Function at 0x180002be0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, [0x180000000]
lea rcx, [r11 - 0x40]
mov rax, qword [rdx + 0x6478]
mov qword [rcx], rax
movzx eax, byte [rdx + 0x6480]
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x6488]
lea rcx, [r11 - 0x20]
mov qword [rcx], rax
mov eax, dword [rdx + 0x6490]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x6494]
mov word [rcx + 0xc], ax
mov rax, qword [rdx + 0x6498]
lea rcx, [r11 - 0x30]
mov qword [rcx], rax
movzx eax, word [rdx + 0x64a0]
mov word [rcx + 8], ax
call fcn.180002a20
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x78]
mov dword [rsp + 0x50], ebx
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002cb1
lea rdx, [rsp + 0x78]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x78]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002c90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002cfa
lea rdx, [rsp + 0x88]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002cd6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002d41
lea rdx, [rsp + 0x68]
nop dword [rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002d20
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, str._s_s_s
lea rcx, [0x18000a430]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a430]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800033b4
lea rax, [rsp + 0x60]
lea rdx, [0x18000a430]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000339d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009ba8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bac]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bb0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bb4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bb8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bbc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a5e8]
xor eax, eax
mov rdi, rdx
xor r8d, r8d
repne scasb al, byte [rdi]
lea r9d, [rax + 1]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009bc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bc4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bc8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x180009bcc]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bd0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bd4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a5f8]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009bd8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bdc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009be0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009be4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009be8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bec]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x18000a608]
mov rdi, rdx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r9d, [rax + 1]
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009bf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bf4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bf8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009bfc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c00]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c04]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a618]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180009c08]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x180009c0c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [0x18000a3e0]
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x58]
lea rdx, [0x180009c10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a414]
lea rdx, [0x180009c14]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a418]
lea rdx, [0x180009c18]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a41c]
lea rdx, [0x180009c1c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000a420]
lea rdx, [0x180009c20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800033ad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1800033c6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800033c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1800054a0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret