Function at 0x180055d70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rbp + 0x100], rax
call fcn.180052c30
lea rdx, [rsp + 0x6e]
call fcn.1800556f0
xor esi, esi
test eax, eax
je 0x18005606b
mov eax, dword [str.CLSID_]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], eax
xor r9d, r9d
movzx eax, word [0x180172658]
xor r8d, r8d
mov word [rsp + 0x6c], ax
mov rcx, 0xffffffff80000000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov edi, esi
sete dil
test eax, eax
jne 0x180055f45
mov rcx, qword [rsp + 0x50]
lea rax, str.GSoInput
mov dword [rsp + 0x28], 9
lea r9d, [rsi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
lea rdx, str.InprocServer32
test eax, eax
mov ebx, esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
sete bl
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
and ebx, edi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov edi, esi
cmove edi, ebx
test edi, edi
je 0x180055f3a
mov rcx, qword [0x1801cad58]
lea rdx, [rbp - 0x10]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rsp + 0x58], eax
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x180055ec2
mov rcx, qword [rsp + 0x60]
inc eax
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x180172618]
test eax, eax
mov dword [rsp + 0x28], 0xa
mov ebx, esi
lea rax, str.Apartment
sete bl
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov r9d, 1
and ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
mov edi, esi
test eax, eax
cmove edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
mov rdi, qword [rsp + 0x220]
je 0x18005606b
call fcn.180055480
test eax, eax
je 0x18005606b
xor edx, edx
lea rax, [rsp + 0x58]
lea r9, [0x180147190]
mov qword [rsp + 0x20], rax
lea rcx, [0x1801472e0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x18005606b
mov rcx, qword [rsp + 0x58]
lea r9, [0x180172608]
lea r8, str.c_t4
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
jne 0x180056055
mov rcx, qword [rsp + 0x58]
lea r9, [0x180172608]
lea r8, [0x180147670]
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
jne 0x180056055
mov rcx, qword [rsp + 0x58]
lea r9, [0x180172608]
lea r8, [0x180147680]
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
jne 0x180056055
call fcn.1800552f0
test al, al
je 0x180056055
mov rcx, qword [rsp + 0x58]
lea r9, [0x180172608]
lea r8, [0x1801725e8]
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
jne 0x180056055
mov rcx, qword [rsp + 0x58]
lea r9, [0x180172608]
lea r8, [0x1801725d8]
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jne 0x18005606b
xor eax, eax
jmp 0x1800561a4
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x180147020]
mov qword [rsp + 0x20], rax
lea rcx, [0x1801472f0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800560d7
mov rcx, qword [rsp + 0x50]
lea r9, [0x1801725f8]
mov r8d, 0x804
mov qword [rsp + 0x20], rsi
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + SHCreateDirectory]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x180147190]
mov qword [rsp + 0x20], rax
lea rcx, [0x1801472e0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18005612a
mov rcx, qword [rsp + 0x50]
lea r9, [0x180172608]
lea r8, str.c_t4
lea rdx, [0x180172608]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [rsp + 0x6e]
call fcn.1800556f0
test eax, eax
je 0x18005619f
mov eax, dword [str.CLSID_]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], eax
mov rcx, 0xffffffff80000000
movzx eax, word [0x180172658]
mov word [rsp + 0x6c], ax
call fcn.180055a00
lea rdx, [rbp - 0x46]
call fcn.1800556f0
test eax, eax
je 0x18005619f
movups xmm0, xmmword [str.SoftwareMicrosftCTFTIP_]
lea rdx, [rbp - 0x60]
movzx eax, word [0x180172650]
movsd xmm1, qword [0x180172648]
mov rcx, 0xffffffff80000000
movaps xmmword [rbp - 0x60], xmm0
movsd qword [rbp - 0x50], xmm1
mov word [rbp - 0x48], ax
call fcn.180055a00
mov eax, 0x80004005
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret