Function at 0x1000036a0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2168
call fcn.10000b880
sub rsp, rax
mov rax, qword [0x10000d130]
xor rax, rsp
mov qword [rsp + 0x2150], rax
mov r14, rdx
lea rdx, [rsp + 0x150]
xor ebx, ebx
mov rdi, r9
mov qword [rsp + 0x38], r9
mov r15, r8
mov r13, rcx
mov word [rsp + 0x30], bx
call fcn.100002a2c
cmp eax, ebx
jl 0x100003a71
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.1000028c8
cmp eax, ebx
jne 0x100003719
mov eax, 0x80020009
jmp 0x100003a71
mov rcx, qword [r13]
movzx eax, word [rcx]
cmp eax, 9
jl 0x100003740
cmp eax, 0xa
jle 0x100003734
cmp eax, 0xd
je 0x100003734
cmp eax, 0x20
jne 0x100003740
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r13], rax
jmp 0x100003719
lea rdx, [rsp + 0x150]
mov rcx, r13
call fcn.100002a2c
cmp eax, ebx
jl 0x100003a71
movzx eax, word [rsp + 0x30]
cmp eax, 8
je 0x100003a36
cmp eax, 0x11
je 0x1000038da
cmp eax, 0x13
je 0x10000388d
cmp eax, 0x4008
jne 0x100003a5f
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x40], rbx
add eax, 2
movsxd rcx, eax
cmp rcx, rbx
je 0x1000037d9
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1000037ce
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x1000037d9
lea rcx, [rsp + 0x40]
call fcn.100002c70
mov rdi, qword [rsp + 0x40]
jmp 0x1000037e3
mov ecx, 0x80070057
call fcn.10000216c
int3
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
cmp rdi, rbx
je 0x10000385b
lea rsi, [rsp + 0x150]
cmp word [rsp + 0x150], bx
je 0x10000383b
mov ebp, 0x30
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rsi]
cmp cx, 0x5c
jne 0x10000382b
cmp word [rax], bp
jne 0x10000382b
mov word [rdi], bx
mov rcx, rax
add rdi, 2
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, rax
jmp 0x100003836
mov word [rdi], cx
add rdi, 2
add rsi, 2
cmp word [rsi], bx
jne 0x1000037ff
mov word [rdi], bx
mov word [rdi + 2], bx
mov r8, qword [rsp + 0x40]
mov rdx, r15
mov rcx, r14
call fcn.100002710
mov rdi, qword [rsp + 0x40]
mov esi, eax
jmp 0x100003860
mov esi, 0xe
lea rax, [rsp + 0x48]
cmp rdi, rax
je 0x100003874
lea rcx, [rsp + 0x40]
call fcn.100002c60
mov rdi, qword [rsp + 0x38]
cmp esi, ebx
je 0x100003a5f
mov ecx, esi
call fcn.100002158
jmp 0x100003a71
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x150]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r11d, dword [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x38], r11d
lea rax, [rsp + 0x38]
mov r9d, 4
mov rcx, qword [r14]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x100003879
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
test sil, 1
je 0x1000038fb
mov eax, 0x80004005
jmp 0x100003a71
mov eax, esi
mov qword [rsp + 0x40], rbx
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
mov rdi, r12
cmp r12, rbx
je 0x100003949
xor edx, edx
or rax, 0xffffffffffffffff
div rdi
cmp rax, 1
jae 0x10000392c
mov ecx, 0x80070057
call fcn.10000216c
int3
cmp r12, 0x100
jbe 0x100003949
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.100002c70
mov rcx, qword [rsp + 0x40]
jmp 0x100003953
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rcx
cmp rcx, rbx
jne 0x10000396e
lea rax, [rsp + 0x48]
cmp rax, rbx
je 0x1000038f1
lea rcx, [rsp + 0x40]
call fcn.100002c60
jmp 0x1000038f1
mov r8, r12
xor edx, edx
call fcn.100007180
cmp rsi, rbx
mov r11d, ebx
mov r8, rbx
jle 0x1000039f1
mov ebp, 0x30
mov eax, r11d
cdq
sub eax, edx
movzx edx, word [rsp + r8*2 + 0x150]
sar eax, 1
movsxd r9, eax
mov eax, edx
add r9, qword [rsp + 0x40]
cmp edx, ebp
jl 0x1000039cd
cmp eax, 0x39
jle 0x1000039c8
cmp eax, 0x40
jle 0x1000039cd
cmp eax, 0x46
jle 0x1000039c3
add eax, 0xffffff9f
cmp eax, 5
ja 0x1000039cd
sub dl, 0x57
jmp 0x1000039cf
sub dl, 0x37
jmp 0x1000039cf
sub dl, bpl
jmp 0x1000039cf
mov dl, bl
mov ecx, r11d
mov eax, 4
inc r8
and ecx, 1
inc r11d
shl ecx, 2
sub eax, ecx
mov cl, al
shl dl, cl
or byte [r9], dl
cmp r8, rsi
jl 0x100003988
mov rax, qword [rsp + 0x40]
mov rcx, qword [r14]
mov r9d, 3
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100003874
lea rcx, [rsp + 0x40]
call fcn.100002c60
jmp 0x100003874
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x150]
jmp 0x1000038c2
mov rdx, rdi
mov rcx, r13
call fcn.100002a2c
cmp eax, ebx
cmovl ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.100007260
add rsp, 0x2168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret