Function at 0x180064f50
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
mov eax, 0x2190
call fcn.1800965d0
sub rsp, rax
mov rax, qword [0x18013b490]
xor rax, rsp
mov qword [rsp + 0x2160], rax
mov r12, rdx
mov qword [rsp + 0x48], rdx
mov rbx, r9
lea rdx, [rsp + 0x160]
xor esi, esi
mov r13, r8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r8
mov rbp, rcx
mov word [rsp + 0x30], si
call fcn.180062fa0
test eax, eax
js 0x180065331
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x160]
call fcn.180062cc0
test eax, eax
jne 0x180064fd0
mov eax, 0x80020009
jmp 0x180065331
mov rcx, qword [rbp]
movzx eax, word [rcx]
cmp eax, 9
jl 0x180064ff7
cmp eax, 0xa
jle 0x180064feb
cmp eax, 0xd
je 0x180064feb
cmp eax, 0x20
jne 0x180064ff7
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rbp], rax
jmp 0x180064fd0
lea rdx, [rsp + 0x160]
mov rcx, rbp
call fcn.180062fa0
test eax, eax
js 0x180065331
movzx eax, word [rsp + 0x30]
mov qword [rsp + 0x2188], rdi
mov qword [rsp + 0x2178], r15
cmp eax, 8
je 0x1800652b9
cmp eax, 0x11
je 0x180065170
cmp eax, 0x13
je 0x180065141
cmp eax, 0x4008
jne 0x18006530f
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x50], rsi
add eax, 2
movsxd rcx, eax
je 0x1800650a8
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18006509d
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x1800650a8
lea rcx, [rsp + 0x50]
call fcn.1800635d0
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x1800650b2
lea edi, [rbx + 0xe]
jmp 0x18006511f
mov ecx, 0x80070057
call fcn.1800014f0
int3
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
lea rdi, [rsp + 0x160]
cmp word [rsp + 0x160], si
je 0x180065101
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rdi]
cmp cx, 0x5c
jne 0x1800650f1
cmp word [rax], 0x30
jne 0x1800650f1
mov word [rbx], si
mov rcx, rax
add rbx, 2
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
jmp 0x1800650fc
mov word [rbx], cx
add rbx, 2
add rdi, 2
cmp word [rdi], si
jne 0x1800650c4
mov word [rbx], si
mov word [rbx + 2], si
mov r8, qword [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call fcn.1800629f0
mov rbx, qword [rsp + 0x50]
mov edi, eax
lea rax, [rsp + 0x58]
cmp rbx, rax
je 0x1800652fd
lea rcx, [rsp + 0x50]
call fcn.180063580
mov rbx, qword [rsp + 0x38]
jmp 0x180065302
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x160]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r8d, dword [rsp + 0x30]
mov rdx, r13
mov rcx, r12
call fcn.180062940
mov edi, eax
jmp 0x180065302
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
test dil, 1
jne 0x1800651e9
mov eax, edi
mov qword [rsp + 0x50], rsi
cdq
sub eax, edx
sar eax, 1
movsxd r15, eax
mov rbx, r15
je 0x1800651f3
xor edx, edx
or rax, 0xffffffffffffffff
div rbx
cmp rax, 1
jae 0x1800651b5
mov ecx, 0x80070057
call fcn.1800014f0
int3
cmp rbx, 0x100
jbe 0x1800651f3
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.180063600
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1800651fd
lea rax, [rsp + 0x58]
test rax, rax
je 0x1800651e9
lea rcx, [rsp + 0x50]
call fcn.180063590
mov eax, 0x80004005
jmp 0x180065321
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x2180], r14
call fcn.180076350
mov r12d, esi
mov r13, rsi
mov r14, rdi
test edi, edi
jle 0x180065267
nop dword [rax]
movzx ecx, word [rsp + r13*2 + 0x160]
mov rbx, qword [rsp + 0x50]
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
movsxd rdi, eax
call fcn.180062dc0
mov ecx, r12d
and ecx, 1
movzx r11d, al
mov eax, 4
shl ecx, 2
inc r13
inc r12d
sub eax, ecx
movzx ecx, al
shl r11b, cl
or byte [rdi + rbx], r11b
cmp r13, r14
jl 0x180065220
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14, qword [rsp + 0x2180]
mov edi, eax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1800652f6
lea rcx, [rsp + 0x50]
call fcn.180063590
mov rbx, qword [rsp + 0x38]
jmp 0x180065302
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [r12]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x180065302
mov rbx, qword [rsp + 0x38]
jmp 0x180065302
mov rbx, qword [rsp + 0x38]
test edi, edi
je 0x18006530f
mov ecx, edi
call fcn.180062590
jmp 0x180065321
mov rdx, rbx
mov rcx, rbp
call fcn.180062fa0
test eax, eax
cmovs esi, eax
mov eax, esi
mov rdi, qword [rsp + 0x2188]
mov r15, qword [rsp + 0x2178]
mov rcx, qword [rsp + 0x2160]
xor rcx, rsp
call fcn.180076320
add rsp, 0x2190
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret