Function at 0x100084c0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
mov rax, qword [rcx]
lea rbp, [rsp + 0x50]
mov r14, rdx
mov rdx, r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x1f0], rcx
mov rcx, rbp
mov rbx, r8
mov edi, r9d
mov qword [rsp + 0x58], 0
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x100088a7
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov ecx, 0x100
xor esi, esi
mov qword [rsp + 0x38], rax
call rax
mov r15, qword [sym.imp.kernel32.dll_lstrcmpiW]
mov qword [rsp + 0x60], rax
mov rax, qword [0x10011370]
mov qword [rsp + 0x68], rax
jmp 0x10008654
mov rcx, qword [rbx]
lea rdx, str.ForceRemove
mov esi, 3
call r15
test eax, eax
jne 0x100088c0
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008870
test byte [0x1000d050], 8
jne 0x100086e0
test edi, edi
je 0x10008688
mov r12, qword [rbx]
cmp esi, 2
je 0x10008c28
cmp esi, 4
je 0x10008bb8
cmp esi, 3
je 0x10008e20
mov rdx, r12
lea r8, [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
mov r12d, eax
test eax, eax
jne 0x10009667
mov rdx, qword [rsp + 0x50]
cmp word [rdx], 0x3d
je 0x10008958
lea eax, [rsi - 2]
and eax, 0xfffffffd
cmp esi, 2
setne r13b
test eax, eax
je 0x100085f6
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x7b
je 0x10008b68
test byte [0x1000d050], 8
jne 0x100086b2
test edi, edi
jne 0x10008618
test esi, esi
je 0x10008828
cmp esi, 3
je 0x10008828
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1000862d
test r13b, r13b
je 0x1000862d
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x6c], 0
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008877
mov rcx, qword [rbx]
cmp word [rcx + 2], 0
jne 0x10008668
cmp word [rcx], 0x7d
je 0x10008870
lea rdx, str.NoRemove
call r15
test eax, eax
jne 0x10008548
mov esi, 1
jmp 0x10008562
lea eax, [rsi - 2]
test eax, 0xfffffffd
jne 0x10008900
cmp esi, 4
jne 0x10008be0
mov r13d, 1
test byte [0x1000d050], 8
je 0x10008603
mov dword [rsp + 0x28], esi
lea r9, str._x__x_n
lea r8, str.do_process_key
mov ecx, 3
mov dword [rsp + 0x20], edi
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10008603
mov r12, qword [rbx]
lea rax, str._null_
test r12, r12
je 0x100087f9
mov rax, r12
shr rax, 0x10
je 0x10008c58
mov rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x100087f9
cmp word [r12], 0
je 0x10008cb0
xor eax, eax
nop dword [rax]
mov ecx, eax
add rax, 1
cmp word [r12 + rax*2], 0
jne 0x10008738
mov edx, 0x224c
lea r8, [rsp + 0x192]
mov word [rsp + 0x70], dx
lea rdx, [rsp + 0x72]
jmp 0x1000878f
cmp ax, 9
je 0x10008b38
cmp ax, 0xa
jne 0x10008abf
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
lea eax, [rcx - 1]
cmp rdx, r8
ja 0x100087d0
test ecx, ecx
jle 0x100087d0
mov ecx, eax
movzx eax, word [r12]
add r12, 2
cmp ax, 0xd
je 0x10008b50
jbe 0x10008760
cmp ax, 0x22
je 0x10008b20
cmp ax, 0x5c
jne 0x10008ab0
mov r9d, 0x5c5c
add rdx, 2
lea eax, [rcx - 1]
mov word [rdx - 2], r9w
cmp rdx, r8
jbe 0x10008789
nop
mov byte [rdx], 0x22
test eax, eax
jle 0x10008cc4
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov qword [rsp + 0x20], rax
lea r9, str.name___s_n
lea r8, str.do_process_key
mov ecx, 3
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10008585
mov r12, qword [rsp + 0x60]
test byte [0x1000d050], 8
jne 0x10008cd0
mov rdx, r12
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegDeleteKeyW]
jmp 0x10008618
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test eax, eax
jns 0x100093fb
nop word cs:[rax + rax]
cmp esi, 2
setne r13b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ucrtbase.dll_free]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10008897
test r13b, r13b
je 0x10008897
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x1f0]
mov qword [rdi], rax
mov eax, r12d
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx]
lea rdx, [0x10010a8e]
mov esi, 2
call r15
test eax, eax
je 0x10008562
mov rcx, qword [rbx]
lea rdx, str.Delete
mov esi, 4
call r15
test eax, eax
je 0x10008562
xor esi, esi
jmp 0x10008578
mov rcx, qword [rbx]
lea rdx, [rsp + 0x60]
mov r8d, 0xffffffff
call fcn.10007af0
mov rdx, qword [rbx]
lea r8, [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
mov r12d, eax
test eax, eax
je 0x10008938
test byte [0x1000d050], 4
jne 0x10008f88
mov rax, qword [rsp + 0x50]
cmp esi, 2
setne r13b
cmp word [rax], 0x3d
mov rdx, rax
jne 0x100085ec
nop dword [rax]
add rdx, 2
mov rcx, rbp
mov qword [rsp + 0x50], rdx
mov rdx, rbx
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008870
cmp dword [rbx + 0xc], 1
jne 0x10009761
test edi, edi
je 0x10008c80
mov r11, qword [rbx]
movzx eax, word [r11]
cmp ax, 0x64
je 0x10009288
cmp ax, 0x73
je 0x10009320
cmp ax, 0x62
je 0x10008850
cmp esi, 2
mov r12d, 0x80020009
setne r13b
test byte [0x1000d050], 4
je 0x10008877
mov rax, r11
shr rax, 0x10
je 0x10009934
mov qword [rsp + 0x38], r11
mov rdx, 0xffffffffffffffff
mov rcx, r11
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x100096bd
mov r11, qword [rsp + 0x38]
cmp word [r11], 0
je 0x100099e0
xor eax, eax
nop
mov ecx, eax
add rax, 1
cmp word [r11 + rax*2], 0
jne 0x10008a10
mov eax, 0x224c
lea rdx, [rsp + 0x72]
lea r8, [rsp + 0x192]
mov word [rsp + 0x70], ax
lea r9, str.0123456789abcdefRegistrar_ResourceUnregister
jmp 0x10008a76
cmp ax, 9
je 0x10009878
cmp ax, 0xa
jne 0x10009899
mov ebp, 0x6e5c
add rdx, 2
mov word [rdx - 2], bp
nop
lea eax, [rcx - 1]
cmp rdx, r8
ja 0x10009694
test ecx, ecx
jle 0x10009694
mov ecx, eax
movzx eax, word [r11]
add r11, 2
cmp ax, 0xd
je 0x10009866
jbe 0x10008a3e
cmp ax, 0x22
je 0x100098ef
cmp ax, 0x5c
jne 0x1000988a
mov r10d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x10008a60
lea r9d, [rax - 0x20]
cmp r9w, 0x5e
jbe 0x10008c70
mov r9d, eax
lea r10, str.0123456789abcdefRegistrar_ResourceUnregister
mov byte [rdx], 0x5c
add rdx, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r10 + r9]
mov byte [rdx - 4], r9b
mov r9d, eax
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r10 + r9]
mov byte [rdx - 3], r9b
mov r9d, eax
and eax, 0xf
shr r9w, 4
movzx eax, byte [r10 + rax]
and r9d, 0xf
movzx r9d, byte [r10 + r9]
mov byte [rdx - 1], al
mov byte [rdx - 2], r9b
jmp 0x10008781
mov r10d, 0x225c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x10008781
mov r11d, 0x745c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x10008781
mov r13d, 0x725c
add rdx, 2
mov word [rdx - 2], r13w
jmp 0x10008781
movzx ecx, word [rax + 2]
call qword [sym.imp.ucrtbase.dll_iswspace]
test eax, eax
je 0x100085f6
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008877
mov rdx, qword [rsp + 0x58]
mov r9d, edi
mov r8, rbx
mov rcx, rbp
call fcn.100084c0
mov r12d, eax
test eax, eax
jns 0x100085f6
jmp 0x10008877
test byte [0x1000d050], 8
jne 0x10008e38
mov rdx, r12
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
jmp 0x1000869f
mov rdx, qword [rsp + 0x50]
cmp word [rdx], 0x3d
je 0x10008958
cmp esi, 2
jne 0x100085d9
nop dword [rax + rax]
test byte [0x1000d050], 4
jne 0x10009643
mov rcx, qword [rsp + 0x60]
mov r12d, 0x80020009
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x10008897
lea rdx, [rsp + 0x60]
mov r8d, 0xffffffff
mov rcx, r12
mov qword [rsp + 0x58], r14
call fcn.10007af0
mov rdx, qword [rsp + 0x50]
cmp word [rdx], 0x3d
je 0x10008958
jmp 0x10008c00
movzx edx, r12w
lea rcx, str._04x
call fcn.10007a80
jmp 0x100087f9
mov byte [rdx], al
add rdx, 1
jmp 0x10008781
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x2d
jne 0x10008c94
add rax, 2
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test r12d, r12d
jns 0x100085d6
jmp 0x10008870
mov eax, 0x224c
mov byte [rsp + 0x72], 0x22
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], ax
lea rax, [rdx + 1]
jmp 0x100087ec
lea rax, str._null_
test r12, r12
je 0x10008de9
mov rax, r12
shr rax, 0x10
je 0x10009260
mov rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x10008de9
cmp word [r12], 0
je 0x100093cc
xor eax, eax
nop
mov ecx, eax
add rax, 1
cmp word [r12 + rax*2], 0
jne 0x10008d20
mov eax, 0x224c
lea rdx, [rsp + 0x72]
lea r8, [rsp + 0x192]
mov word [rsp + 0x70], ax
jmp 0x10008d86
cmp ax, 9
je 0x100090c0
cmp ax, 0xa
jne 0x100090e3
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
nop dword [rax]
lea eax, [rcx - 1]
cmp rdx, r8
ja 0x10008dc0
test ecx, ecx
jle 0x10008dc0
mov ecx, eax
movzx eax, word [r12]
add r12, 2
cmp ax, 0xd
je 0x100090a8
jbe 0x10008d50
cmp ax, 0x22
je 0x10009140
cmp ax, 0x5c
jne 0x100090d4
mov r9d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r9w
jmp 0x10008d78
mov byte [rdx], 0x22
test eax, eax
jle 0x100093e0
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov qword [rsp + 0x20], rax
lea r9, str.Deleting__s_n
lea r8, str.do_process_key
mov ecx, 3
lea rdx, [0x1000d050]
call fcn.10007e00
mov r12, qword [rsp + 0x60]
jmp 0x1000883a
mov rdx, r12
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov r12, qword [rbx]
jmp 0x100085ab
lea rax, str._null_
test r12, r12
je 0x10008f59
mov rax, r12
shr rax, 0x10
je 0x10009090
mov rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x10008f59
cmp word [r12], 0
je 0x10009624
xor eax, eax
nop word cs:[rax + rax]
mov ecx, eax
add rax, 1
cmp word [r12 + rax*2], 0
jne 0x10008e90
mov r11d, 0x224c
lea rdx, [rsp + 0x72]
lea r8, [rsp + 0x192]
mov word [rsp + 0x70], r11w
jmp 0x10008ef6
cmp ax, 9
je 0x10009248
cmp ax, 0xa
jne 0x100091b8
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
nop dword [rax]
lea eax, [rcx - 1]
test ecx, ecx
jle 0x10008f30
cmp rdx, r8
ja 0x10008f30
mov ecx, eax
movzx eax, word [r12]
add r12, 2
cmp ax, 0xd
je 0x10009230
jbe 0x10008ec0
cmp ax, 0x22
je 0x10009218
cmp ax, 0x5c
jne 0x100091a9
mov r9d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r9w
jmp 0x10008ee8
mov byte [rdx], 0x22
test eax, eax
jle 0x1000963a
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov qword [rsp + 0x20], rax
lea r9, str.Deleting__s_n
lea r8, str.do_process_key
mov ecx, 3
lea rdx, [0x1000d050]
call fcn.10007e00
mov r12, qword [rbx]
jmp 0x10008bc5
mov r13, qword [rsp + 0x60]
lea rax, str._null_
test r13, r13
je 0x1000917b
mov rax, r13
shr rax, 0x10
je 0x10009604
mov rdx, 0xffffffffffffffff
mov rcx, r13
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x1000917b
cmp word [r13], 0
je 0x10009154
xor eax, eax
nop dword [rax + rax]
mov ecx, eax
add rax, 1
cmp word [r13 + rax*2], 0
jne 0x10008fe0
mov r8d, 0x224c
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], r8w
lea r8, [rsp + 0x192]
jmp 0x1000904e
cmp ax, 9
je 0x100095b8
cmp ax, 0xa
jne 0x10009525
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
nop dword [rax]
lea eax, [rcx - 1]
test ecx, ecx
jle 0x100095e1
cmp rdx, r8
ja 0x100095e1
mov ecx, eax
movzx eax, word [r13]
add r13, 2
cmp ax, 0xd
je 0x100095a0
jbe 0x10009010
cmp ax, 0x22
je 0x10009588
cmp ax, 0x5c
jne 0x10009516
mov eax, 0x5c5c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x10009038
movzx edx, r12w
lea rcx, str._04x
call fcn.10007a80
jmp 0x10008f59
mov eax, 0x725c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x10008d78
mov r11d, 0x745c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x10008d78
lea r9d, [rax - 0x20]
cmp r9w, 0x5e
jbe 0x10009278
mov r9d, eax
lea r11, str.0123456789abcdefRegistrar_ResourceUnregister
mov byte [rdx], 0x5c
add rdx, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 4], r9b
mov r9d, eax
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 3], r9b
mov r9d, eax
and eax, 0xf
shr r9w, 4
movzx eax, byte [r11 + rax]
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 1], al
mov byte [rdx - 2], r9b
jmp 0x10008d78
mov r10d, 0x225c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x10008d78
mov r9d, 0x224c
mov byte [rsp + 0x72], 0x22
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], r9w
lea rax, [rdx + 1]
mov byte [rax], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov dword [rsp + 0x28], r12d
lea r9, str.Could_not_open_key__s:__08lx_n
lea r8, str.do_process_key
mov ecx, 2
mov qword [rsp + 0x20], rax
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10008938
lea r9d, [rax - 0x20]
cmp r9w, 0x5e
jbe 0x100093f0
mov r9d, eax
lea r11, str.0123456789abcdefRegistrar_ResourceUnregister
mov byte [rdx], 0x5c
add rdx, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 4], r9b
mov r9d, eax
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 3], r9b
mov r9d, eax
and eax, 0xf
shr r9w, 4
movzx eax, byte [r11 + rax]
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 1], al
mov byte [rdx - 2], r9b
jmp 0x10008ee8
mov r10d, 0x225c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x10008ee8
mov r13d, 0x725c
add rdx, 2
mov word [rdx - 2], r13w
jmp 0x10008ee8
mov r11d, 0x745c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x10008ee8
movzx edx, r12w
lea rcx, str._04x
call fcn.10007a80
jmp 0x10008de9
mov byte [rdx], al
add rdx, 1
jmp 0x10008d78
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008870
xor edx, edx
mov rcx, qword [rbx]
mov r8d, 0xa
call qword [sym.imp.ucrtbase.dll_wcstoul]
xor edx, edx
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x100092c2
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov r13d, eax
test eax, eax
je 0x10008ca2
test byte [0x1000d050], 4
jne 0x10009954
movzx r12d, r13w
or r12d, 0x80070000
test r13d, r13d
cmovle r12d, r13d
jmp 0x10008ca2
mov rdx, rbx
mov rcx, rbp
call fcn.10007fb0
mov r12d, eax
test eax, eax
js 0x10008870
mov rdx, qword [rbx]
cmp word [rdx], 0
je 0x100099fd
mov rax, rdx
nop word cs:[rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x10009350
sub rax, rdx
sar rax, 1
lea eax, [rax + rax + 2]
mov ecx, dword [rsp + 0x6c]
xor r10d, r10d
test ecx, ecx
je 0x10009374
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, r10
mov dword [rsp + 0x28], eax
mov r9d, 1
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov r12d, eax
test eax, eax
je 0x100085d6
test byte [0x1000d050], 4
jne 0x1000997c
test r12d, r12d
jle 0x10008ca2
movzx r12d, r12w
or r12d, 0x80070000
cmp esi, 2
setne r13b
jmp 0x10008877
mov eax, 0x224c
mov byte [rsp + 0x72], 0x22
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], ax
lea rax, [rdx + 1]
jmp 0x10008ddc
mov byte [rdx], al
add rdx, 1
jmp 0x10008ee8
mov r13, qword [rbx]
movzx edx, word [r13]
test dx, dx
je 0x10009a07
mov rax, r13
nop
add rax, 2
cmp word [rax], 0
jne 0x10009410
sub rax, r13
mov dword [rsp + 0x4c], edx
sar rax, 1
add eax, 1
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
mov dword [rsp + 0x48], eax
mov ecx, eax
mov rax, qword [rsp + 0x38]
call rax
mov edx, dword [rsp + 0x4c]
test rax, rax
mov qword [rsp + 0x40], rax
je 0x10009a1e
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x100096f4
mov rcx, qword [rsp + 0x40]
lea r11d, [rax - 1]
mov r8, rcx
add r11, rcx
mov ecx, 2
jmp 0x100094f8
lea r9d, [rdx - 0x61]
cmp r9w, 5
jbe 0x100095d0
sub edx, 0x41
cmp dx, 5
ja 0x10009929
sub eax, 0x37
lea edx, [rcx - 1]
movzx r9d, word [r13 + rdx*2]
lea r10d, [r9 - 0x30]
mov edx, r9d
cmp r10w, 9
jbe 0x10009510
lea r10d, [rdx - 0x61]
cmp r10w, 5
jbe 0x100095d8
sub edx, 0x41
cmp dx, 5
ja 0x10009929
sub r9d, 0x37
shl eax, 4
or eax, r9d
mov byte [r8], al
cmp r11, r8
je 0x100096f4
mov eax, ecx
add r8, 1
add ecx, 2
movzx edx, word [r13 + rax*2]
test dx, dx
je 0x100096f4
lea r9d, [rdx - 0x30]
movzx eax, dx
cmp r9w, 9
ja 0x10009478
sub eax, 0x30
jmp 0x10009497
sub r9d, 0x30
jmp 0x100094ce
lea r9d, [rax - 0x20]
cmp r9w, 0x5e
jbe 0x10009619
mov r9d, eax
lea r11, str.0123456789abcdefRegistrar_ResourceUnregister
mov byte [rdx], 0x5c
add rdx, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 4], r9b
mov r9d, eax
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 3], r9b
mov r9d, eax
and eax, 0xf
shr r9w, 4
movzx eax, byte [r11 + rax]
and r9d, 0xf
movzx r9d, byte [r11 + r9]
mov byte [rdx - 1], al
mov byte [rdx - 2], r9b
jmp 0x10009038
mov eax, 0x225c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x10009038
mov eax, 0x725c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x10009038
mov eax, 0x745c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x10009038
sub eax, 0x57
jmp 0x10009497
sub r9d, 0x57
jmp 0x100094ce
mov byte [rdx], 0x22
test eax, eax
jle 0x1000916a
mov r13d, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], r13w
jmp 0x1000916e
movzx edx, r13w
lea rcx, str._04x
call fcn.10007a80
jmp 0x1000917b
mov byte [rdx], al
add rdx, 1
jmp 0x10009038
mov r10d, 0x224c
mov byte [rsp + 0x72], 0x22
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], r10w
lea rax, [rdx + 1]
jmp 0x10008f4c
lea r9, str.value_not_set__n
lea r8, str.do_process_key
mov ecx, 2
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10008c0d
test byte [0x1000d050], 4
jne 0x10009901
movzx eax, r12w
mov edx, r12d
mov r13d, 1
or eax, 0x80070000
test r12d, r12d
cmovg edx, eax
mov r12d, edx
jmp 0x10008877
mov byte [rdx], 0x22
test eax, eax
jle 0x100099f4
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov qword [rsp + 0x20], rax
lea r9, str.Wrong_resource_type:__s_n
lea r8, str.do_process_key
lea rdx, [0x1000d050]
mov ecx, 2
mov r12d, 0x80020009
call fcn.10007e00
jmp 0x10008877
mov dword [rsp + 0x48], 0
mov r13d, dword [rsp + 0x6c]
xor edx, edx
test r13d, r13d
je 0x10009705
mov rdx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov r13d, eax
test eax, eax
je 0x10009751
test byte [0x1000d050], 4
jne 0x10009a30
movzx r12d, r13w
or r12d, 0x80070000
test r13d, r13d
cmovle r12d, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x10008ca2
cmp esi, 2
mov r12d, 0x80020009
setne r13b
test byte [0x1000d050], 4
je 0x10008877
mov rbx, qword [rbx]
lea rax, str._null_
test rbx, rbx
je 0x100099cf
mov rax, rbx
shr rax, 0x10
je 0x10009b00
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x100099cf
cmp word [rbx], 0
je 0x10009b14
xor eax, eax
mov ecx, eax
add rax, 1
cmp word [rbx + rax*2], 0
jne 0x100097ca
mov eax, 0x224c
lea r8, str.0123456789abcdefRegistrar_ResourceUnregister
lea r10, [rsp + 0x192]
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x72]
jmp 0x1000982e
cmp dx, 9
je 0x10009ae3
cmp dx, 0xa
jne 0x10009a67
mov ebp, 0x6e5c
add rax, 2
mov word [rax - 2], bp
lea edx, [rcx - 1]
test ecx, ecx
jle 0x100099a4
cmp rax, r10
ja 0x100099a4
mov ecx, edx
movzx edx, word [rbx]
add rbx, 2
cmp dx, 0xd
je 0x10009ad1
jbe 0x100097f7
cmp dx, 0x22
je 0x10009abd
cmp dx, 0x5c
jne 0x10009a58
mov r9d, 0x5c5c
add rax, 2
mov word [rax - 2], r9w
jmp 0x10009818
mov edi, 0x725c
add rdx, 2
mov word [rdx - 2], di
jmp 0x10008a60
mov esi, 0x745c
add rdx, 2
mov word [rdx - 2], si
jmp 0x10008a60
lea r10d, [rax - 0x20]
cmp r10w, 0x5e
jbe 0x10009949
mov r10d, eax
mov byte [rdx], 0x5c
add rdx, 5
shr r10w, 0xc
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 4], r10b
mov r10d, eax
shr r10w, 8
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 3], r10b
mov r10d, eax
and eax, 0xf
shr r10w, 4
movzx eax, byte [r9 + rax]
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 1], al
mov byte [rdx - 2], r10b
jmp 0x10008a60
mov ebx, 0x225c
add rdx, 2
mov word [rdx - 2], bx
jmp 0x10008a60
mov dword [rsp + 0x20], eax
lea r9, str.Could_not_create_open__key:__08lx_n
lea r8, str.do_process_key
mov ecx, 2
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10009674
mov r12d, 0x80004005
jmp 0x10009751
movzx edx, r11w
lea rcx, str._04x
call fcn.10007a80
jmp 0x100096bd
mov byte [rdx], al
add rdx, 1
jmp 0x10008a60
mov dword [rsp + 0x20], eax
lea r9, str.Could_set_value_of_key:__08lx_n
lea r8, str.do_process_key
mov ecx, 2
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x10009300
mov dword [rsp + 0x20], eax
lea r9, str.Could_set_value_of_key:__08lx_n
lea r8, str.do_process_key
mov ecx, 2
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x100093ac
mov byte [rax], 0x22
test edx, edx
jle 0x10009b25
mov r8d, 0x2e2e
mov byte [rax + 3], 0x2e
lea rdx, [rax + 4]
mov word [rax + 1], r8w
mov byte [rdx], 0
lea rcx, [rsp + 0x70]
call fcn.1000c110
mov qword [rsp + 0x20], rax
lea r9, str.Wrong_registry_type:__s_n
jmp 0x100096c9
mov eax, 0x224c
mov byte [rsp + 0x72], 0x22
lea rdx, [rsp + 0x72]
mov word [rsp + 0x70], ax
lea rax, [rdx + 1]
jmp 0x100096b0
mov eax, 2
jmp 0x10009364
mov rax, qword [rsp + 0x38]
xor ecx, ecx
call rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x100096ec
cmp esi, 2
mov r12d, 0x8007000e
setne r13b
jmp 0x10008877
mov dword [rsp + 0x20], eax
lea r9, str.Could_not_set_value_of_key:_0x_08lx_n
lea r8, str.do_process_key
mov ecx, 2
lea rdx, [0x1000d050]
call fcn.10007e00
jmp 0x1000973f
lea r9d, [rdx - 0x20]
cmp r9w, 0x5e
jbe 0x10009af5
mov r9d, edx
mov byte [rax], 0x5c
add rax, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r8 + r9]
mov byte [rax - 4], r9b
mov r9d, edx
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r8 + r9]
mov byte [rax - 3], r9b
mov r9d, edx
and edx, 0xf
shr r9w, 4
movzx edx, byte [r8 + rdx]
and r9d, 0xf
movzx r9d, byte [r8 + r9]
mov byte [rax - 1], dl
mov byte [rax - 2], r9b
jmp 0x10009818
mov r11d, 0x225c
add rax, 2
mov word [rax - 2], r11w
jmp 0x10009818
mov edi, 0x725c
add rax, 2
mov word [rax - 2], di
jmp 0x10009818
mov esi, 0x745c
add rax, 2
mov word [rax - 2], si
jmp 0x10009818
mov byte [rax], dl
add rax, 1
jmp 0x10009818
movzx edx, bx
lea rcx, str._04x
call fcn.10007a80
jmp 0x100099cf
mov word [rsp + 0x70], 0x224c
lea rax, [rsp + 0x72]
mov byte [rsp + 0x72], 0x22
lea rdx, [rax + 1]
jmp 0x100099c2