Function at 0x180002d00
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, [0x180000000]
lea rcx, [r11 - 0x40]
mov rax, qword [rdx + 0x7480]
mov qword [rcx], rax
movzx eax, byte [rdx + 0x7488]
mov byte [rcx + 8], al
mov rax, qword [rdx + 0x7490]
lea rcx, [r11 - 0x20]
mov qword [rcx], rax
mov eax, dword [rdx + 0x7498]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x749c]
mov word [rcx + 0xc], ax
mov rax, qword [rdx + 0x74a0]
lea rcx, [r11 - 0x30]
mov qword [rcx], rax
movzx eax, word [rdx + 0x74a8]
mov word [rcx + 8], ax
call fcn.180002b40
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x78]
mov dword [rsp + 0x50], ebx
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002dd1
lea rdx, [rsp + 0x78]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x78]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002db0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002e1a
lea rdx, [rsp + 0x88]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x88]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002df6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
repne scasb al, byte [rdi]
mov r8d, ebx
not rcx
dec rcx
test ecx, ecx
jle 0x180002e61
lea rdx, [rsp + 0x68]
nop dword [rax]
add byte [rdx], 7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x68]
inc r8d
inc rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp r8d, ecx
jl 0x180002e40
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, str._s_s_s
lea rcx, [0x18000ac60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x58]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000ac60]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800034d4
lea rax, [rsp + 0x60]
lea rdx, [0x18000ac60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800034bd
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3dc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3e0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3e4]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3e8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3ec]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3f0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000ae18]
xor eax, eax
mov rdi, rdx
xor r8d, r8d
repne scasb al, byte [rdi]
lea r9d, [rax + 1]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a3f4]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3f8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a3fc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x18000a400]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a404]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a408]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000ae28]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a40c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a410]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a414]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a418]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a41c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a420]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x18000ae38]
mov rdi, rdx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r9d, [rax + 1]
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a424]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a428]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a42c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a430]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a434]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a438]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or rcx, 0xffffffffffffffff
lea rdx, [0x18000ae48]
xor eax, eax
xor r8d, r8d
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000a43c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18000a440]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [0x18000ac10]
mov rdi, rdx
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x58]
lea rdx, [0x18000a444]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000ac44]
lea rdx, [0x18000a448]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000ac48]
lea rdx, [0x18000a44c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000ac4c]
lea rdx, [0x18000a450]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [0x18000ac50]
lea rdx, [0x18000a454]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800034cd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1800034e6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800034e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180005d30
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret