Function at 0x18000bcb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xa70
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
lea rcx, [rbp + 0x19]
call fcn.18000abc0
mov rcx, rax
call fcn.18000a8e0
cdqe
lea rcx, [0x180046010]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x680]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x28
xor ecx, ecx
call qword [rbp + 0x128]
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 0x1a]
lea rcx, [rbp + 0x300]
call fcn.180001f70
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x3c0]
call fcn.180007d90
mov qword [rbp + 0x78], rax
mov r8, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
lea rcx, [rbp + 0x3a0]
call fcn.180002ab0
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.180002630
lea rcx, [rbp + 0x3a0]
call fcn.180009e30
lea rcx, [rbp + 0x3c0]
call fcn.180009e30
lea rcx, [rbp + 0x168]
call fcn.180013120
movzx eax, al
test eax, eax
jne 0x18000c743
lea rcx, [rbp + 0x168]
call fcn.180011760
lea rcx, [rbp + 0x130]
call fcn.1800085d0
lea rcx, [rbp + 0x3e0]
call fcn.1800127a0
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.180008e90
lea rax, [rbp + 0x158]
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x3e0]
call fcn.18000a3d0
lea rax, [rbp + 0x310]
mov qword [rbp + 0x80], rax
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x80]
call fcn.180008e50
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.180010d90
lea rax, [rbp + 0x320]
mov qword [rbp + 0x88], rax
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x88]
call fcn.180008e50
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.180012ea0
jmp 0x18000be6a
lea rcx, [rbp + 0x60]
call fcn.18000aac0
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x60]
call fcn.18000a640
movzx eax, al
test eax, eax
jne 0x18000bfaf
lea rcx, [rbp + 0x60]
call fcn.18000aa80
mov qword [rbp + 0x40], rax
lea rax, [rbp + 2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 3]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 2]
movzx r8d, byte [rbp + 3]
movzx edx, byte [rbp + 0x1b]
lea rcx, [rbp + 0x390]
call fcn.180002140
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0x90], rax
xor r8d, r8d
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x260]
call fcn.180001c20
mov rcx, qword [rbp + 0x40]
call fcn.180014410
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x400]
mov rcx, qword [rbp + 0x98]
call fcn.1800131f0
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.18000a6d0
mov byte [rbp + 4], al
lea rcx, [rbp + 0x400]
call fcn.18000a3d0
lea rcx, [rbp + 0x260]
call fcn.18000a3d0
movzx eax, byte [rbp + 4]
test eax, eax
je 0x18000bfaa
mov rcx, qword [rbp + 0x40]
call fcn.180014410
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x440]
mov rcx, qword [rbp + 0xa0]
call fcn.180013260
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x420]
mov rcx, qword [rbp + 0xa8]
call fcn.1800150b0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1800147b0
lea rcx, [rbp + 0x420]
call fcn.180009e30
lea rcx, [rbp + 0x440]
call fcn.18000a3d0
jmp 0x18000be61
lea rcx, [rbp + 0x148]
call fcn.18000a240
lea rcx, [rbp + 0x60]
call fcn.18000a240
lea rcx, [rbp + 0x158]
call fcn.18000a240
mov r8d, 0x104
lea rdx, [rbp + 0x8a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0x280]
call fcn.180007d90
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x130]
call fcn.1800147b0
lea rcx, [rbp + 0x280]
call fcn.180009e30
lea rcx, [rbp + 0x220]
call fcn.180009720
lea rax, [rbp + 0x130]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call fcn.180004af0
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x48]
call fcn.180010320
mov qword [rbp + 0xb0], rax
jmp 0x18000c059
mov rax, qword [rbp + 0x28]
add rax, 0x20
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0xb0]
cmp qword [rbp + 0x28], rax
je 0x18000c154
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x50], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x2a0]
call fcn.180002630
lea rcx, [rbp + 0x460]
call fcn.1800127a0
lea r8, [rbp + 0x2a0]
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.18000ab80
lea rcx, [rbp + 0x460]
call fcn.18000a3d0
lea rcx, [rbp + 0x2a0]
call fcn.18000a3d0
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x200]
call fcn.180013260
mov r8, rax
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x1e0]
call fcn.18000ab80
lea rcx, [rbp + 0x480]
call fcn.18000a3d0
mov r8d, 2
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x200]
call fcn.1800116e0
lea rdx, [rbp + 0x8a0]
mov rcx, qword [rbp + 0x50]
call fcn.180002a10
movzx eax, al
test eax, eax
je 0x18000c137
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x220]
call fcn.18000a610
lea rcx, [rbp + 0x1e0]
call fcn.18000a3d0
lea rcx, [rbp + 0x200]
call fcn.18000a3d0
jmp 0x18000c04d
lea rax, [rbp + 5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 6]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 5]
movzx r8d, byte [rbp + 6]
movzx edx, byte [rbp + 0x1c]
lea rcx, [rbp + 0x330]
call fcn.180001e00
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x4a0]
call fcn.180007d90
mov qword [rbp + 0xc0], rax
mov r8, qword [rbp + 0xb8]
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x240]
call fcn.180002ab0
lea rcx, [rbp + 0x4a0]
call fcn.180009e30
lea rax, [rbp + 7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 7]
movzx r8d, byte [rbp + 8]
movzx edx, byte [rbp + 0x1d]
lea rcx, [rbp + 0x340]
call fcn.180002320
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0xc8], rax
lea rax, [rbp + 9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xa]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 9]
movzx r8d, byte [rbp + 0xa]
movzx edx, byte [rbp + 0x1e]
lea rcx, [rbp + 0x5c0]
call fcn.180002270
mov rcx, rax
call fcn.180011ad0
lea r8, [rbp + 0x240]
mov rdx, rax
lea rcx, [rbp + 0x4c0]
call fcn.180002af0
mov qword [rbp + 0xd0], rax
mov r8, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x1a8]
call fcn.180002ab0
lea rcx, [rbp + 0x4c0]
call fcn.180009e30
lea rax, [rbp + 0xb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xc]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb]
movzx r8d, byte [rbp + 0xc]
movzx edx, byte [rbp + 0x1f]
lea rcx, [rbp + 0x9c0]
call fcn.180002370
mov rcx, rax
call fcn.1800121d0
mov rdx, rax
lea rcx, [rbp + 0x1a8]
call fcn.18000b190
lea rax, [rbp + 0xd]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xe]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xd]
movzx r8d, byte [rbp + 0xe]
movzx edx, byte [rbp + 0x20]
lea rcx, [rbp + 0x350]
call fcn.180002480
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x500]
lea rcx, [rbp + 0x220]
call fcn.1800150b0
mov qword [rbp + 0xe0], rax
mov r8, qword [rbp + 0xd8]
mov rdx, qword [rbp + 0xe0]
lea rcx, [rbp + 0x4e0]
call fcn.180002ab0
mov rdx, rax
lea rcx, [rbp + 0x1a8]
call fcn.18000b130
lea rcx, [rbp + 0x4e0]
call fcn.180009e30
lea rcx, [rbp + 0x500]
call fcn.180009e30
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x520]
call fcn.180001280
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0x360]
mov rcx, qword [rbp + 0xe8]
call fcn.18000a840
lea rcx, [rbp + 0x1d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x2e0]
call fcn.1800151d0
lea rcx, [rbp + 0x520]
call fcn.180009e30
lea rax, [rbp + 0xf]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xf]
movzx r8d, byte [rbp + 0x10]
movzx edx, byte [rbp + 0x21]
lea rcx, [rbp + 0x600]
call fcn.1800024d0
mov rcx, rax
call fcn.180011ad0
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x30], eax
cmp dword [rbp + 0x30], 0
jne 0x18000c707
lea rax, [rbp + 0x11]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x12]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x11]
movzx r8d, byte [rbp + 0x12]
movzx edx, byte [rbp + 0x22]
lea rcx, [rbp + 0x640]
call fcn.180001d20
mov rcx, rax
call fcn.180011e00
lea r8, [rbp + 0x2e0]
mov rdx, rax
lea rcx, [rbp + 0x540]
call fcn.180002af0
lea r8, [0x180036d40]
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.180002ab0
lea rcx, [rbp + 0x540]
call fcn.180009e30
lea rax, [rbp + 0x13]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x13]
movzx r8d, byte [rbp + 0x14]
movzx edx, byte [rbp + 0x23]
lea rcx, [rbp + 0x370]
call fcn.180001e50
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x15]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x16]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x15]
movzx r8d, byte [rbp + 0x16]
movzx edx, byte [rbp + 0x24]
lea rcx, [rbp + 0x380]
call fcn.180001e00
mov rcx, rax
call fcn.1800117b0
mov qword [rbp + 0xf0], rax
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x580]
call fcn.180007d90
mov qword [rbp + 0xf8], rax
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0x560]
call fcn.180002ab0
mov qword [rbp + 0x108], rax
mov r8, qword [rbp + 0x100]
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.180002ab0
lea rcx, [rbp + 0x560]
call fcn.180009e30
lea rcx, [rbp + 0x580]
call fcn.180009e30
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x790]
call fcn.180007880
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x790]
call fcn.180002990
lea rcx, [rbp + 0x790]
call fcn.180011170
lea rcx, [rbp + 0x188]
call fcn.180014ee0
inc rax
mov dword [rbp + 0x34], eax
lea rcx, [rbp + 0x188]
call fcn.180010e10
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x17]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x18]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x17]
movzx r8d, byte [rbp + 0x18]
movzx edx, byte [rbp + 0x25]
lea rcx, [rbp + 0x5a0]
call fcn.180001ea0
mov rcx, rax
call fcn.1800118f0
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x120], rax
mov eax, dword [rbp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x790]
call fcn.18000b4f0
lea rcx, [rbp + 0x188]
call fcn.180009e30
lea rcx, [rbp + 0x2c0]
call fcn.180009e30
lea rcx, [rbp + 0x2e0]
call fcn.180009e30
lea rcx, [rbp + 0x1a8]
call fcn.180009e30
lea rcx, [rbp + 0x240]
call fcn.180009e30
lea rcx, [rbp + 0x220]
call fcn.18000a3d0
lea rcx, [rbp + 0x130]
call fcn.180009f90
lea rcx, [rbp + 0x168]
call fcn.18000a3d0
add rsp, 0xa70
pop rdi
pop rsi
pop rbp
ret