Function at 0x180012a70
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], 0xfffffffffffffffe
mov r14, rdx
mov rdi, rcx
mov qword [rbp + 0x108], 0
mov dword [rbp + 0x104], 2
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x180012abb
mov rcx, qword [rdi]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rax
mov rbx, rbp
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.180006d10
mov rax, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x180012ae1
mov rbx, qword [rbp]
lea rsi, [rbx + rax*2]
mov rcx, rbx
mov rdx, rsi
call fcn.1800059c0
mov rcx, rsi
cmp rax, rsi
je 0x180012b1f
mov rcx, rax
jmp 0x180012b0f
cmp ax, 0x2f
jne 0x180012b1f
add rcx, 2
cmp rcx, rsi
je 0x180012b1c
movzx eax, word [rcx]
cmp ax, 0x5c
jl 0x180012b00
je 0x180012b06
jmp 0x180012b1f
mov rcx, rsi
cmp rcx, rsi
je 0x180012b4e
mov rax, rsi
jmp 0x180012b3b
je 0x180012b4b
add rax, 0xfffffffffffffffe
cmp rax, rcx
je 0x180012b4e
movzx edx, word [rax - 2]
cmp dx, 0x5c
jge 0x180012b30
cmp dx, 0x2f
jne 0x180012b32
mov rcx, rax
sub rsi, rcx
sar rsi, 1
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rsi
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x20]
call fcn.180006d10
lea rax, [0x1800347a6]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0
lea rcx, [rbp + 0x20]
lea rdx, [rbp - 0x30]
call fcn.180006d10
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x20]
call fcn.180013170
lea r15, [rbp - 0x20]
mov rcx, rax
mov rdx, r15
call fcn.1800053c0
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x180012beb
mov rcx, qword [rbp + 0x20]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180012be6
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x180012fdc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.18001ac00
mov rax, qword [rbp + 0x58]
cmp rax, 8
jb 0x180012c31
mov rcx, qword [rbp + 0x40]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180012c2c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x180012fdc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.18001ac00
movabs rax, 0x7b005800620074
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], 0x60074
mov word [rbp + 0xf6], 0
movdqa xmm0, xmmword [0x18002e2d0]
movaps xmm1, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersio]
movaps xmmword [rbp + 0x40], xmm1
movaps xmm1, xmmword [0x18002e2f0]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [0x18002e300]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x18002e310]
movaps xmmword [rbp + 0x70], xmm1
movaps xmm1, xmmword [0x18002e320]
movaps xmmword [rbp + 0x80], xmm1
movdqa xmm1, xmmword [rbp + 0x90]
paddw xmm1, xmm0
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm1, xmmword [rbp + 0xa0]
paddw xmm1, xmm0
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmm1, xmmword [rbp + 0xb0]
paddw xmm1, xmm0
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm1, xmmword [rbp + 0xc0]
paddw xmm1, xmm0
movdqa xmmword [rbp + 0xc0], xmm1
movdqa xmm1, xmmword [rbp + 0xd0]
paddw xmm1, xmm0
movdqa xmmword [rbp + 0xd0], xmm1
paddw xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xe0], xmm0
add word [rbp + 0xf0], 0xfffa
add word [rbp + 0xf2], 0xfffa
add word [rbp + 0xf4], 0xfffa
lea rax, [rbp + 0x104]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor esi, esi
lea rbx, [rbp + 0x40]
mov rcx, 0xffffffff80000001
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180012f46
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm0, xmmword [0x18002e330]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], 0x22
mov rsi, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x180012da2
mov rdi, qword [rdi]
cmp rsi, 6
jbe 0x180012dc8
mov qword [rsp + 0x20], rsi
lea rcx, [rbp + 0x40]
mov rdx, rsi
mov r9, rdi
call fcn.18000b880
cmp qword [r14 + 0x10], 0
jne 0x180012df2
jmp 0x180012eaa
lea rcx, [rbp + 0x42]
lea rax, [rsi + 1]
mov qword [rbp + 0x50], rax
lea r8, [rsi + rsi]
mov rdx, rdi
call fcn.18001e9d0
mov word [rbp + rsi*2 + 0x42], 0
cmp qword [r14 + 0x10], 0
je 0x180012eaa
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov rdx, rcx
sub rdx, rax
cmp rdx, 2
jae 0x180012e26
mov qword [rsp + 0x20], 2
lea r9, [0x1800347a2]
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.18000b880
jmp 0x180012e46
lea rdx, [rax + 2]
mov qword [rbp + 0x50], rdx
cmp rcx, 8
jb 0x180012e38
mov rbx, qword [rbp + 0x40]
mov dword [rbx + rax*2], 0x200022
mov word [rbx + rax*2 + 4], 0
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x180012e54
mov r14, qword [r14]
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x180012e7d
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x40]
mov rdx, r8
mov r9, r14
call fcn.18000b880
jmp 0x180012eaa
lea rsi, [rax + r8]
mov qword [rbp + 0x50], rsi
cmp rcx, 8
jb 0x180012e91
mov rdi, qword [rbp + 0x40]
jmp 0x180012e95
lea rdi, [rbp + 0x40]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, r14
call fcn.18001e9d0
mov word [rdi + rsi*2], 0
mov eax, dword [rbp + 0x50]
cmp qword [rbp + 0x58], 8
jb 0x180012eba
mov rdx, qword [rbp + 0x40]
jmp 0x180012ebe
lea rdx, [rbp + 0x40]
add eax, eax
cmp qword [rbp - 8], 8
jb 0x180012ecb
mov r15, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x108]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete sil
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x58]
cmp rax, 8
jb 0x180012f46
mov rcx, qword [rbp + 0x40]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180012f41
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x180012fdc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.18001ac00
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x180012f88
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180012f83
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x180012fdc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.18001ac00
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x180012fca
mov rcx, qword [rbp]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180012fc5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x180012fdc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.18001ac00
mov eax, esi
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.1800207ec
int3