Function at 0x18000ea70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.18000bc40
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.180002770
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000eaf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eaf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef41
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x10], xmm0
xor edi, edi
mov word [rbp - 0x20], di
call fcn.18000d9a0
test al, al
jne 0x18000ed01
movdqa xmm0, xmmword [0x180040bb0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], dil
lea r8d, [rdi + 5]
lea rdx, str.kantu
lea rcx, [rbp - 0x80]
call fcn.1800022e0
nop
lea rcx, [rbp - 0x40]
call fcn.18000bc40
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.180002770
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180003070
mov rbx, rax
lea rax, [rbp - 0x60]
cmp rax, rbx
je 0x18000ebd9
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18000ebaa
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef47
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040bb0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000ec16
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ec11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef4d
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040bb0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x18000ec64
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ec5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef53
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040bb0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000ecb5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ecb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef59
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x18000ed01
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ecfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef5f
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], di
mov r8d, 7
lea rdx, str.DateExt
lea rcx, [rbp - 0x80]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
mov r8d, 0x18
lea rdx, str.SOFTWAREMicrosoftkantu
lea rcx, [rsp + 0x60]
call fcn.180003d10
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.1800028e0
mov rbx, rax
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2011b
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000edfc
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18000edbf
mov rbx, qword [rbx]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000ee3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef65
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000ee8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef6b
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000eee3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eedd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef71
call fcn.180017cf8
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18000ef1a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ef15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ef3b
call fcn.180017cf8
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180017e90
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
int3
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
int3