Function at 0x1019ed4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov r13, rcx
xor r14d, r14d
mov ebp, r14d
mov r15, r14
mov qword [rax - 0x70], r14
mov qword [rax - 0x68], r14
mov qword [rax - 0x60], r14
mov qword [rsp + 0x60], r14
lea rax, [rax - 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01007040]
mov rcx, 0xffffffff80000001
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
mov esi, eax
mov dword [rsp + 0x118], eax
cmp eax, r14d
jne 0x1019f7c
mov esi, r14d
mov dword [rsp + 0x118], r14d
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0x88], r15
cmp esi, r14d
jne 0x101a2f5
mov r12, r14
mov ebx, r14d
mov rdi, qword [0x01031110]
lea rax, [rdi + 0x28]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], r14b
lea rcx, [rsp + 0x50]
call fcn.01015798
mov edi, dword [rdi + 0x20]
cmp byte [rsp + 0x58], r14b
je 0x1019fc4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x58], r14b
cmp ebx, edi
jae 0x101a017
lea r8, [rsp + 0x108]
mov edx, ebx
mov rcx, qword [0x01031110]
call fcn.0101ba68
cmp eax, r14d
jl 0x101a010
mov rdx, qword [rsp + 0x108]
cmp dword [rdx + 0x14], r14d
je 0x101a007
or ebp, 4
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, qword [rdx + 0x38]
repne scasw ax, word [rdi]
not rcx
add r12, rcx
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
inc ebx
jmp 0x1019f8b
mov rdx, r14
cmp qword [r13 + 0x68], r14
jbe 0x101a051
or ebp, 4
cmp rdx, qword [r13 + 0x68]
jae 0x101a046
mov rax, qword [r13 + 0x60]
mov rax, qword [rax + rdx*8]
mov eax, dword [rax - 0x10]
inc eax
cdqe
add r12, rax
inc rdx
cmp rdx, qword [r13 + 0x68]
jb 0x101a020
jmp 0x101a051
mov ecx, 0x80070057
call fcn.010112f4
int3
add r12, 1
mov rbx, r14
jne 0x101a05f
mov rcx, r14
jmp 0x101a076
xor edx, edx
or rax, 0xffffffffffffffff
div r12
cmp rax, 2
jb 0x101a2a0
lea rcx, [r12 + r12]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, r14
je 0x101a2a0
mov rsi, rax
mov dword [rsp + 0x108], r14d
mov dword [rsp + 0x110], r14d
xor r15d, r15d
mov rdi, qword [0x01031110]
lea rax, [rdi + 0x28]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x70], r15b
lea rcx, [rsp + 0x68]
call fcn.01015798
mov edi, dword [rdi + 0x20]
cmp byte [rsp + 0x70], r15b
je 0x101a0dc
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x70], r15b
cmp r14d, edi
jae 0x101a176
lea r8, [rsp + 0x78]
mov edx, r14d
mov rcx, qword [0x01031110]
call fcn.0101ba68
mov dword [rsp + 0x108], eax
cmp eax, r15d
jl 0x101a166
mov r14, qword [rsp + 0x78]
cmp dword [r14 + 0x14], r15d
je 0x101a155
mov r8, qword [r14 + 0x38]
mov rdx, r12
mov rcx, rsi
call fcn.01015e90
mov dword [rsp + 0x108], eax
test eax, eax
js 0x101a152
xor eax, eax
or rdx, 0xffffffffffffffff
mov rcx, rdx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rdx
sub rax, rcx
add r12, rax
lea rsi, [rsi + rcx*2 + 2]
xor r15d, r15d
jmp 0x101a155
xor r15d, r15d
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov r14d, dword [rsp + 0x110]
inc r14d
mov dword [rsp + 0x110], r14d
jmp 0x101a0a3
mov qword [rsp + 0x110], rsi
mov rdi, r15
mov r13, qword [rsp + 0x100]
cmp qword [r13 + 0x68], r15
mov esi, dword [rsp + 0x118]
mov r15, qword [rsp + 0x88]
jbe 0x101a22b
mov r14, qword [rsp + 0x110]
cmp rdi, qword [r13 + 0x68]
jae 0x101a220
mov r8, qword [r13 + 0x60]
mov r8, qword [r8 + rdi*8]
mov rdx, r12
mov rcx, r14
call fcn.01015e90
mov dword [rsp + 0x108], eax
test eax, eax
js 0x101a1ff
cmp rdi, qword [r13 + 0x68]
jae 0x101a215
mov rax, qword [r13 + 0x60]
mov rax, qword [rax + rdi*8]
mov eax, dword [rax - 0x10]
inc eax
cdqe
sub r12, rax
cmp rdi, qword [r13 + 0x68]
jae 0x101a20a
mov rax, qword [r13 + 0x60]
mov rax, qword [rax + rdi*8]
mov eax, dword [rax - 0x10]
inc eax
cdqe
lea r14, [r14 + rax*2]
inc rdi
cmp rdi, qword [r13 + 0x68]
jae 0x101a233
jmp 0x101a1aa
mov ecx, 0x80070057
call fcn.010112f4
int3
mov ecx, 0x80070057
call fcn.010112f4
int3
mov ecx, 0x80070057
call fcn.010112f4
int3
mov r14, qword [rsp + 0x110]
xor eax, eax
mov word [r14], ax
mov eax, dword [rsp + 0x108]
xor r14d, r14d
cmp eax, r14d
jl 0x101a2a0
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
jne 0x101a261
mov ecx, 0x80004005
call fcn.010112f4
int3
mov esi, r14d
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rdi, [rdi + rax*2]
lea esi, [rsi + rax*2]
cmp eax, 1
jne 0x101a267
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9d, [rax + 6]
xor r8d, r8d
lea rdx, [0x01006fd8]
mov rcx, r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
cmp esi, r14d
jne 0x101a2f5
cmp dword [r13 + 0x44], r14d
je 0x101a2b7
or ebp, 1
cmp dword [r13 + 0x50], r14d
je 0x101a2c0
or ebp, 2
mov dword [rsp + 0x108], ebp
mov ecx, 4
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
lea rdx, [0x01007008]
mov rcx, r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov esi, eax
movzx edi, si
or edi, 0x80070000
cmp esi, r14d
cmovle edi, esi
cmp r15, r14
je 0x101a312
mov rcx, r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, edi
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret