Function at 0x18006cd60
Capabilities:
Delete registry key
Set registry value

Disassembly:
jmp 0x18008455c
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
lea rax, [0x18009dff0]
mov dword [rbp + 0x5c], r13d
mov rdi, r8
mov qword [rbp - 0x40], r13
mov r12d, edx
mov qword [rbp - 0x48], r13
mov r15, rcx
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r13
mov dword [rbp + 0x40], r13d
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r13
test byte [0x1800b78f3], 0x20
je 0x1800845d9
mov qword [rsp + 0x20], r8
lea ecx, [r13 + 0x17]
mov r9d, edx
mov r8, r15
lea rdx, [0x18009f490]
call fcn.180087f80
test r15, r15
jne 0x1800845ef
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1aa
jmp 0x180084c82
test rdi, rdi
jne 0x180084605
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1ab
jmp 0x180084c82
mov rdx, qword [rdi + 8]
or rcx, 0xffffffffffffffff
test rdx, rdx
je 0x180084636
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r13w
jne 0x180084615
cmp rax, 0x40
jbe 0x180084636
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1b3
jmp 0x180084c82
lea r14, [rdi + 0x14]
mov edx, dword [r14]
test edx, edx
je 0x180084723
sub edx, 1
je 0x180084696
cmp edx, 1
je 0x180084660
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1eb
jmp 0x180084c82
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x18008480a
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x18008466d
mov eax, 0x80
cmp rcx, rax
jbe 0x18008480a
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1e5
jmp 0x180084c82
mov rdx, qword [rdi + 0x18]
test rdx, rdx
jne 0x1800846b0
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1d5
jmp 0x180084c82
cmp word [rdx], r13w
jne 0x1800846c7
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1d6
jmp 0x180084c82
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r13w
jne 0x1800846ca
cmp rax, 0x824
jbe 0x1800846ed
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1d8
jmp 0x180084c82
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x18008480a
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1800846fa
mov eax, 0x80
cmp rcx, rax
jbe 0x18008480a
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1dc
jmp 0x180084c82
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x180084752
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r13w
jne 0x18008472f
cmp rax, 0x100
jbe 0x180084752
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1bb
jmp 0x180084c82
mov r8, qword [rdi + 0x20]
mov eax, 0x80
test r8, r8
je 0x180084783
mov rdx, rcx
inc rdx
cmp word [r8 + rdx*2], r13w
jne 0x180084763
cmp rdx, rax
jbe 0x180084783
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1c0
jmp 0x180084c82
mov r8, qword [rdi + 0x28]
test r8, r8
je 0x1800847af
mov rdx, rcx
inc rdx
cmp word [r8 + rdx*2], r13w
jne 0x18008478f
cmp rdx, rax
jbe 0x1800847af
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1c5
jmp 0x180084c82
mov rdx, qword [rdi + 0x30]
mov r8d, 0x400
test rdx, rdx
je 0x1800847e1
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r13w
jne 0x1800847c1
cmp rax, r8
jbe 0x1800847e1
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1ca
jmp 0x180084c82
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x18008480a
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1800847ea
cmp rcx, r8
jbe 0x18008480a
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1cf
jmp 0x180084c82
mov esi, 1
cmp dword [rdi], esi
je 0x180084824
mov ebx, 0x80070057
mov dword [rbp + 0x5c], 0x1f6
jmp 0x180084c82
lea r8, [rbp - 0x40]
mov edx, esi
mov ecx, 0x2001f
call fcn.180085458
mov ebx, eax
test eax, eax
jns 0x180084846
mov dword [rbp + 0x5c], 0x1f8
jmp 0x180084c82
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.180015ab0
mov ebx, eax
test eax, eax
jns 0x180084864
mov dword [rbp + 0x5c], 0x1fa
jmp 0x180084c82
mov r9, qword [rdi + 8]
test r9, r9
je 0x180084895
cmp word [r9], r13w
je 0x180084895
mov rdx, qword [rbp - 0x38]
mov r8d, r12d
mov rcx, qword [rbp - 0x40]
call fcn.18008512c
mov ebx, eax
test eax, eax
jns 0x180084895
mov dword [rbp + 0x5c], 0x202
jmp 0x180084c82
mov rdx, qword [rbp - 0x38]
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
mov r9d, esi
mov r8d, 0x2001f
mov qword [rsp + 0x20], rax
call fcn.180082214
mov ebx, eax
test eax, eax
jns 0x1800848c6
mov dword [rbp + 0x5c], 0x205
jmp 0x180084c82
mov r8d, r12d
lea rdx, [0x1800a8690]
lea rcx, [rbp - 0x18]
call fcn.180015800
mov ebx, eax
test eax, eax
jns 0x1800848eb
mov dword [rbp + 0x5c], 0x20b
jmp 0x180084c82
mov rsi, qword [rbp - 0x18]
xor r9d, r9d
mov rcx, qword [rbp - 0x48]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
je 0x18008492c
test eax, eax
jle 0x18008491c
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18008492c
mov dword [rbp + 0x5c], 0x210
jmp 0x180084c82
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x2001f
mov rdx, rsi
call fcn.180082214
mov ebx, eax
test eax, eax
jns 0x18008495f
mov dword [rbp + 0x5c], 0x213
jmp 0x180084c82
mov ecx, 4
lea rax, [rdi + 0x10]
mov dword [rsp + 0x28], ecx
lea rdx, str.Flags
mov r9d, ecx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp - 0x50]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x18008499d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x1800849ad
mov dword [rbp + 0x5c], 0x21a
jmp 0x180084c50
mov rcx, qword [rbp - 0x50]
lea rdx, str.Switch
mov eax, 4
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov r9d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1800849e7
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x1800849f7
mov dword [rbp + 0x5c], 0x21b
jmp 0x180084c50
mov r8, qword [rdi + 8]
test r8, r8
je 0x180084a35
cmp word [r8], r13w
je 0x180084a35
mov rcx, qword [rbp - 0x50]
lea rdx, str.FriendlyName
call fcn.180082524
mov ebx, eax
test eax, eax
jle 0x180084a25
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x180084a90
mov dword [rbp + 0x5c], 0x21f
jmp 0x180084c50
mov r9d, r12d
lea rdx, str.PXY__s:_d_
mov r8, r15
lea rcx, [rbp - 0x28]
call fcn.180015800
mov ebx, eax
test eax, eax
jns 0x180084a5d
mov dword [rbp + 0x5c], 0x227
jmp 0x180084c50
mov r8, qword [rbp - 0x28]
lea rdx, str.FriendlyName
mov rcx, qword [rbp - 0x50]
call fcn.180082524
mov ebx, eax
test eax, eax
jle 0x180084a80
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x180084a90
mov dword [rbp + 0x5c], 0x228
jmp 0x180084c50
mov ecx, dword [r14]
test ecx, ecx
je 0x180084b49
sub ecx, 1
je 0x180084ae6
cmp ecx, 1
jne 0x180084c82
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x180084c82
cmp word [r8], r13w
je 0x180084c82
mov rcx, qword [rbp - 0x50]
lea rdx, str.Username
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084c82
mov dword [rbp + 0x5c], 0x25a
jmp 0x180084c50
mov r8, qword [rdi + 0x18]
lea rdx, str.Script
mov rcx, qword [rbp - 0x50]
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084b0c
mov dword [rbp + 0x5c], 0x24b
jmp 0x180084c50
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x180084c82
cmp word [r8], r13w
je 0x180084c82
mov rcx, qword [rbp - 0x50]
lea rdx, str.Username
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084c82
mov dword [rbp + 0x5c], 0x250
jmp 0x180084c50
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x180084b74
mov rcx, qword [rbp - 0x50]
lea rdx, str.Server
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084b74
mov dword [rbp + 0x5c], 0x230
jmp 0x180084c50
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x180084ba5
cmp word [r8], r13w
je 0x180084ba5
mov rcx, qword [rbp - 0x50]
lea rdx, str.Username
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084ba5
mov dword [rbp + 0x5c], 0x236
jmp 0x180084c50
mov r8, qword [rdi + 0x30]
test r8, r8
je 0x180084bd3
cmp word [r8], r13w
je 0x180084bd3
mov rcx, qword [rbp - 0x50]
lea rdx, str.Exception
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084bd3
mov dword [rbp + 0x5c], 0x23c
jmp 0x180084c50
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x180084c01
cmp word [r8], r13w
je 0x180084c01
mov rcx, qword [rbp - 0x50]
lea rdx, str.ExtraInfo
call fcn.180082524
mov ebx, eax
test eax, eax
jns 0x180084c01
mov dword [rbp + 0x5c], 0x242
jmp 0x180084c50
movzx eax, word [rdi + 0x40]
lea rdx, str.Port
mov rcx, qword [rbp - 0x50]
mov r9d, 4
mov dword [rbp + 0x40], eax
xor r8d, r8d
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x180084c45
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x180084c82
mov dword [rbp + 0x5c], 0x246
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180084c69
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
test byte [0x1800b78f3], 0x20
je 0x180084c9f
mov ecx, 0x18
lea rdx, [0x18009f490]
mov r8d, ebx
call fcn.1800876bc
mov ecx, ebx
call fcn.180011928
lea rcx, [rbp - 0x28]
mov ebx, eax
call fcn.180021be4
lea rcx, [rbp - 0x18]
call fcn.180021be4
lea rcx, [rbp - 0x38]
call fcn.180021be4
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180084cdc
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x180084cf5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x48], r13
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x180084d0a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret