Function at 0x180003528
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor esi, esi
xor eax, eax
mov rbx, rdx
and dword [rsp + 0x78], eax
mov edx, 0x7df87476
mov rdi, r8
xor r8d, r8d
cmp ecx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x60], 0x57
lea r12d, [rsi + 4]
mov r13d, 0x119
ja 0x1800038b5
je 0x180003890
mov eax, 0x401c7c9e
cmp ecx, eax
ja 0x180003725
je 0x18000370f
cmp ecx, 0xcb3669a
je 0x1800036bf
cmp ecx, 0xf30cfa9
je 0x18000369b
cmp ecx, 0x1623d945
je 0x180003671
cmp ecx, 0x21969926
je 0x180003653
cmp ecx, 0x26ff9756
je 0x18000360c
cmp ecx, 0x37c26f8b
je 0x1800035f4
cmp ecx, 0x3d00c328
jne 0x1800039d1
lea eax, [rsi + 0x10]
movzx r8d, word [0x180025ff4]
mov ecx, dword [0x180025ff0]
and r8w, 0xffef
or r8w, ax
xor edx, edx
jmp 0x180003622
mov ecx, 0x118
xor edx, edx
mov r9, rdi
call fcn.18000fe04
mov dword [rsp + 0x60], eax
jmp 0x180003b80
test rbx, rbx
je 0x180003b87
movzx r8d, word [0x180025ff4]
mov rdx, rbx
xor ecx, ecx
mov r9b, 0xff
mov byte [rsp + 0x20], r9b
call fcn.18000522c
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x180003b87
lea rdx, [rsp + 0x60]
mov r9, rdi
mov r8d, r12d
mov ecx, r13d
call fcn.18000fe04
jmp 0x180003b80
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbx
mov edx, eax
call fcn.18000e648
jmp 0x18000362f
lea rax, [0x18002941f]
mov edx, 0xb
mov ecx, 0x112
lea r9, [0x180029c49]
mov r8d, 0x10000
mov qword [rsp + 0x20], rax
call fcn.180004418
jmp 0x18000362f
test rbx, rbx
je 0x180003b87
mov edx, 0x10f
mov r8d, 1
mov r9, rdi
mov rcx, rbx
call fcn.180002650
jmp 0x180003603
test rbx, rbx
je 0x180003b87
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov r9d, 1
mov rcx, rbx
call fcn.1800044d0
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003a6f
mov ecx, 0x105
mov rsi, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x78]
mov r9, rdi
mov rdx, rsi
call fcn.18000fe04
mov dword [rsp + 0x60], eax
jmp 0x180003b69
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call fcn.180002c9c
jmp 0x18000362f
cmp ecx, 0x440c113f
je 0x18000386d
cmp ecx, 0x471a9bd7
je 0x180003857
cmp ecx, 0x4d620095
je 0x18000384d
cmp ecx, 0x5980ca6f
je 0x180003816
cmp ecx, 0x5bba381a
je 0x18000380c
cmp ecx, 0x62aa9f62
je 0x18000377f
cmp ecx, 0x69e38da6
jne 0x1800039d1
mov ecx, 0x10c
jmp 0x1800035f9
test rbx, rbx
je 0x1800039d1
lea rcx, [0x180026b00]
mov rdx, rbx
call fcn.1800076f8
test eax, eax
mov esi, eax
jne 0x1800037e8
mov rdx, qword [0x180026820]
lea r8, [rsp + 0x78]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, eax
jne 0x1800037e8
and dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x78]
and qword [rsp + 0x20], 0
lea r9d, [rax + 3]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov dword [rsp + 0x60], esi
jne 0x1800039d1
lea rdx, [rsp + 0x60]
mov r9, rdi
mov r8d, r12d
mov ecx, r13d
call fcn.18000fe04
jmp 0x1800039d1
mov ecx, 0x109
jmp 0x1800035f9
test rbx, rbx
je 0x180003b87
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov r9d, 1
mov rcx, rbx
call fcn.1800044d0
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003a6f
mov ecx, 0x107
jmp 0x1800036f1
call fcn.180006c18
jmp 0x18000362f
lea rax, [0x18002941b]
mov edx, 8
mov ecx, 0x10e
jmp 0x180003682
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
and dword [rsp + 0x60], esi
jmp 0x18000363b
mov r8d, 1
test rbx, rbx
je 0x180003b87
neg r8d
sbb edx, edx
and edx, 8
add edx, 0x10f
xor r8d, r8d
jmp 0x1800036af
mov edx, 0xbb140c62
cmp ecx, edx
ja 0x180003989
je 0x180003896
cmp ecx, 0x8dc05229
je 0x18000397f
cmp ecx, 0x8dd7aafe
je 0x180003975
cmp ecx, 0x98e70129
je 0x18000395f
cmp ecx, 0x9ceda5b8
je 0x180003937
cmp ecx, 0xa195d165
je 0x18000392d
cmp ecx, 0xae5c2259
je 0x1800035d8
cmp ecx, 0xb9baf2af
jne 0x1800039d1
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbx
mov edx, eax
call fcn.18000e468
jmp 0x18000362f
mov ecx, 0x124
jmp 0x1800035f9
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, 1
mov rdx, rbx
add r8d, eax
mov ecx, 0x102
jmp 0x1800035fb
test rbx, rbx
je 0x180003b87
mov rcx, rbx
call fcn.180001da8
jmp 0x180003603
mov ecx, 0x108
jmp 0x1800035f9
mov ecx, 0x103
jmp 0x1800035f9
cmp ecx, 0xbd99c429
je 0x180003b2b
cmp ecx, 0xd11e7a2d
je 0x180003b21
cmp ecx, 0xda133f00
je 0x180003a79
cmp ecx, 0xeda409a4
je 0x180003a3c
cmp ecx, 0xeec85bef
je 0x180003a32
cmp ecx, 0xf190093c
je 0x180003a02
cmp ecx, 0xf40acb61
je 0x1800039e1
mov r8d, 1
mov dword [rsp + 0x60], r8d
jmp 0x180003b87
test rbx, rbx
je 0x1800039f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov r8d, eax
mov rdx, rbx
mov ecx, 0x123
jmp 0x1800035fb
test rbx, rbx
je 0x180003b87
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov rcx, rbx
call fcn.1800044d0
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003a6f
mov ecx, 0x122
jmp 0x1800036f1
mov ecx, 0x10a
jmp 0x1800035f9
test rbx, rbx
je 0x180003b87
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov r9d, 1
mov rcx, rbx
call fcn.1800044d0
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003a6f
mov ecx, 0x106
jmp 0x1800036f1
mov rsi, qword [rsp + 0x30]
jmp 0x180003b69
movzx r8d, word [0x180025ff4]
mov ecx, dword [0x180025ff0]
mov r9b, 0xff
xor edx, edx
or r8w, 8
mov byte [rsp + 0x20], 0xff
call fcn.18000522c
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003b87
mov rcx, qword [0x180026728]
lea r8d, [rax + 1]
xor edx, edx
call fcn.180005b18
test rax, rax
mov rbx, rax
je 0x180003b16
mov ecx, dword [0x180026028]
and dword [rsp + 0x28], esi
and qword [rsp + 0x20], rsi
imul rcx, rcx, 0xffffffffff676980
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x180003afa
and dword [rsp + 0x60], esi
jmp 0x180003b04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
jmp 0x180003633
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000362f
mov ecx, 0x10b
jmp 0x1800035f9
movzx r8d, word [0x180025ff4]
mov ecx, dword [0x180025ff0]
mov r9b, 0xff
xor edx, edx
and r8w, 0xfff7
mov byte [rsp + 0x20], 0xff
call fcn.18000522c
test eax, eax
mov dword [rsp + 0x60], eax
jne 0x180003b87
lea rdx, [rsp + 0x60]
mov r9, rdi
mov r8d, r12d
mov ecx, r13d
call fcn.18000fe04
test rsi, rsi
je 0x180003b80
mov rcx, qword [0x1800266d0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0x60], 0
je 0x180003b9a
lea rdx, [rsp + 0x60]
mov r9, rdi
mov r8d, r12d
mov ecx, r13d
call fcn.18000fe04
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret