Function at 0x180009240
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov qword [rsp + 0x130], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov r14, rdx
mov r15d, 1
mov qword [r11 - 0x130], 0xf
xor esi, esi
mov qword [r11 - 0x138], rsi
mov byte [rsp + 0xc0], sil
lea r8d, [r15 + 0xa]
lea rdx, str.wfcSendFile
lea rcx, [r11 - 0x150]
call fcn.18000f0f0
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.180004280
nop
cmp qword [rsp + 0xd8], 0x10
jb 0x1800092e5
mov rcx, qword [rsp + 0xc0]
call fcn.18009a864
mov qword [rsp + 0xd8], socket
mov qword [rsp + 0xd0], rsi
mov byte [rsp + 0xc0], 0
mov rcx, qword [rsp + 0x50]
sub rcx, qword [rsp + 0x48]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180009330
mov r15d, esi
jmp 0x1800098af
mov r12, qword [r14 + 0x18]
cmp r12, qword [r14 + 0x20]
jbe 0x18000933f
call fcn.18009a80c
mov r13, qword [r14]
mov rbx, qword [r14 + 0x20]
cmp qword [r14 + 0x18], rbx
jbe 0x180009351
call fcn.18009a80c
test r13, r13
je 0x18000935b
cmp r13, qword [r14]
je 0x180009360
call fcn.18009a80c
cmp r12, rbx
je 0x1800098af
test r13, r13
jne 0x180009378
call fcn.18009a80c
mov r11, rsi
jmp 0x18000937c
mov r11, qword [r13]
cmp r12, qword [r11 + 0x20]
jb 0x180009387
call fcn.18009a80c
lea rdx, [r12 + 8]
cmp qword [rdx + 0x18], 8
jb 0x180009396
mov rdx, qword [rdx]
lea rcx, [rsp + 0x188]
call fcn.180003f40
nop
cmp qword [rsp + 0x1a0], 0
je 0x180009855
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
jbe 0x1800093c4
call fcn.18009a80c
mov rbp, qword [rsp + 0x30]
nop dword [rax]
mov rdi, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rdi
jbe 0x1800093e1
call fcn.18009a80c
test rbp, rbp
je 0x1800093ed
cmp rbp, qword [rsp + 0x30]
je 0x1800093f2
call fcn.18009a80c
cmp rbx, rdi
je 0x180009838
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x68], 0
mov r8d, 4
lea rdx, str.hash
lea rcx, [rsp + 0x60]
call fcn.18000f0f0
nop
mov qword [rsp + 0x100], socket
mov qword [rsp + 0xf8], rsi
mov byte [rsp + 0xe8], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xe0]
call fcn.18000f0f0
test rbp, rbp
jne 0x18000946b
call fcn.18009a80c
mov r11, rsi
jmp 0x18000946f
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x20]
jb 0x18000947a
call fcn.18009a80c
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x1b0]
call fcn.180001940
nop
cmp qword [rsp + 0x80], 0x10
jb 0x1800094ad
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov qword [rsp + 0x80], socket
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x68], 0
mov qword [rsp + 0xa8], socket
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
mov r8d, 4
lea rdx, str.proc
lea rcx, [rsp + 0x88]
call fcn.18000f0f0
nop
mov qword [rsp + 0x158], socket
mov qword [rsp + 0x150], rsi
mov byte [rsp + 0x140], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x138]
call fcn.18000f0f0
test rbp, rbp
jne 0x18000953c
call fcn.18009a80c
mov r11, rsi
jmp 0x180009540
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x20]
jb 0x18000954b
call fcn.18009a80c
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x88]
mov rdx, rbx
lea rcx, [rsp + 0x108]
call fcn.180001940
nop
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.180001500
nop
cmp qword [rsp + 0x128], 0x10
jb 0x180009595
mov rcx, qword [rsp + 0x110]
call fcn.18009a864
mov qword [rsp + 0x128], socket
mov qword [rsp + 0x120], rsi
mov byte [rsp + 0x110], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x1800095c9
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0xa8], socket
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
lea rdx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 0x10
cmovae rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0x10
cmovae rcx, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
mov r8, rdi
mov rsi, qword [rsp + 0x1c8]
cmp rsi, rdi
cmovb r8, rsi
call fcn.1800a4090
movsxd rcx, eax
test eax, eax
jne 0x18000964c
cmp rsi, rdi
jb 0x18000968d
cmp rsi, rdi
setne al
mov ecx, eax
test ecx, ecx
jne 0x18000968d
cmp qword [rsp + 0x180], 8
jb 0x18000966a
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x180009695
jmp 0x180009672
lea rcx, [rsp + 0x168]
lea rdx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180009702
mov rcx, qword [rsp + 0x168]
jmp 0x180009695
mov rcx, qword [rsp + 0x168]
cmp qword [rsp + 0x180], 8
jb 0x1800096a5
call fcn.18009a864
mov qword [rsp + 0x180], 7
xor esi, esi
mov qword [rsp + 0x178], rsi
mov word [rsp + 0x168], si
cmp qword [rsp + 0x1d0], 0x10
jb 0x1800096db
mov rcx, qword [rsp + 0x1b8]
call fcn.18009a864
test rbp, rbp
jne 0x1800096ea
call fcn.18009a80c
mov r11, rsi
jmp 0x1800096ee
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x20]
jb 0x1800096f9
call fcn.18009a80c
add rbx, 0x28
jmp 0x1800093d0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xe0]
call fcn.180001500
mov rbx, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009740
call rax
jmp 0x180009748
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
cmp qword [rbx + 0x20], 8
jb 0x180009755
mov r8, qword [rbx + 8]
jmp 0x180009759
lea r8, [rbx + 8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_banfilesent_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x100], 8
jb 0x1800097aa
mov rcx, qword [rsp + 0xe8]
call fcn.18009a864
nop
cmp qword [rsp + 0x180], 8
jb 0x1800097c2
mov rcx, qword [rsp + 0x168]
call fcn.18009a864
mov qword [rsp + 0x180], 7
xor esi, esi
mov qword [rsp + 0x178], rsi
mov word [rsp + 0x168], si
cmp qword [rsp + 0x1d0], 0x10
jb 0x1800097f9
mov rcx, qword [rsp + 0x1b8]
call fcn.18009a864
nop
cmp qword [rsp + 0x1a8], 0x10
jb 0x180009811
mov rcx, qword [rsp + 0x190]
call fcn.18009a864
test r13, r13
jne 0x180009820
call fcn.18009a80c
mov r11, rsi
jmp 0x180009824
mov r11, qword [r13]
cmp r12, qword [r11 + 0x20]
jb 0x18000982f
call fcn.18009a80c
add r12, 0x28
jmp 0x180009342
mov r15d, esi
cmp qword [rsp + 0x1a8], 0x10
jb 0x1800098af
mov rcx, qword [rsp + 0x190]
call fcn.18009a864
jmp 0x1800098af
test r13, r13
jne 0x180009864
call fcn.18009a80c
mov r11, rsi
jmp 0x180009868
mov r11, qword [r13]
cmp r12, qword [r11 + 0x20]
jb 0x180009873
call fcn.18009a80c
cmp qword [r12 + 0x20], 8
jb 0x180009882
mov rdx, qword [r12 + 8]
jmp 0x180009887
lea rdx, [r12 + 8]
lea rcx, str.wfAttachmentHash_failed:__s
call fcn.18005c5d0
mov r15d, esi
cmp qword [rsp + 0x1a8], 0x10
jb 0x1800098af
mov rcx, qword [rsp + 0x190]
call fcn.18009a864
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1800098de
mov rdi, qword [rsp + 0x50]
cmp rbx, rdi
je 0x1800098d4
mov rcx, rbx
call fcn.180066210
add rbx, 0x28
cmp rbx, rdi
jne 0x1800098c3
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov rcx, qword [rsp + 0x30]
call fcn.18009a864
mov eax, r15d
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret