Function at 0x18000dafc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e60]
mov eax, 0x3f60
call fcn.180012f20
sub rsp, rax
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x3e50], rax
mov rbx, r8
mov qword [rsp + 0x70], rdx
mov r13, rdx
mov r14, rcx
mov esi, 0x208
lea rcx, [rbp + 0x3440]
mov r8d, esi
xor edx, edx
mov r15, r9
call sub.msvcrt.dll_memset
mov r8d, esi
lea rcx, [rbp + 0x3230]
xor edx, edx
call sub.msvcrt.dll_memset
or rdi, 0xffffffffffffffff
mov word [rbp - 0x5c], 0x500
xor r12d, r12d
mov qword [rsp + 0x58], rdi
mov r8d, esi
mov dword [rbp - 0x60], r12d
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
cmp rbx, 0xffffffff80000002
jne 0x18000e06b
xor ebx, ebx
test r14, r14
jne 0x18000dbc8
lea r14, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea rdx, [rbp + 0x1b0]
call fcn.18000e254
test eax, eax
jne 0x18000e040
mov r8d, 0x400
lea rdx, [rbp + 0x3650]
mov rcx, r14
call fcn.18000e094
test eax, eax
jne 0x18000e040
mov r12d, 0x103
lea rax, [rbp + 0x3650]
lea r9, str.SOFTWAREMicrosoftClientForNFSCurrentVersionUsers_s
mov qword [rsp + 0x20], rax
mov r8d, r12d
mov rcx, r15
lea esi, [r12 + 1]
mov edx, esi
call qword [sym.imp.msvcrt.dll__snwprintf_s]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov rdx, r15
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000dfbb
cmp dword [rsp + 0x60], 1
jne 0x18000dfc0
lea edx, [rax + 1]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x18000dfad
mov edx, 0x1000
lea rcx, [rbp + 0x230]
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [rax + rax]
test eax, eax
je 0x18000dfad
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x18000dfad
mov r8, r14
lea rdx, [rbp + 0x30]
mov ecx, 0x80
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop dword [rax + rax]
mov r8b, 2
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
jne 0x18000dd13
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x18000dd4c
xor edx, edx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
nop dword [rax + rax]
mov edx, 1
lea rcx, [rbp + 0xb0]
mov dword [rax], 0x20
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
nop dword [rax + rax]
mov dword [rax], 0x220
mov r8b, 1
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x130]
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
nop dword [rax + rax]
test eax, eax
jne 0x18000dd78
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x18000dd93
xor edx, edx
lea rcx, [rbp + 0x130]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
nop dword [rax + rax]
mov dword [rax], 0x12
mov dword [rsp + 0x50], r13d
mov eax, r13d
shl rax, 7
lea rbx, [rbp + 0x30]
add rbx, rax
mov word [rbp - 0x50], 0x300
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
mov r8, rbx
mov dword [rbp - 0x4c], 0x10000000
add ax, 8
lea rdx, [rbp - 0x48]
mov ecx, 0x7c
mov word [rbp - 0x4e], ax
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x18000de12
movzx eax, word [rbp - 0x4e]
lea r9, [rbp - 0x50]
or r8d, 0xffffffff
mov dword [rsp + 0x20], eax
mov edx, 2
lea rcx, [rbp + 0x230]
call qword [sym.imp.ADVAPI32.dll_AddAce]
nop dword [rax + rax]
test eax, eax
jne 0x18000de1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp eax, 3
jb 0x18000dd9b
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rcx, [rsp + 0x78]
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
nop dword [rax + rax]
mov r13, qword [rsp + 0x70]
test eax, eax
je 0x18000dfad
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0x2000
lea rdx, [rbp + 0x1230]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
je 0x18000dfad
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x1230]
lea edx, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
nop dword [rax + rax]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x3440]
lea rax, [rbp + 0x3230]
mov rdx, r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
nop dword [rax + rax]
test eax, eax
je 0x18000dfad
lea rcx, [rbp + 0x3230]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x18000defe
mov r9, r12
lea r8, [0x180014f30]
sub r9, rax
lea rcx, [rbp + 0x3230]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcsncat_s]
nop dword [rax + rax]
lea rcx, [rbp + 0x3230]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x18000df34
sub r12, rax
lea r8, [rbp + 0x3440]
mov r9, r12
lea rcx, [rbp + 0x3230]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcsncat_s]
nop dword [rax + rax]
lea rcx, [rbp + 0x3230]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x18000df6a
mov rcx, qword [rsp + 0x58]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.Name
lea rax, [rbp + 0x3230]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
jmp 0x18000dfc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x18000dfc0
mov qword [rsp + 0x58], rdi
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x18000dfd6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor r12d, r12d
test r13, r13
je 0x18000e03d
cmp word [r13], 0x5c
je 0x18000e016
mov rcx, rdi
inc rcx
cmp word [r15 + rcx*2], r12w
jne 0x18000dfe9
mov eax, esi
lea r8, [0x180014f30]
sub eax, ecx
mov edx, eax
lea r9d, [rax - 1]
mov eax, ecx
lea rcx, [r15 + rax*2]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
inc rdi
cmp word [r15 + rdi*2], r12w
jne 0x18000e016
sub esi, edi
mov eax, edi
mov edx, esi
mov r8, r13
lea r9d, [rsi - 1]
lea rcx, [r15 + rax*2]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov eax, r12d
mov rcx, qword [rbp + 0x3e50]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x3fb0]
add rsp, 0x3f60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov esi, 0x104
lea r8, str.SOFTWAREMicrosoftClientForNFSCurrentVersion
mov edx, esi
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
jmp 0x18000dfd9