Function at 0x401000
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete registry key
Get common file path
Persist via app paths registry key
Persist via default file association registry key
Query or enumerate registry value
Self delete
Set file attributes
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 8
sub rsp, 0x20
jmp 0x40101f
lea rcx, [0x0040100a]
mov rdx, 0
call qword [sym.imp.USER32.DLL_FindWindowA]
add rsp, 0x20
or eax, eax
jne 0x410921
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401070
lea rdx, [0x0040104f]
jmp 0x401085
lea r8, [0x00401079]
mov r9, 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
test eax, eax
jne 0x410921
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4010e8
lea rdx, [0x004010c7]
jmp 0x4010fd
lea r8, [0x004010f1]
mov r9, 0
mov qword [rsp + 0x20], section..data_1
mov qword [rsp + 0x28], 0x412618
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, section..data_1
jmp 0x40113b
lea rdx, [0x00401134]
call qword [sym.imp.SHLWAPI.DLL_PathAppendA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data_1
mov rdx, 0x412628
call qword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
add rsp, 0x20
cmp eax, 0
je 0x410921
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetCommandLineA]
add rsp, 0x20
mov ebx, eax
cmp byte [ebx], 0
je 0x40d7a0
cmp byte [ebx], 0x20
je 0x401195
inc ebx
jmp 0x401181
inc ebx
cmp byte [ebx], 0x20
je 0x401195
cmp byte [ebx], 0x2a
jne 0x40d7a0
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4011cd
lea rdx, [0x004011b7]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401204
lea rdx, [0x004011ee]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40123b
lea rdx, [0x00401225]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401272
lea rdx, [0x0040125c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012a9
lea rdx, [0x00401293]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012e0
lea rdx, [0x004012ca]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401322
lea rdx, [0x00401301]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401366
lea rdx, [0x00401343]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013aa
lea rdx, [0x00401387]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013e4
lea rdx, [0x004013cb]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40141d
lea rdx, [0x00401405]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401462
lea rdx, [0x0040143e]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4014be
lea rdx, [0x00401483]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401520
lea rdx, [0x004014df]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401582
lea rdx, [0x00401541]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4015e4
lea rdx, [0x004015a3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40161b
lea rdx, [0x00401605]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401652
lea rdx, [0x0040163c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401689
lea rdx, [0x00401673]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016c2
lea rdx, [0x004016aa]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016fc
lea rdx, [0x004016e3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401738
lea rdx, [0x0040171d]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40178f
lea rdx, [0x00401759]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4017c4
lea rdx, [0x004017b0]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401805
lea rdx, [0x004017e5]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401856
lea rdx, [0x00401826]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4018b2
lea rdx, [0x00401877]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4018f9
lea rdx, [0x004018d3]
jmp 0x401910
lea r8, [0x00401902]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401970
lea rdx, [0x0040194a]
jmp 0x401984
lea r8, [0x00401979]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4019e4
lea rdx, [0x004019be]
jmp 0x4019fd
lea r8, [0x004019ed]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401a5d
lea rdx, [0x00401a37]
jmp 0x401a7a
lea r8, [0x00401a66]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401ada
lea rdx, [0x00401ab4]
jmp 0x401af2
lea r8, [0x00401ae3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401b52
lea rdx, [0x00401b2c]
jmp 0x401b69
lea r8, [0x00401b5b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401bc9
lea rdx, [0x00401ba3]
jmp 0x401be2
lea r8, [0x00401bd2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401c42
lea rdx, [0x00401c1c]
jmp 0x401c5a
lea r8, [0x00401c4b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401cba
lea rdx, [0x00401c94]
jmp 0x401cd8
lea r8, [0x00401cc3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401d55
lea rdx, [0x00401d12]
jmp 0x401d6d
lea r8, [0x00401d5e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401dea
lea rdx, [0x00401da7]
jmp 0x401e03
lea r8, [0x00401df3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401e81
lea rdx, [0x00401e3d]
jmp 0x401e99
lea r8, [0x00401e8a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401f17
lea rdx, [0x00401ed3]
jmp 0x401f30
lea r8, [0x00401f20]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401fb1
lea rdx, [0x00401f6a]
jmp 0x401fc9
lea r8, [0x00401fba]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40204a
lea rdx, [0x00402003]
jmp 0x402063
lea r8, [0x00402053]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4020e3
lea rdx, [0x0040209d]
jmp 0x4020fb
lea r8, [0x004020ec]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40217b
lea rdx, [0x00402135]
jmp 0x402194
lea r8, [0x00402184]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402212
lea rdx, [0x004021ce]
jmp 0x40222a
lea r8, [0x0040221b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4022a8
lea rdx, [0x00402264]
jmp 0x4022c1
lea r8, [0x004022b1]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402340
lea rdx, [0x004022fb]
jmp 0x402358
lea r8, [0x00402349]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4023d7
lea rdx, [0x00402392]
jmp 0x4023f0
lea r8, [0x004023e0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402444
lea rdx, [0x0040242a]
jmp 0x402461
lea r8, [0x0040244d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4024b5
lea rdx, [0x0040249b]
jmp 0x4024ce
lea r8, [0x004024be]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402521
lea rdx, [0x00402508]
jmp 0x40253e
lea r8, [0x0040252a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402591
lea rdx, [0x00402578]
jmp 0x4025ad
lea r8, [0x0040259a]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40260a
lea rdx, [0x004025e7]
jmp 0x402623
lea r8, [0x00402613]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402675
lea rdx, [0x0040265d]
jmp 0x402692
lea r8, [0x0040267e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4026f0
lea rdx, [0x004026cc]
jmp 0x402706
lea r8, [0x004026f9]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402764
lea rdx, [0x00402740]
jmp 0x402787
lea r8, [0x0040276d]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4027e5
lea rdx, [0x004027c1]
jmp 0x4027fd
lea r8, [0x004027ee]
mov r9, 4
mov qword [rsp + 0x20], 0x41100c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40285b
lea rdx, [0x00402837]
jmp 0x402889
lea r8, [0x00402864]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4028e7
lea rdx, [0x004028c3]
jmp 0x402901
lea r8, [0x004028f0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40295f
lea rdx, [0x0040293b]
jmp 0x40297b
lea r8, [0x00402968]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4029d9
lea rdx, [0x004029b5]
jmp 0x4029f6
lea r8, [0x004029e2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402a54
lea rdx, [0x00402a30]
jmp 0x402a6b
lea r8, [0x00402a5d]
mov r9, 4
mov qword [rsp + 0x20], 0x411010
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402ac9
lea rdx, [0x00402aa5]
jmp 0x402ae8
lea r8, [0x00402ad2]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402b46
lea rdx, [0x00402b22]
jmp 0x402b5d
lea r8, [0x00402b4f]
mov r9, 4
mov qword [rsp + 0x20], 0x411024
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402bbb
lea rdx, [0x00402b97]
jmp 0x402bd9
lea r8, [0x00402bc4]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402c37
lea rdx, [0x00402c13]
jmp 0x402c4c
lea r8, [0x00402c40]
mov r9, 4
mov qword [rsp + 0x20], 0x411008
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402caa
lea rdx, [0x00402c86]
jmp 0x402cd3
lea r8, [0x00402cb3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402d31
lea rdx, [0x00402d0d]
jmp 0x402d50
lea r8, [0x00402d3a]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402dae
lea rdx, [0x00402d8a]
jmp 0x402dd2
lea r8, [0x00402db7]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402e30
lea rdx, [0x00402e0c]
jmp 0x402e56
lea r8, [0x00402e39]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402eb4
lea rdx, [0x00402e90]
jmp 0x402ed4
lea r8, [0x00402ebd]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402f32
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40d7d0
lea rdx, [0x0040d7b0]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40d81a
lea rdx, [0x0040d7f1]
jmp 0x40d83e
lea r8, [0x0040d823]
mov r9, 1
jmp 0x40d850
lea rax, [0x0040d84e]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40d8a8
lea rdx, [0x0040d87f]
jmp 0x40d8c3
lea r8, [0x0040d8b1]
mov r9, 1
jmp 0x40d8d5
lea rax, [0x0040d8d3]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40d92d
lea rdx, [0x0040d904]
jmp 0x40d942
lea r8, [0x0040d936]
mov r9, 1
jmp 0x40d954
lea rax, [0x0040d952]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40d9b5
lea rdx, [0x0040d983]
jmp 0x40d9d2
lea r8, [0x0040d9be]
mov r9, 1
jmp 0x40d9e4
lea rax, [0x0040d9e2]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40da45
lea rdx, [0x0040da13]
jmp 0x40da65
lea r8, [0x0040da4e]
mov r9, 1
jmp 0x40da77
lea rax, [0x0040da75]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dad8
lea rdx, [0x0040daa6]
jmp 0x40daea
lea r8, [0x0040dae1]
mov r9, 1
jmp 0x40dafc
lea rax, [0x0040dafa]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40db5f
lea rdx, [0x0040db2b]
jmp 0x40db6e
lea r8, [0x0040db68]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dbcc
lea rdx, [0x0040dba8]
jmp 0x40dbef
lea r8, [0x0040dbd5]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dc4d
lea rdx, [0x0040dc29]
jmp 0x40dc73
lea r8, [0x0040dc56]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dcd1
lea rdx, [0x0040dcad]
jmp 0x40dcf6
lea r8, [0x0040dcda]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dd54
lea rdx, [0x0040dd30]
jmp 0x40dd71
lea r8, [0x0040dd5d]
mov r9, 4
mov qword [rsp + 0x20], 0x411014
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ddcf
lea rdx, [0x0040ddab]
jmp 0x40dde8
lea r8, [0x0040ddd8]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40de46
lea rdx, [0x0040de22]
jmp 0x40de5f
lea r8, [0x0040de4f]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40debd
lea rdx, [0x0040de99]
jmp 0x40ded4
lea r8, [0x0040dec6]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40df32
lea rdx, [0x0040df0e]
jmp 0x40df4c
lea r8, [0x0040df3b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40dfaa
lea rdx, [0x0040df86]
jmp 0x40dfbf
lea r8, [0x0040dfb3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e01d
lea rdx, [0x0040dff9]
jmp 0x40e03c
lea r8, [0x0040e026]
mov r9, 4
mov qword [rsp + 0x20], 0x411018
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e09a
lea rdx, [0x0040e076]
jmp 0x40e0b7
lea r8, [0x0040e0a3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e115
lea rdx, [0x0040e0f1]
jmp 0x40e128
lea r8, [0x0040e11e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e17a
lea rdx, [0x0040e162]
jmp 0x40e1a5
lea r8, [0x0040e183]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e1f7
lea rdx, [0x0040e1df]
jmp 0x40e21f
lea r8, [0x0040e200]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e271
lea rdx, [0x0040e259]
jmp 0x40e298
lea r8, [0x0040e27a]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e2ea
lea rdx, [0x0040e2d2]
jmp 0x40e314
lea r8, [0x0040e2f3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e366
lea rdx, [0x0040e34e]
jmp 0x40e393
lea r8, [0x0040e36f]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e3e5
lea rdx, [0x0040e3cd]
jmp 0x40e40c
lea r8, [0x0040e3ee]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e462
lea rdx, [0x0040e446]
jmp 0x40e47c
lea r8, [0x0040e46b]
mov r9, 4
mov qword [rsp + 0x20], 0x41101c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e4d2
lea rdx, [0x0040e4b6]
jmp 0x40e4eb
lea r8, [0x0040e4db]
mov r9, 4
mov qword [rsp + 0x20], 0x411020
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e541
lea rdx, [0x0040e525]
jmp 0x40e55c
lea r8, [0x0040e54a]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e5b2
lea rdx, [0x0040e596]
jmp 0x40e5ce
lea r8, [0x0040e5bb]
mov r9, 4
mov qword [rsp + 0x20], 0x411004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40e61f
lea rdx, [0x0040e608]
jmp 0x40e62b
lea r8, [0x0040e628]
mov r9, 1
jmp 0x40e655
lea rax, [0x0040e63b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x19
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x00412620], eax
sub rsp, 0x20
mov rcx, 1
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x00412624], eax
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40e6f9
lea rdx, [0x0040e6b7]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub dword [0x00412624], 0x35
sub rsp, 0x20
mov rcx, 0x412410
jmp 0x40e72f
lea rdx, [0x0040e72c]
mov r8d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x412410
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e77a
lea r8, [0x0040e773]
mov r9, 1
mov qword [rsp + 0x20], 0x412410
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e7bb
lea r8, [0x0040e7b6]
mov r9, 1
jmp 0x40e7cd
lea rax, [0x0040e7cb]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e809
lea r8, [0x0040e803]
mov r9, 1
jmp 0x40e81b
lea rax, [0x0040e819]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e855
lea r8, [0x0040e851]
mov r9, 1
jmp 0x40e868
lea rax, [0x0040e865]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 2
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x412514
jmp 0x40e897
lea rdx, [0x0040e894]
mov r8d, dword [0x00412620]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x412514
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e8e1
lea r8, [0x0040e8db]
mov r9, 1
mov qword [rsp + 0x20], 0x412514
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
add dword [0x00412624], 0x35
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40e95f
lea rdx, [0x0040e91a]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40e99b
lea r8, [0x0040e995]
mov r9, 1
jmp 0x40e9ad
lea rax, [0x0040e9ab]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40ea11
lea rdx, [0x0040e9d9]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ea4e
lea r8, [0x0040ea47]
mov r9, 1
jmp 0x40ea62
lea rax, [0x0040ea5e]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ea9d
lea r8, [0x0040ea98]
mov r9, 1
jmp 0x40eab1
lea rax, [0x0040eaad]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40eaeb
lea r8, [0x0040eae7]
mov r9, 1
jmp 0x40eafd
lea rax, [0x0040eafb]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40eb3b
lea r8, [0x0040eb33]
mov r9, 1
jmp 0x40eb4d
lea rax, [0x0040eb4b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40eb89
lea r8, [0x0040eb83]
mov r9, 1
jmp 0x40eb9d
lea rax, [0x0040eb99]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40ec01
lea rdx, [0x0040ebc9]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ec3e
lea r8, [0x0040ec37]
mov r9, 1
jmp 0x40ec52
lea rax, [0x0040ec4e]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ec8d
lea r8, [0x0040ec88]
mov r9, 1
jmp 0x40ec9f
lea rax, [0x0040ec9d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ecd9
lea r8, [0x0040ecd5]
mov r9, 1
jmp 0x40eceb
lea rax, [0x0040ece9]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ed29
lea r8, [0x0040ed21]
mov r9, 1
jmp 0x40ed3b
lea rax, [0x0040ed39]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ed77
lea r8, [0x0040ed71]
mov r9, 1
jmp 0x40ed8c
lea rax, [0x0040ed87]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40edfb
lea rdx, [0x0040edb8]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ee38
lea r8, [0x0040ee31]
mov r9, 1
jmp 0x40ee4c
lea rax, [0x0040ee48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ee87
lea r8, [0x0040ee82]
mov r9, 1
jmp 0x40ee9b
lea rax, [0x0040ee97]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40eed7
lea r8, [0x0040eed1]
mov r9, 1
jmp 0x40eee9
lea rax, [0x0040eee7]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ef23
lea r8, [0x0040ef1f]
mov r9, 1
jmp 0x40ef37
lea rax, [0x0040ef33]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40ef73
lea r8, [0x0040ef6d]
mov r9, 1
jmp 0x40ef87
lea rax, [0x0040ef83]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x412104
jmp 0x40efeb
lea rdx, [0x0040efb3]
mov r8d, dword [0x00412620]
mov r9d, dword [0x00412624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40f028
lea r8, [0x0040f021]
mov r9, 1
jmp 0x40f03c
lea rax, [0x0040f038]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x412104
jmp 0x40f077
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]