Function at 0x180087e10
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CLSID0055AAB0_EACB_46DB_9BB4_1B97FC046D02
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180087e8d
mov dword [rsp + 0x58], 1
jmp 0x180087e95
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x18008816e
mov eax, 0x4e2d
mov word [rsp + 0x98], ax
mov eax, 0x6587
mov word [rsp + 0x9a], ax
mov eax, 0x28
mov word [rsp + 0x9c], ax
mov eax, 0x7b80
mov word [rsp + 0x9e], ax
mov eax, 0x4f53
mov word [rsp + 0xa0], ax
mov eax, 0x29
mov word [rsp + 0xa2], ax
mov eax, 0x20
mov word [rsp + 0xa4], ax
mov eax, 0x2d
mov word [rsp + 0xa6], ax
mov eax, 0x20
mov word [rsp + 0xa8], ax
mov eax, 0x32
mov word [rsp + 0xaa], ax
mov eax, 0x33
mov word [rsp + 0xac], ax
mov eax, 0x34
mov word [rsp + 0xae], ax
mov eax, 0x35
mov word [rsp + 0xb0], ax
mov eax, 0x738b
mov word [rsp + 0xb2], ax
mov eax, 0x724c
mov word [rsp + 0xb4], ax
mov eax, 0x62fc
mov word [rsp + 0xb6], ax
mov eax, 0x97f3
mov word [rsp + 0xb8], ax
mov eax, 0x8f93
mov word [rsp + 0xba], ax
mov eax, 0x5165
mov word [rsp + 0xbc], ax
mov eax, 0x6cd5
mov word [rsp + 0xbe], ax
xor eax, eax
mov word [rsp + 0xc0], ax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.180033860
nop
lea rcx, [rsp + 0x78]
call fcn.180037960
shl rax, 1
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x78]
call fcn.180037970
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InprocServer32
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18008805c
mov dword [rsp + 0x5c], 1
jmp 0x180088064
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x180088158
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0xd0]
mov rcx, qword [0x18048a418]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x78]
call fcn.180033910
lea rcx, [rsp + 0x78]
call fcn.180037960
shl rax, 1
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x78]
call fcn.180037970
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Apartment
lea rcx, [rsp + 0x78]
call fcn.180033910
lea rcx, [rsp + 0x78]
call fcn.180037960
shl rax, 1
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x78]
call fcn.180037970
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
call fcn.180033840
movzx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x2f0
pop rdi
ret