Function at 0x180158f90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18053d0c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov qword [rsp + 0x58], rdx
xor edi, edi
call fcn.180143080
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea r8d, [rdi + 0x20]
lea rdx, str.5a70eb91b17803ed717a8ed0dd518654
lea rcx, [rbp + 0x60]
call fcn.1801411d0
nop
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x20]
call fcn.18014adc0
nop
lea r8d, [rdi + 8]
lea rdx, str._tcn.ini
lea rcx, [rbp + 0x20]
call fcn.18014acf0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x18015908d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159942
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a50]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1801590c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
call fcn.1801530d0
nop
lea rcx, [rsp + 0x60]
call fcn.180154830
movzx r12d, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180159138
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159948
call fcn.1803e3270
test r12b, r12b
je 0x1801593af
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.180178850
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.180158d10
nop
mov r13, qword [rbp - 0x68]
mov r15, qword [rbp - 0x80]
cmp qword [rbp - 0x70], 0x20
jne 0x18015933c
lea rdx, [rsp + 0x60]
call fcn.180158940
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x180159303
lea rdx, [rsp + 0x60]
cmp r14, 0x10
cmovae rdx, rdi
lea rcx, [rbp - 0x80]
cmp r13, 0x10
cmovae rcx, r15
cmp rax, 0x20
jne 0x180159303
mov r8, rax
call fcn.1803e5e50
test eax, eax
jne 0x180159303
xor ebx, ebx
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rsi + 0x10], xmm1
cmp r14, 0x10
jb 0x180159211
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180159209
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015995a
mov rcx, rdi
call fcn.1803e3270
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], bl
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18015925e
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015994e
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a60]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1801592af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801592aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159954
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a50]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], bx
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180159903
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801598fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015993c
jmp 0x1801598fe
cmp r14, 0x10
jb 0x18015933a
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180159332
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015995a
mov rcx, rdi
call fcn.1803e3270
xor edi, edi
cmp r13, 0x10
jb 0x180159374
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x18015936b
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159960
mov rcx, r15
call fcn.1803e3270
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1801593af
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801593aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159966
call fcn.1803e3270
lea rax, [rbp + 0x40]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rdi
mov r8d, 9
lea rdx, str.Create...
lea rcx, [rbp + 0x40]
call fcn.1801411d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov r8d, 8
lea rdx, str.TCN_Sign
lea rcx, [rbp - 0x80]
call fcn.1801411d0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.18014c3c0
test r12b, r12b
je 0x1801594b3
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180159430
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x40]
call fcn.1801530d0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call fcn.1803e2304
shr rax, 0x20
test eax, eax
jne 0x18015996c
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1801594b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801594ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015997f
call fcn.1803e3270
call fcn.1803e1978
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1801599c0
nop
lea rdx, [rbp + 0x20]
call fcn.180158a60
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov rdx, qword [rsp + 0x58]
nop word [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x180159520
mov r8, rbx
lea rcx, [rbp - 0x80]
call fcn.1801411d0
lea rcx, [rsp + 0x58]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov r9, qword [rbp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.180149a80
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180141140
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.1801762b0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18015961f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18015961a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159985
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a60]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18015966d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159668
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015998b
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a60]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1801596bb
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801596b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159991
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a60]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Software_tcn
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18015974a
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.sign
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x10]
sub rax, rcx
cmp rax, 9
jb 0x180159997
lea rax, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rax, qword [rbp]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.tcn_sign
lea rcx, [rbp - 0x40]
call fcn.180140810
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.180178250
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1801597e4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801597df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015999d
call fcn.1803e3270
movups xmm0, xmmword [rbp]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x18015983f
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801599a3
call fcn.1803e3270
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x18015987b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180159875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801599a9
call fcn.1803e3270
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1801598bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801598b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801599af
call fcn.1803e3270
movdqa xmm0, xmmword [0x180502a50]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], di
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180159903
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801598fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180159936
call fcn.1803e3270
mov rax, rsi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1803e3250
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1803ea6d4
int3
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
int3
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, str.remove
call fcn.1801534e0
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
int3
call fcn.180142570
int3
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
nop
call fcn.1803ea6d4
int3