Function at 0x10003bb58
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rcx
mov r9, rcx
mov ebx, 0x103
lea rcx, [r11 - 0x248]
lea r8, [0x100020e30]
xor ebp, ebp
mov rdx, rbx
mov qword [rsp + 0x50], rbp
call fcn.10002e570
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r12d, [rbp + 2]
lea rdx, [rsp + 0x270]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
or r15, 0xffffffffffffffff
lea r13d, [rbp + 1]
mov r14d, 0x8007007a
cmp eax, ebp
jne 0x10003bd46
lea rdi, [0x100022680]
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003bc3d
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003bc3d
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x10003bc1d
cmp rdx, rbp
jne 0x10003bc48
sub rcx, r12
mov r8d, r14d
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003bc88
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
mov r9d, r13d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x1000226d0]
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003bcc2
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003bcc2
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x10003bca2
cmp rdx, rbp
jne 0x10003bccd
sub rcx, r12
mov r8d, r14d
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003bd12
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
lea rdx, [0x10001efb0]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100001db4]
lea rdx, [0x100022728]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x100020d80]
lea rcx, [rsp + 0x270]
mov r9, rsi
mov rdx, rbx
call fcn.10002e570
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x270]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003be35
lea rdi, [0x100020de0]
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003bdda
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003bdda
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x10003bdba
cmp rdx, rbp
jne 0x10003bde5
sub rcx, r12
mov r8d, r14d
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003be2a
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
lea rdx, [0x100020db8]
mov r9d, r13d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x100020ee0]
lea rcx, [rsp + 0x270]
mov r9, rsi
mov rdx, rbx
call fcn.10002e570
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x270]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003bfd2
lea rdi, [0x100022750]
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003bec9
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003bec9
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x10003bea9
cmp rdx, rbp
jne 0x10003bed4
sub rcx, r12
mov r8d, r14d
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003bf14
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
mov r9d, r13d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100022790]
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbp
je 0x10003bf4e
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10003bf4e
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x10003bf2e
cmp rdx, rbp
jne 0x10003bf59
sub rcx, r12
mov r8d, r14d
cmp r8d, ebp
mov word [rcx], bp
jl 0x10003bf9e
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
lea rdx, [0x10001efb0]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100001db4]
lea rdx, [0x100022728]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x100020e58]
lea rcx, [rsp + 0x270]
mov r9, rsi
mov rdx, rbx
call fcn.10002e570
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x270]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10003c0bc
lea rcx, [0x100020e90]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x60]
sub rcx, rax
mov edi, ebp
lea rax, [rbx + 0x7ffffefb]
cmp rax, rbp
je 0x10003c062
movzx eax, word [rcx + rdx]
cmp ax, bp
je 0x10003c062
mov word [rdx], ax
add rdx, r12
sub rbx, r13
jne 0x10003c042
cmp rbx, rbp
jne 0x10003c06d
sub rdx, r12
mov edi, r14d
cmp edi, ebp
mov word [rdx], bp
jl 0x10003c0b1
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r15
repne scasw ax, word [rdi]
lea rdx, [0x100020db8]
mov r9d, r13d
not rcx
xor r8d, r8d
sub rcx, r13
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret