Function at 0x1004020e0
Capabilities:
Set registry value

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov rax, qword [0x10040a018]
xor r8d, r8d
mov edx, 0xf003f
mov ecx, 2
mov r12, qword [rax + 8]
call dbg.find_key(int, unsigned int, int)
test r12, r12
je 0x1004025fa
mov r9d, dword [0x100404384]
cmp r9d, 0xffffffff
je 0x100402150
cmp r9d, 0xb
ja case.0x10040213d.6
lea rdx, [0x100405ef0]
mov eax, r9d
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov r13d, 0x75
mov ecx, r13d
call dbg.Fail(unsigned int)
nop
lea rdx, [rbp - 8]
xor r8d, r8d
mov rcx, r12
call sym.strtoull
mov qword [rbp - 0x10], rax
movzx edx, byte [r12]
cmp dl, 0x25
je 0x1004023e8
test dl, dl
je 0x100402182
mov rdx, qword [rbp - 8]
cmp byte [rdx], 0
je 0x1004024c0
mov rdi, qword [0x10040a018]
cmp qword [rdi + 0x10], 0
je 0x100402590
mov dword [0x100404384], 7
mov rdx, qword [rdi + 8]
mov ebx, 0x10
mov esi, 1
mov ecx, 2
test rdx, rdx
je 0x1004021e8
nop word cs:[rax + rax]
xor r8d, r8d
xor ecx, ecx
call sym.mbstowcs
mov rdi, qword [0x10040a018]
lea esi, [rsi + rax + 1]
mov rdx, qword [rdi + rbx]
add rbx, 8
test rdx, rdx
jne 0x1004021c0
movsxd rcx, esi
add rcx, rcx
call sym.malloc
mov rdx, qword [rdi + 8]
mov r12, rax
test rdx, rdx
je 0x1004025c0
mov edi, 0x10
xor ebx, ebx
nop dword [rax]
mov r8d, esi
movsxd rax, ebx
sub r8d, ebx
lea rcx, [r12 + rax*2]
movsxd r8, r8d
call sym.mbstowcs
lea ebx, [rbx + rax + 1]
mov rax, qword [0x10040a018]
mov rdx, qword [rax + rdi]
add rdi, 8
test rdx, rdx
jne 0x100402208
movsxd rax, ebx
lea rdx, [r12 + rax*2]
lea eax, [rbx + rbx + 2]
xor ecx, ecx
mov r9d, 7
xor r8d, r8d
mov word [rdx], cx
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
test r12, r12
je 0x1004023c8
mov rcx, r12
call sym.free
jmp 0x1004023c8
mov rdx, qword [0x10040a018]
mov r12, qword [rdx + 8]
test r12, r12
je 0x1004025b0
mov eax, 1
nop dword [rax]
mov esi, eax
mov rcx, rax
add rax, 1
mov r13, qword [rdx + rax*8]
test r13, r13
jne 0x1004022a8
cmp esi, 1
je 0x100402528
call sym.malloc
lea r13d, [rsi + 1]
mov ebx, 1
lea rdi, [rbp - 8]
mov r12, rax
nop dword [rax + rax]
call sym.__errno
mov r8d, 0x10
mov rdx, rdi
lea r14, [rbx*8]
mov dword [rax], 0
mov rax, qword [0x10040a018]
mov rcx, qword [rax + rbx*8]
call sym.strtoul
mov dword [rbp - 0x14], eax
call sym.__errno
mov r8d, dword [rax]
test r8d, r8d
jne 0x1004025cd
mov eax, dword [rbp - 0x14]
cmp eax, 0xff
ja 0x1004025cd
mov rdx, qword [rbp - 8]
cmp byte [rdx], 0
jne 0x1004025cd
mov byte [r12 + rbx - 1], al
add rbx, 1
cmp r13, rbx
jne 0x1004022e0
mov r9d, dword [0x100404384]
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
jmp 0x10040226e
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.strtoul
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
xor r8d, r8d
bswap eax
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x14]
mov r9d, 5
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
nop dword [rax + rax]
test r13d, r13d
jne 0x100402146
xor eax, eax
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov dword [0x100404384], 2
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
mov rsi, rsp
call sym.mbstowcs
lea ebx, [rax + 1]
movsxd r8, ebx
lea rax, [r8 + r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.100402b00
sub rsp, rax
mov rdx, r12
add ebx, ebx
lea rdi, [rsp + 0x30]
mov rcx, rdi
call sym.mbstowcs
mov r9d, dword [0x100404384]
mov rdx, qword [0x10040a008]
xor r8d, r8d
mov rcx, qword [0x10040a010]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rsp, rsi
mov r13d, eax
jmp 0x1004023c8
mov dword [0x100404384], 0xb
nop word [rax + rax]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.strtoul
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
xor r8d, r8d
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov r9d, 0xb
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
jmp 0x1004023c8
shr rax, 0x20
jne 0x100402460
mov dword [0x100404384], 4
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.strtoul
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
xor r8d, r8d
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x14]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
jmp 0x1004023c8
mov rdi, qword [0x10040a018]
jmp 0x10040219e
cmp byte [r12], 0x2d
jne 0x1004022c3
movzx ebx, byte [r12 + 1]
test ebx, ebx
jne 0x1004022c3
xor esi, esi
jmp 0x100402571
mov edi, ebx
sub edi, esi
movsxd rdi, edi
call sym.__getreent
movsxd rcx, esi
mov r8, rdi
mov edx, 1
mov r9, qword [rax + 8]
add rcx, r13
call sym.fread
test eax, eax
jle 0x1004025a0
add esi, eax
cmp ebx, esi
jg 0x100402548
lea ebx, [rsi + 0x400]
mov rcx, r13
mov edi, 0x400
movsxd rdx, ebx
call sym.realloc
mov r13, rax
jmp 0x10040254f
mov dword [0x100404384], 1
jmp case.0x10040213d.1
mov r9d, dword [0x100404384]
mov r12, r13
jmp 0x100402350
xor esi, esi
jmp 0x100402350
mov rdx, rax
mov eax, 2
jmp 0x100402240
mov rax, qword [0x10040a018]
mov rbx, qword [rax + r14]
call sym.__getreent
lea rdx, str.Invalid_hex_constant___s_n
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sym.fprintf
mov ecx, 1
call sym.exit
call sym.__getreent
mov rcx, qword [rax + 0x18]
call dbg.usage
nop
nop dword [rax]