Function at 0x18000721c
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2088]
mov eax, 0x2188
call fcn.180030850
sub rsp, rax
mov rax, qword [0x180044dd0]
xor rax, rsp
mov qword [rbp + 0x2070], rax
mov r15, rdx
mov qword [rsp + 0x48], rdx
xor esi, esi
mov qword [rsp + 0x40], r9
lea rdx, [rbp + 0x70]
mov word [rsp + 0x30], si
mov r13, r9
mov qword [rsp + 0x50], r8
mov r12, r8
mov qword [rsp + 0x38], rcx
mov rbx, rcx
call fcn.18000a108
test eax, eax
js 0x1800075f5
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.18000bc40
test eax, eax
jne 0x1800072a3
mov eax, 0x80020009
jmp 0x1800075f5
mov rdx, qword [rbx]
movzx ecx, word [rdx]
sub ecx, 9
je 0x1800072bd
sub ecx, 1
je 0x1800072bd
sub ecx, 3
je 0x1800072bd
cmp ecx, 0x13
jne 0x1800072cb
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov qword [rbx], rax
jmp 0x1800072a3
lea rdx, [rbp + 0x70]
mov rcx, rbx
call fcn.18000a108
test eax, eax
js 0x1800075f5
movzx eax, word [rsp + 0x30]
cmp eax, 8
je 0x1800075b8
cmp eax, 0x11
je 0x180007483
cmp eax, 0x13
je 0x18000742d
cmp eax, 0x4008
jne 0x1800075e3
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], rsi
mov rax, rdi
lea rcx, [rbp + 0x70]
inc rax
cmp word [rcx + rax*2], si
jne 0x18000731a
add eax, 2
movsxd rcx, eax
je 0x18000735b
xor edx, edx
mov rax, rdi
div rcx
cmp rax, 2
jb 0x180007623
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x18000735b
lea rcx, [rsp + 0x60]
call fcn.180007640
mov rbx, qword [rsp + 0x60]
jmp 0x180007365
lea rbx, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x18000740b
lea r14, [rbp + 0x70]
cmp word [rbp + 0x70], si
je 0x1800073b3
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
movzx ecx, word [r14]
cmp cx, 0x5c
jne 0x1800073a2
cmp word [rax], 0x30
jne 0x1800073a2
mov rcx, rax
mov word [rbx], si
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov r14, rax
jmp 0x1800073a9
mov word [rbx], cx
add r14, 2
add rbx, 2
cmp word [r14], si
jne 0x180007378
mov dword [rbx], esi
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x18000762e
mov r9d, esi
mov r8, rdx
mov rcx, rdi
inc rcx
cmp word [r8 + rcx*2], si
jne 0x1800073cc
inc ecx
lea r8, [r8 + rcx*2]
lea r9d, [r9 + rcx*2]
cmp ecx, 1
jne 0x1800073c9
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea r9d, [rcx + 6]
mov rcx, qword [r15]
mov rdx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x60]
mov edi, eax
jmp 0x180007410
mov edi, 0xe
lea rax, [rsp + 0x68]
cmp rbx, rax
je 0x1800075a6
lea rcx, [rsp + 0x60]
call fcn.180009478
jmp 0x1800075a6
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], esi
xor r8d, r8d
lea rcx, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x1800075f5
mov eax, dword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov rcx, qword [r15]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov edi, eax
jmp 0x1800075ab
or rdi, 0xffffffffffffffff
lea rax, [rbp + 0x70]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], si
jne 0x18000748e
test bl, 1
jne 0x1800074f8
mov eax, ebx
mov qword [rsp + 0x60], rsi
cdq
sub eax, edx
sar eax, 1
movsxd r13, eax
mov r14, r13
je 0x1800074df
xor edx, edx
mov rax, rdi
div r14
cmp rax, 1
jb 0x180007618
cmp r13, 0x100
jbe 0x1800074df
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.180007640
mov rcx, qword [rsp + 0x60]
jmp 0x1800074e9
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x60], rcx
test rcx, rcx
jne 0x180007502
lea rcx, [rsp + 0x60]
call fcn.180009478
mov eax, 0x80004005
jmp 0x1800075f5
mov r8, r14
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movsxd r12, ebx
mov r14d, esi
test ebx, ebx
jle 0x180007563
mov r15, rsi
mov eax, r14d
test r14d, r14d
jns 0x180007525
lea eax, [r14 + 1]
movzx ecx, word [rbp + r15*2 + 0x70]
mov rbx, qword [rsp + 0x60]
sar eax, 1
movsxd rdi, eax
call fcn.1800087bc
mov dl, al
mov ecx, r14d
and ecx, 1
mov eax, 4
shl ecx, 2
inc r14d
sub eax, ecx
inc r15
mov cl, al
shl dl, cl
or byte [rdi + rbx], dl
cmp r15, r12
jl 0x180007519
mov r15, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov r9d, 3
mov rdx, qword [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [r15]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov edi, eax
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x1800075a1
lea rcx, [rsp + 0x60]
call fcn.180009478
mov r13, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
test edi, edi
je 0x1800075e3
mov ecx, edi
call fcn.180007b44
jmp 0x1800075f5
lea rax, [rbp + 0x70]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], si
jne 0x1800075c0
lea eax, [rdi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x70]
jmp 0x180007468
mov rdx, r13
mov rcx, rbx
call fcn.18000a108
test eax, eax
cmovs esi, eax
mov eax, esi
mov rcx, qword [rbp + 0x2070]
xor rcx, rsp
call fcn.1800308b0
add rsp, 0x2188
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.180005734
int3
mov ecx, 0x80070057
call fcn.180005734
int3
mov ecx, 0x80004005
call fcn.180005734
int3