Function at 0x180062110
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x18006278f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor esi, esi
mov dword [rsp + 0x58], esi
mov r15d, 1
mov dword [rsp + 0x60], r15d
mov dword [rbp - 0x50], 0x11c
lea rcx, [rbp - 0x50]
call fcn.180024510
test eax, eax
je 0x18006220d
cmp dword [rbp - 0x4c], 6
jb 0x18006220d
mov qword [rsp + 0x78], rsi
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180062215
mov dword [rsp + 0x5c], esi
mov dword [rsp + 0x70], esi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 4]
lea r8, [rsp + 0x5c]
lea edx, [rsi + 0x14]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180062200
mov r15d, esi
cmp dword [rsp + 0x5c], esi
setne r15b
mov dword [rsp + 0x60], r15d
mov ebx, r15d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180062215
mov dword [rsp + 0x60], r15d
mov ebx, r15d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1800614f0
mov r13d, eax
mov r14, 0xffffffffffffffff
test eax, eax
je 0x1800622b0
test ebx, ebx
je 0x180062247
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.18001edc0
test eax, eax
jne 0x1800622b0
mov rbx, qword [rsp + 0x50]
lea rcx, [rbx - 0x18]
mov rsi, qword [rdi]
sub rsi, 0x18
cmp rcx, rsi
je 0x180062735
cmp dword [rsi + 0x10], 0
jl 0x18006229c
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x18006229c
call fcn.180025a30
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x180062290
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rdi], rax
jmp 0x180062730
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, rdi
call fcn.1800252d0
jmp 0x180062735
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x18006279a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x1800627a5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x1800627b0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x30]
call fcn.180064d90
test eax, eax
jne 0x18006234e
lea rcx, [rsp + 0x30]
call fcn.1800656d0
test eax, eax
je 0x18006235e
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
je 0x18006235e
or dword [rsp + 0x48], 1
lea rcx, [rsp + 0x38]
call fcn.180066410
test eax, eax
je 0x18006237c
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x18006237c
or dword [rsp + 0x48], 2
lea rcx, [rsp + 0x40]
call fcn.180061070
mov rax, qword [rsp + 0x40]
mov esi, dword [rsp + 0x48]
cmp dword [rax - 0x10], 0
je 0x18006239c
or esi, 8
mov dword [rsp + 0x48], esi
mov rbx, qword [rsp + 0x50]
test sil, 3
jne 0x180062418
test r13d, r13d
je 0x180062451
cmp dword [rsp + 0x58], 0
je 0x180062451
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx - 0x18]
mov rbx, qword [rdi]
sub rbx, 0x18
cmp rcx, rbx
je 0x1800626b6
cmp dword [rbx + 0x10], 0
jl 0x180062568
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x180062568
call fcn.180025a30
mov rsi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18006240c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rdi], rax
jmp 0x1800626b6
test r13d, r13d
je 0x180062451
mov r8d, r15d
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180061920
test eax, eax
je 0x1800623bb
test rbx, rbx
je 0x1800627bb
mov rdx, rbx
mov rcx, qword [rdi]
call fcn.1800bb554
test eax, eax
je 0x1800626b6
mov esi, dword [rsp + 0x48]
mov eax, esi
and eax, 3
cmp al, 3
je 0x1800624ed
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r12d, dword [rsp + 0x48]
not r12d
test r12b, 1
je 0x1800624a3
lea rcx, [rsp + 0x30]
call fcn.180064d90
test eax, eax
jne 0x180062493
lea rcx, [rsp + 0x30]
call fcn.1800656d0
test eax, eax
je 0x1800624a3
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
je 0x1800624a3
or dword [rsp + 0x48], 1
test r12b, 2
je 0x1800624c7
lea rcx, [rsp + 0x38]
call fcn.180066410
test eax, eax
je 0x1800624c7
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x1800624c7
or dword [rsp + 0x48], 2
test r12b, 8
je 0x1800624e7
lea rcx, [rsp + 0x40]
call fcn.180061070
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x1800624e7
or dword [rsp + 0x48], 8
cmp esi, dword [rsp + 0x48]
jne 0x1800624fa
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jne 0x18006258d
mov r8d, r15d
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180061920
test eax, eax
jne 0x18006258d
test r13d, r13d
je 0x18006258d
cmp dword [rsp + 0x58], eax
je 0x18006258d
lea rcx, [rbx - 0x18]
mov rsi, qword [rdi]
sub rsi, 0x18
cmp rcx, rsi
je 0x1800626b6
cmp dword [rsi + 0x10], eax
jl 0x180062579
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x180062579
call fcn.180025a30
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x18006255c
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rdi], rax
jmp 0x1800626b6
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.1800252d0
jmp 0x1800626b6
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, rdi
call fcn.1800252d0
jmp 0x1800626b6
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x70], r15
lea rcx, [rsp + 0x68]
call fcn.1800613c0
nop
mov r9d, 0x202
mov r8, qword [rax]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.180022180
test eax, eax
sete bl
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800625e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x18006269f
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rbp - 0x80]
cmp dword [rbx - 0x10], 0
je 0x180062654
mov rdx, qword [rdi]
test rdx, rdx
je 0x180062784
mov rcx, rbx
call fcn.1800bb554
test eax, eax
je 0x180062654
mov rax, r14
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x180062620
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.m2_old
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rdi]
test rdx, rdx
je 0x180062695
mov rax, r14
nop
lea rax, [rax + 1]
cmp word [rdx + rax*2], 0
jne 0x180062660
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1800fe79c]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rsi, rsi
je 0x1800626b2
mov rcx, rsi
jmp 0x1800626a8
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800626b2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], r15d
lea rax, [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800626df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rax, [rsp + 0x38]
mov qword [rbp - 0x68], rax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180062708
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rax, [rsp + 0x30]
mov qword [rbp - 0x68], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180062730
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x18006274f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, 1
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
int3