Function at 0x180002a50
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, [0x180000000]
lea rcx, [r11 - 0x40]
mov rax, qword [rdx + 0x6468]
mov qword [rcx], rax
movzx eax, byte [rdx + 0x6470]
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x6478]
lea rcx, [r11 - 0x20]
mov qword [rcx], rax
mov eax, dword [rdx + 0x6480]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x6484]
mov word [rcx + 0xc], ax
mov rax, qword [rdx + 0x6488]
lea rcx, [r11 - 0x30]
mov qword [rcx], rax
movzx eax, word [rdx + 0x6490]
mov word [rcx + 8], ax
call fcn.180002890
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x78]
mov dword [rsp + 0x50], ebx
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002b21
lea rdx, [rsp + 0x78]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x78]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002b00
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002b6a
lea rdx, [rsp + 0x88]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002b46
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002bb1
lea rdx, [rsp + 0x68]
nop dword [rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002b90
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, str._s_s_s
lea rcx, [0x180009080]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009080]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000310a
lea rax, [rsp + 0x60]
lea rdx, [0x180009080]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800030f3
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008818]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000881c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008820]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008824]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008828]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000882c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x180009220]
xor eax, eax
mov rdi, rdx
xor r8d, r8d
repne scasb al, byte [rdi]
lea r9d, [rax + 1]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008830]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008834]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008838]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x18000883c]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008840]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008844]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x180009230]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008848]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000884c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008850]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008854]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008858]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000885c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x180009240]
mov rdi, rdx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r9d, [rax + 1]
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008860]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180008864]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x180009030]
xor eax, eax
mov rdi, rdx
lea r9d, [rax + 1]
xor r8d, r8d
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008868]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180009064]
lea rdx, [0x18000886c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180009068]
lea rdx, [0x180008870]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000906c]
lea rdx, [0x180008874]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x180009070]
lea rdx, [0x180008878]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180003103
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x18000311c
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000311a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180004dc0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret