Function at 0x180002ff0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [0x180000000]
lea rcx, [r11 - 0x38]
mov rax, qword [rdx + 0x8488]
mov qword [rcx], rax
movzx eax, byte [rdx + 0x8490]
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x8498]
lea rcx, [r11 - 0x28]
mov qword [rcx], rax
movzx eax, word [rdx + 0x84a0]
mov word [rcx + 8], ax
mov eax, dword [rdx + 0x84a4]
lea rcx, [r11 - 0x44]
mov dword [rcx], eax
movzx eax, word [rdx + 0x84a8]
mov word [rcx + 4], ax
call fcn.180002cf0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x64]
mov dword [rsp + 0x50], ebx
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x1800030c1
lea rdx, [rsp + 0x64]
nop word [rax + rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x64]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x1800030a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x18000310a
lea rdx, [rsp + 0x80]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x1800030e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180003151
lea rdx, [rsp + 0x70]
nop dword [rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180003130
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_s
lea rcx, [0x18000c470]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000c470]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800037c4
lea rax, [rsp + 0x60]
lea rdx, [0x18000c470]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800037ad
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbb0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbb4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbb8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbbc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbc0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbc4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000c628]
xor eax, eax
mov rdi, rdx
xor r8d, r8d
repne scasb al, byte [rdi]
lea r9d, [rax + 1]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000bbc8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbcc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbd0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x18000bbd4]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbd8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbdc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000c638]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000bbe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbe4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbe8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbec]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbf0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbf4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x18000c648]
mov rdi, rdx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r9d, [rax + 1]
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000bbf8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bbfc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bc00]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bc04]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bc08]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bc0c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000c658]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000bc10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000bc14]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [0x18000c420]
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x58]
lea rdx, [0x18000bc18]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000c454]
lea rdx, [0x18000bc1c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000c458]
lea rdx, [0x18000bc20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000c45c]
lea rdx, [0x18000bc24]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000c460]
lea rdx, [0x18000bc28]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800037bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1800037d6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800037d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180006ba0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret