1a8], r13w
mov rdi, qword [rsp + 0x1f0]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x1800027ea
cmp rbx, rax
je 0x1800027ef
call fcn.18006e940
cmp rsi, rdi
je 0x180002ac8
test rbx, rbx
jne 0x180002807
call fcn.18006e940
mov rdx, r13
jmp 0x18000280a
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x180002815
call fcn.18006e940
cmp qword [rsi + 0x178], 8
jb 0x180002828
mov rdx, qword [rsi + 0x160]
jmp 0x18000282f
lea rdx, [rsi + 0x160]
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r13
mov word [rsp + 0x78], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.180006960
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.18000a760
nop
cmp qword [rax + 0x20], 8
jb 0x180002884
mov rdx, qword [rax + 8]
jmp 0x180002888
lea rdx, [rax + 8]
lea r8, [0x18009547c]
lea rcx, [rsp + 0xb0]
call fcn.180033970
nop
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.18000a620
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.18000adb0
nop
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x210]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x180], xmm0
movaps xmm1, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x190], xmm1
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x210]
call fcn.1800074d0
mov rcx, qword [rsp + 0x240]
call fcn.18006e998
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], r13
mov rcx, qword [rsp + 0x210]
call fcn.18006e998
nop
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1800029b9
mov rbp, qword [rsp + 0xd0]
cmp rcx, rbp
je 0x1800029b4
lea rdi, [rcx + 0x20]
nop dword [rax]
cmp qword [rdi], 8
jb 0x18000298f
mov rcx, qword [rdi - 0x18]
call fcn.18006e998
mov qword [rdi], 7
mov qword [rdi - 8], r13
mov word [rdi - 0x18], r13w
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rbp
jne 0x180002980
mov rcx, qword [rsp + 0xc8]
call fcn.18006e998
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xb0]
call fcn.18006e998
nop
cmp qword [rsp + 0x60], 8
jb 0x1800029f1
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
cmp qword [rsp + 0x90], 8
jb 0x180002a1a
mov rcx, qword [rsp + 0x78]
call fcn.18006e998
test rbx, rbx
jne 0x180002a29
call fcn.18006e940
mov rdx, r13
jmp 0x180002a2c
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x180002a37
call fcn.18006e940
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.180001450
mov rdi, rax
test rbx, rbx
jne 0x180002a57
call fcn.18006e940
mov rdx, r13
jmp 0x180002a5a
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x180002a65
call fcn.18006e940
mov rdx, rdi
lea rcx, [0x1800bfb20]
call fcn.180004600
mov rcx, rax
lea rdx, [rsi + 0x10]
call fcn.180002d50
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180002a93
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
test rbx, rbx
jne 0x180002aa2
call fcn.18006e940
mov rdx, r13
jmp 0x180002aa5
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x180002ab0
call fcn.18006e940
mov rsi, qword [rsi]
mov rdi, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x1c8]
jmp 0x1800027e0
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r13
mov word [rsp + 0x78], r13w
mov r8d, 1
lea rdx, [0x18009547c]
lea rcx, [rsp + 0x70]
call fcn.180006960
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xe8]
call fcn.180001300
nop
lea r8, [0x18009547c]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000aec0
cmp qword [rax + 0x20], 8
jb 0x180002b35
mov rdi, qword [rax + 8]
jmp 0x180002b39
lea rdi, [rax + 8]
test rdi, rdi
je 0x180002b49
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180002b4c
mov eax, r13d
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
lea r8, str.dteMainExts
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp qword [rsp + 0x60], 8
jb 0x180002b8c
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
cmp qword [rsp + 0x108], 8
jb 0x180002bb8
mov rcx, qword [rsp + 0xf0]
call fcn.18006e998
mov rcx, qword [0x1800bfb80]
sub rcx, qword [0x1800bfb78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov edx, dword [0x1800bfb58]
lea rcx, str._d_app_and__d_white_path_loaded_from_das
call fcn.18002f1b4
nop
mov rax, qword [rsp + 0x1f0]
mov rbx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rax + 8], rax
mov qword [rsp + 0x1f8], r13
mov rcx, qword [rsp + 0x1f0]
cmp rbx, rcx
je 0x180002c47
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.180004bf0
mov rcx, rbx
call fcn.18006e998
mov rbx, rdi
mov rcx, qword [rsp + 0x1f0]
cmp rdi, rcx
jne 0x180002c23
call fcn.18006e998
mov qword [rsp + 0x1f0], r13
mov rcx, qword [rsp + 0x1c8]
call fcn.18006e998
nop
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0xa0], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x190], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x180], xmm1
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x110]
call fcn.1800074d0
mov rcx, qword [rsp + 0x140]
call fcn.18006e998
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], r13
mov rcx, qword [rsp + 0x110]
call fcn.18006e998
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x180002d24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.open_das_failed__error:__d
call fcn.18002f4e4
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret