Function at 0x18001da68
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
mov r15d, r9d
mov r12, r8
mov r14, rdx
mov rdi, rcx
cmp qword [r8 + 0x10], rbx
je 0x18001daae
call fcn.18001ecf4
test al, al
jne 0x18001daae
xor al, al
jmp 0x18001ddf6
mov r13d, dword [rbp + 0x60]
cmp r13d, 0xe1000
jae 0x18001db6f
mov rcx, qword [rbp + 0x50]
lea eax, [r13 + 0xc]
mov edx, 8
mov qword [rbp - 0x18], rcx
mov rcx, qword [rdi + 8]
mov r8d, eax
mov dword [rbp - 0x20], r15d
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x30], r15d
mov dword [rbp - 0x28], eax
mov dword [rbp - 0x2c], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18001daa7
lea rdx, [rbp - 0x30]
mov r8d, 0xc
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
mov rdx, qword [rbp + 0x58]
lea rcx, [rsi + 0xc]
mov r8d, r13d
call qword [sym.imp.msvcrt.dll_memcpy]
mov r11d, dword [rbp - 0x28]
mov rdx, qword [rbp + 0x50]
mov dword [rsp + 0x28], r11d
mov r9d, 3
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18001db59
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001daa7
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
jne 0x18001dde5
jmp 0x18001ddce
mov ecx, 0x91a2b3c5
mov r8d, 0xe100c
mov eax, ecx
mul r13d
mov eax, r13d
shr edx, 0x13
imul edx, edx, 0xe1000
sub eax, edx
sub r13d, eax
mov dword [rbp - 0x4c], eax
mov eax, ecx
mov rcx, qword [rdi + 8]
mul r13d
mov r13d, edx
mov edx, 8
shr r13d, 0x13
mov dword [rbp - 0x48], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18001daa7
mov eax, ebx
mov dword [rbp + 0x40], ebx
test r13d, r13d
je 0x18001dcd8
mov dword [rbp - 0x50], ebx
lea rdx, [rbp - 0x30]
mov r8d, 0xc
mov rcx, rsi
mov dword [rbp - 0x30], r15d
mov dword [rbp - 0x28], 0xe100c
mov dword [rbp - 0x2c], eax
call qword [sym.imp.msvcrt.dll_memcpy]
mov edx, dword [rbp - 0x50]
lea rcx, [rsi + 0xc]
add rdx, qword [rbp + 0x58]
mov r8d, 0xe1000
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rdi + 8]
mov edx, 8
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x18001daa7
mov r9, qword [rbp + 0x50]
lea rcx, [0x18003bf08]
lea r8, str._s_d_s
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x40]
mov edx, 0x400
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov r11d, dword [rbp - 0x28]
mov rdx, qword [rbp - 0x40]
mov dword [rsp + 0x28], r11d
mov r9d, 3
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18001dd9b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
jne 0x18001dd9b
mov eax, dword [rbp + 0x40]
mov r8, qword [r12 + 8]
lea r9, [rbp - 0x20]
mov dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov rcx, r12
mov dword [rbp - 0x20], r15d
mov dword [rbp - 0x1c], 0xe100c
mov qword [rbp - 0x18], rax
call fcn.180020fb4
mov eax, dword [rbp + 0x40]
add dword [rbp - 0x50], 0xe1000
inc eax
mov dword [rbp + 0x40], eax
cmp eax, r13d
jb 0x18001dbcf
mov eax, dword [rbp - 0x4c]
test eax, eax
je 0x18001dde3
add eax, 0xc
lea rdx, [rbp - 0x30]
mov r8d, 0xc
mov rcx, rsi
mov dword [rbp - 0x30], r15d
mov dword [rbp - 0x2c], r13d
mov dword [rbp + 0x40], eax
mov dword [rbp - 0x28], eax
call qword [sym.imp.msvcrt.dll_memcpy]
mov r8d, dword [rbp - 0x4c]
mov edx, r13d
lea rcx, [rsi + 0xc]
imul edx, edx, 0xe1000
add rdx, qword [rbp + 0x58]
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rdi + 8]
mov edx, 8
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x18001daa7
mov r9, qword [rbp + 0x50]
lea rax, [0x18003bf08]
lea r8, str._s_d_s
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x48]
mov edx, 0x400
mov rcx, r13
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov r11d, dword [rbp - 0x28]
mov r9d, 3
mov dword [rsp + 0x28], r11d
xor r8d, r8d
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18001ddad
mov r8, r13
jmp 0x18001dd9f
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001dde5
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
jne 0x18001dd96
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x20], r15d
mov qword [rbp - 0x18], r13
mov dword [rbp - 0x10], eax
mov eax, dword [rbp + 0x40]
mov dword [rbp - 0x1c], eax
mov r8, qword [r12 + 8]
lea r9, [rbp - 0x20]
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.180020fb4
mov bl, 1
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret