Function at 0x1800a1020
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r15, rcx
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800a170a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
xor r12d, r12d
mov dword [rsp + 0x6c], r12d
mov esi, 1
mov r14d, esi
mov dword [rsp + 0x68], esi
mov dword [rbp + 0xc0], 0x11c
lea edi, [rsi + 1]
mov rbx, qword [0x180166208]
test rbx, rbx
jne 0x1800a10f8
xor eax, eax
lock cmpxchg dword [0x1801660e0], esi
jne 0x1800a10c8
call fcn.1800a2810
mov dword [0x1801660e0], edi
jmp 0x1800a10e9
mov eax, dword [0x1801660e0]
cmp eax, edi
je 0x1800a10e4
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1801660e0]
cmp eax, edi
jne 0x1800a10d2
call fcn.1800a2810
mov rbx, rax
mov qword [0x180166208], rax
mov r14d, dword [rsp + 0x68]
cmp dword [rbx + 8], 0xffffffff
je 0x1800a117a
lea rcx, [rbx + 0xc]
lea rdx, [rbp + 0xc0]
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, rsi
jne 0x1800a1110
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov eax, dword [rcx + 0x18]
mov dword [rdx + 0x18], eax
jmp 0x1800a1216
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp - 0x60]
call fcn.1800c61d0
mov dword [rbp - 0x60], 0x11c
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.1800a1b20
test eax, eax
je 0x1800a1292
lea rcx, [rbp + 0xc0]
lea rdx, [rbp - 0x60]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rdi, rsi
jne 0x1800a11b1
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
cmp dword [rbp + 0xc4], 6
jb 0x1800a1292
mov qword [rsp + 0x78], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800a1299
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], r12d
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 0x10]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1800a1285
mov r14d, r12d
cmp dword [rsp + 0x70], r12d
setne r14b
mov dword [rsp + 0x68], r14d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800a1299
mov r14d, esi
mov dword [rsp + 0x68], esi
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x60]
call fcn.1800a2600
mov r13d, eax
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x1800a1323
test r14d, r14d
jne 0x1800a1323
mov rbx, qword [rsp + 0x60]
lea rcx, [rbx - 0x18]
mov rdi, qword [r15]
sub rdi, 0x18
cmp rcx, rdi
je 0x1800a16a7
cmp dword [rdi + 0x10], r12d
jl 0x1800a130f
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1800a130f
call fcn.180009ba0
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1800a1303
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [r15], rax
jmp 0x1800a16a2
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, r15
call fcn.18000b4d0
jmp 0x1800a16a7
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800a16ff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800a16ff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800a16ff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], r12d
lea rcx, [rsp + 0x40]
call fcn.1800a2e80
test eax, eax
jne 0x1800a13a4
lea rcx, [rsp + 0x40]
call fcn.1800a28f0
test eax, eax
je 0x1800a13b4
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x1800a13b4
or dword [rsp + 0x58], 1
lea rcx, [rsp + 0x48]
call fcn.1800a4180
test eax, eax
je 0x1800a13d2
mov rax, qword [rsp + 0x48]
cmp dword [rax - 0x10], 0
je 0x1800a13d2
or dword [rsp + 0x58], 2
lea rcx, [rsp + 0x50]
call fcn.1800a1720
mov rax, qword [rsp + 0x50]
mov edi, dword [rsp + 0x58]
cmp dword [rax - 0x10], 0
je 0x1800a13f2
or edi, 8
mov dword [rsp + 0x58], edi
mov rbx, qword [rsp + 0x60]
test dil, 3
jne 0x1800a140b
test r13d, r13d
je 0x1800a1456
cmp dword [rsp + 0x6c], 0
jne 0x1800a1424
jmp 0x1800a1456
test r13d, r13d
je 0x1800a1456
mov r8d, r14d
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1800a1e40
test eax, eax
jne 0x1800a1436
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.180009380
jmp 0x1800a1648
test rbx, rbx
je 0x1800a16ff
mov rdx, rbx
mov rcx, qword [r15]
call fcn.1800c98b0
test eax, eax
je 0x1800a1648
mov edi, dword [rsp + 0x58]
mov eax, edi
and eax, 3
cmp al, 3
je 0x1800a14f2
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r12d, dword [rsp + 0x58]
not r12d
test r12b, 1
je 0x1800a14a8
lea rcx, [rsp + 0x40]
call fcn.1800a2e80
test eax, eax
jne 0x1800a1498
lea rcx, [rsp + 0x40]
call fcn.1800a28f0
test eax, eax
je 0x1800a14a8
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x1800a14a8
or dword [rsp + 0x58], 1
test r12b, 2
je 0x1800a14cc
lea rcx, [rsp + 0x48]
call fcn.1800a4180
test eax, eax
je 0x1800a14cc
mov rax, qword [rsp + 0x48]
cmp dword [rax - 0x10], 0
je 0x1800a14cc
or dword [rsp + 0x58], 2
test r12b, 8
je 0x1800a14ec
lea rcx, [rsp + 0x50]
call fcn.1800a1720
mov rax, qword [rsp + 0x50]
cmp dword [rax - 0x10], 0
je 0x1800a14ec
or dword [rsp + 0x58], 8
cmp edi, dword [rsp + 0x58]
jne 0x1800a14fb
mov rax, qword [r15]
cmp dword [rax - 0x10], 0
jne 0x1800a152c
mov r8d, r14d
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1800a1e40
test eax, eax
jne 0x1800a152c
test r13d, r13d
je 0x1800a152c
cmp dword [rsp + 0x6c], eax
je 0x1800a152c
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.180009380
jmp 0x1800a1648
xor edi, edi
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x78], edi
mov qword [rbp - 0x70], rdi
mov r9d, 0x202
mov r8, qword [0x1801548d0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.180041b90
test eax, eax
je 0x1800a15a0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, qword [0x1801548d0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.1800a0b50
test eax, eax
je 0x1800a15a0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800a1648
jmp 0x1800a1641
mov rdi, qword [rbp - 0x80]
cmp dword [rbx - 0x10], 0
je 0x1800a15f9
mov rdx, qword [r15]
test rdx, rdx
je 0x1800a16f4
mov rcx, rbx
call fcn.1800c98b0
test eax, eax
je 0x1800a15f9
mov rax, rsi
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x1800a15c5
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.m2_old
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [r15]
test rdx, rdx
je 0x1800a1639
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdx + rax*2], 0
jne 0x1800a1604
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x18011914c]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rdi, rdi
je 0x1800a1648
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800a1666
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800a1684
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800a16a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1800a16bf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.180096b80
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
int3