Function at 0x10003c1b4
Capabilities:
Delete registry value
Persist via autoplayhandlers registry key
Persist via contextmenuhandlers registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rbp
call fcn.10003746c
cmp eax, ebp
jne 0x10003d95b
call fcn.10003746c
mov ebx, 0x103
lea r13d, [rbp + 2]
lea r12d, [rbp + 1]
mov r14d, 0x2001f
mov r15, 0xffffffff80000000
cmp eax, ebp
jne 0x10003c318
call fcn.100045800
cmp eax, ebp
jne 0x10003c318
lea rcx, [0x100020040]
mov edx, r12d
call fcn.10004100c
cmp eax, ebp
je 0x10003c318
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021190]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c318
lea rdi, [0x1000227f0]
lea rax, [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c2be
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003c2be
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c29e
cmp rdx, rbp
jne 0x10003c2cc
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c30d
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021230]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rsi, [0x100022840]
cmp eax, ebp
jne 0x10003c3ea
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c390
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003c390
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c370
cmp rdx, rbp
jne 0x10003c39e
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c3df
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000212d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c4b5
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c45b
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c45b
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c43b
cmp rdx, rbp
jne 0x10003c469
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c4aa
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021370]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c580
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c526
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c526
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c506
cmp rdx, rbp
jne 0x10003c534
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c575
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021410]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c64b
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c5f1
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c5f1
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c5d1
cmp rdx, rbp
jne 0x10003c5ff
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c640
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021490]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c716
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c6bc
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c6bc
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c69c
cmp rdx, rbp
jne 0x10003c6ca
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c70b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021510]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c7e1
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c787
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c787
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c767
cmp rdx, rbp
jne 0x10003c795
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c7d6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021590]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c8ac
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c852
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c852
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c832
cmp rdx, rbp
jne 0x10003c860
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c8a1
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000215f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c977
lea rax, [rsp + 0x70]
mov rdi, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c91d
movzx eax, word [rcx + rdi]
cmp ax, bp
je 0x10003c91d
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c8fd
cmp rdx, rbp
jne 0x10003c92b
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003c96c
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021650]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003ca3c
lea rax, [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x70]
sub rsi, rax
mov edi, ebp
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c9e4
movzx eax, word [rcx + rsi]
cmp ax, bp
je 0x10003c9e4
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003c9c4
cmp rdx, rbp
jne 0x10003c9f1
sub rcx, r13
mov edi, 0x8007007a
cmp edi, ebp
mov word [rcx], bp
jl 0x10003ca31
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000216b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cb0b
lea rdi, [0x100022890]
lea rax, [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003cab1
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003cab1
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003ca91
cmp rdx, rbp
jne 0x10003cabf
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003cb00
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000217c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cbd4
lea rdx, [0x1000228d8]
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x70]
sub rdx, rax
mov edi, ebp
lea rax, [rbx + 0x7ffffefb]
cmp rax, rbp
je 0x10003cb7c
movzx eax, word [rdx + rcx]
cmp ax, bp
je 0x10003cb7c
mov word [rcx], ax
add rcx, r13
sub rbx, r12
jne 0x10003cb5c
cmp rbx, rbp
jne 0x10003cb89
sub rcx, r13
mov edi, 0x8007007a
cmp edi, ebp
mov word [rcx], bp
jl 0x10003cbc9
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1000218d0]
call fcn.10003bb58
lea rcx, [0x100021910]
call fcn.10003bb58
lea rcx, [0x100021950]
call fcn.10003bb58
lea rcx, [0x1000219a0]
call fcn.10003bb58
lea rcx, [0x1000219f0]
call fcn.10003bb58
lea rcx, [0x100020f20]
call fcn.10003bb58
lea rcx, [0x100020f38]
call fcn.10003bb58
lea rcx, [0x100020f50]
call fcn.10003bb58
xor ecx, ecx
call fcn.10003b304
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov r15, 0xffffffff80000002
lea rdx, [0x100021a40]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, [0x100001db4]
cmp eax, ebp
jne 0x10003ccad
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100021b10]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10003c0f4
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [0x100021c40]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cd16
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100021d30]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021d80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cd7a
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100021e58]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021e90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cdde
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100021f68]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100021fa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003ce42
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022078]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000220b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003cea6
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022078]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100022190]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, 0x24
lea rsi, [0x100022938]
cmp eax, ebp
jne 0x10003cfc8
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022910]
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022960]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020660]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100022a20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d0de
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022ae8]
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b10]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020660]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100022330]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d1f4
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b30]
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b58]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020660]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000224e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d30a
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b68]
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b90]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020660]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100022400]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d420
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022ba0]
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022b90]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020660]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x100022260]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x16
cmp eax, ebp
jne 0x10003d53b
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022bc8]
lea rdx, [0x100022938]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022bf0]
lea rdx, [0x100022978]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022c08]
lea rdx, [0x100022998]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea rdx, [0x1000225c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d667
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022c18]
lea rdx, [0x100022938]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x26
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001ef88]
lea rdx, [0x100022948]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022c40]
lea rdx, [0x100022c90]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 0x4e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1000229b0]
lea rdx, [0x1000207e0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100022cb0]
lea rdx, [0x100022cc8]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022cd8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [0x100020f90]
mov r9d, r14d
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x104
cmp eax, ebp
jne 0x10003d7fb
lea rax, [rsp + 0x60]
lea rdx, [0x10001c500]
mov r9d, r14d
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003d7f0
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x58], esi
jmp 0x10003d7af
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003d7af
lea rax, [rsp + 0x70]
mov rdi, rbx
mov rdx, rsi
lea rcx, [rsp + 0x70]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x10003d73d
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003d73d
mov word [rcx], ax
add rcx, r13
sub rdx, r12
jne 0x10003d71d
cmp rdx, rbp
jne 0x10003d74b
sub rcx, r13
mov r8d, 0x8007007a
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003d791
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x100021008]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x280]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rcx, qword [rsp + 0x60]
cmp eax, ebp
je 0x10003d6ca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
lea rdx, [0x100021030]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003d95b
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x70]
mov edx, ebp
sub rbx, rax
lea rax, [rsi + 0x7ffffefa]
cmp rax, rbp
je 0x10003d855
movzx eax, word [rbx + rcx]
cmp ax, bp
je 0x10003d855
mov word [rcx], ax
add rcx, r13
sub rsi, r12
jne 0x10003d835
cmp rsi, rbp
jne 0x10003d862
sub rcx, r13
mov edx, 0x8007007a
cmp edx, ebp
mov word [rcx], bp
jl 0x10003d950
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, [0x1000210f0]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003d8e1
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x100021008]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, [0x100021140]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003d950
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x100021008]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret