Function at 0x18000be00
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov r13, r8
mov rsi, rdx
mov r12, rcx
xor r15d, r15d
mov qword [r11 - 0x60], r15
mov dword [r11 - 0x58], r15d
mov rax, qword [rdx]
or ebx, 0xffffffff
cmp dword [rax - 0x10], r15d
je 0x18000be8a
mov r8, rdx
lea rdx, [0x180056c08]
lea rcx, [r11 - 0x80]
call fcn.180001a70
nop
mov rdx, rax
mov rcx, rsi
call fcn.18000e720
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000be8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x68]
call fcn.18000ae30
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1800018f0
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x18000bf04
mov edi, r15d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], r15d
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bf24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bf43
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x18000bfa4
mov rbp, qword [r13]
mov r14, qword [r12]
mov eax, r15d
test rbp, rbp
setne al
mov rdi, qword [rsp + 0x78]
test eax, eax
je 0x18000bf8c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x18000bfa9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov qword [rsp + 0x78], r15
jmp 0x18000bfa9
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x18000bfb8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bfd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000bff5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000c011
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret