Function at 0x18fec64
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x870
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x860], rax
test rcx, rcx
mov rbx, rcx
jne 0x18fec9d
mov edi, 0x80004003
jmp 0x18ff0b1
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov edi, 0x20006
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x01801700]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18fecf2
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x18ff0b1
mov r15d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov r8d, r15d
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x18fed14
xor edi, edi
jmp 0x18ff0a6
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18fed70
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x18ff0a6
or rsi, 0xffffffffffffffff
xor eax, eax
lea rdx, [rbx + 0x14]
mov rdi, rdx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
add rcx, rcx
cmp rcx, r15
jbe 0x18fed98
mov edi, 0x80070057
jmp 0x18ff0a6
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea rdx, [0x01801748]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
xor eax, eax
lea rdx, [rbx + 0x214]
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
add rcx, rcx
cmp rcx, r15
ja 0x18ff075
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea rdx, [0x01801768]
lea r9d, [rax + 1]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x414]
mov edi, 4
lea rdx, [0x01801780]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x418]
lea rdx, [0x018017a0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x10]
lea rdx, [0x018017c0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x41c]
lea rdx, [0x018017d0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x420]
lea rdx, [0x018017f8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x424]
lea rdx, [0x01801820]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x428]
lea rdx, [0x01801850]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x42c]
lea rdx, [0x01801880]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
mov rcx, qword [rsp + 0x50]
lea rbp, [rbx + 0x430]
lea rdx, [0x018018a0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
xor esi, esi
cmp dword [rbp], esi
jbe 0x18ff05c
lea r8, [0x018018c8]
lea rcx, [rsp + 0x460]
mov r9d, esi
mov edx, 0x400
call fcn.018febf4
test eax, eax
mov edi, eax
js 0x18ff0b1
mov eax, esi
lea rdx, [rsp + 0x60]
mov r8d, r15d
add rax, rax
lea rcx, [rbx + rax*8 + 0x434]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x18ff099
cdqe
add rax, rax
cmp rax, 0x400
ja 0x18ff075
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x460]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18ff065
add esi, 1
cmp esi, dword [rbp]
jb 0x18fefcc
mov rdi, qword [0x01966750]
jmp 0x18ff094
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x18ff09b
mov edi, 0x80070057
jmp 0x18ff09b
test rdi, rdi
mov rcx, rdi
je 0x18ff099
mov rcx, qword [rcx + 0x10]
mov rdi, qword [rdi]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test rdi, rdi
jne 0x18ff07c
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret