Function at 0x1800b10f0
Capabilities:
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov rax, qword [0x1801903f8]
xor rax, rbp
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], r8
mov r15, rcx
test rdx, rdx
je 0x1800b1151
or r9d, 0x20006
mov r8d, r9d
call fcn.1800aeae0
mov r14, rax
jmp 0x1800b1154
mov r14, rcx
test r14, r14
je 0x1800b1576
call fcn.1800d08e0
test eax, eax
je 0x1800b12b3
mov r12d, 2
xor r13d, r13d
mov r8d, r13d
mov rbx, qword [rbp + 0xa0]
mov rdi, qword [rbx + 0x10]
mov edx, r13d
test rdi, rdi
jle 0x1800b11c0
nop dword [rax]
test rdx, rdx
js 0x1800b11ba
cmp rdx, rdi
jge 0x1800b11ba
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdx*8]
mov eax, dword [rcx - 0x10]
lea r12d, [r12 + rax*2 + 2]
inc r8d
inc rdx
movsxd rax, r8d
cmp rax, rdi
jl 0x1800b1190
jmp 0x1800b11c0
call fcn.1800329e8
int3
mov edi, r12d
mov ecx, r12d
call fcn.180030824
mov rsi, rax
test rax, rax
je 0x1800b1576
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.18007ead0
mov r11, rsi
mov rcx, qword [rbx + 0x10]
mov r8, r13
test rcx, rcx
jle 0x1800b1252
test r8, r8
js 0x1800b124c
cmp r8, rcx
jge 0x1800b124c
mov rax, qword [rbx + 8]
mov rcx, qword [rax + r8*8]
mov rdx, r11
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x1800b1210
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea r11, [r11 + rcx*2]
inc r13d
inc r8
mov rcx, qword [rbx + 0x10]
movsxd rax, r13d
cmp rax, rcx
jl 0x1800b11f3
jmp 0x1800b1252
call fcn.1800329e8
int3
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800b1295
cmp r14, r15
je 0x1800b1283
mov rcx, r14
call fcn.1800aeb30
mov rcx, rsi
call fcn.18003081c
mov eax, 1
jmp 0x1800b1578
mov rcx, rsi
call fcn.18003081c
cmp r14, r15
je 0x1800b1576
mov rcx, r14
call fcn.1800aeb30
jmp 0x1800b1576
lea rcx, [rbp + 0x10]
call fcn.18011a4a0
nop
xor r13d, r13d
mov esi, r13d
mov r12, qword [rbp + 0xa0]
mov rcx, qword [r12 + 0x10]
mov ebx, r13d
test rcx, rcx
jle 0x1800b13b7
nop dword [rax + rax]
test rbx, rbx
js 0x1800b13b1
cmp rbx, rcx
jge 0x1800b13b1
mov rax, qword [r12 + 8]
mov rdi, qword [rax + rbx*8]
call fcn.180032e40
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x1800b13a6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp], rax
test rdi, rdi
je 0x1800b1350
test rdi, 0xffffffffffff0000
jne 0x1800b1350
movzx edi, di
mov ecx, edi
call fcn.180035ed8
test rax, rax
je 0x1800b135d
mov r8d, edi
mov rdx, rax
lea rcx, [rbp]
call fcn.180037a70
jmp 0x1800b135d
mov rdx, rdi
lea rcx, [rbp]
call fcn.180037b8c
nop
lea r8, [rbp]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x10]
call fcn.18011b2c0
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800b138e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc esi
inc rbx
mov rcx, qword [r12 + 0x10]
movsxd rax, esi
cmp rax, rcx
jl 0x1800b12e0
jmp 0x1800b13b7
mov ecx, 0x80004005
call fcn.180004010
int3
call fcn.1800329e8
int3
mov esi, 1
mov r8d, r13d
mov rdx, r13
mov rdi, qword [rbp + 0x20]
test rdi, rdi
jle 0x1800b13fb
mov r9, qword [rbp + 0x18]
nop
test rdx, rdx
js 0x1800b13f5
cmp rdx, rdi
jge 0x1800b13f5
mov rax, qword [r9 + rdx*8]
mov ecx, dword [rax - 0x10]
lea esi, [rsi + rcx + 1]
inc r8d
inc rdx
movsxd rax, r8d
cmp rax, rdi
jl 0x1800b13d0
jmp 0x1800b13fb
call fcn.1800329e8
int3
mov edi, esi
mov ecx, esi
call fcn.180030824
mov rbx, rax
test rax, rax
je 0x1800b156d
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.18007ead0
mov r11, rbx
mov r9d, r13d
mov r8, r13
mov rcx, qword [rbp + 0x20]
test rcx, rcx
jle 0x1800b148c
nop
test r8, r8
js 0x1800b1486
cmp r8, rcx
jge 0x1800b1486
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax + r8*8]
mov rdx, r11
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800b1450
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
mov eax, ecx
add r11, rax
inc r9d
inc r8
movsxd rax, r9d
mov rcx, qword [rbp + 0x20]
cmp rax, rcx
jl 0x1800b1430
jmp 0x1800b148c
call fcn.1800329e8
int3
mov r12, qword [rbp + 8]
test r12, r12
je 0x1800b150f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1800b150f
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b14c2
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18011bdc0
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1800b150f
mov byte [rdi], 0
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, r13
mov r13, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, 7
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1800b1557
cmp r14, r15
je 0x1800b153e
mov rcx, r14
call fcn.1800aeb30
mov rcx, rbx
call fcn.18003081c
nop
lea rcx, [rbp + 0x10]
call fcn.18011aff0
mov eax, 1
jmp 0x1800b1578
mov rcx, rbx
call fcn.18003081c
cmp r14, r15
je 0x1800b156d
mov rcx, r14
call fcn.1800aeb30
nop
lea rcx, [rbp + 0x10]
call fcn.18011aff0
xor eax, eax
mov rcx, qword [rbp + 0x40]
xor rcx, rbp
call fcn.18007e1e0
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret