Function at 0x1000f1054
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov r13d, ecx
lea r15, [0x100153eb8]
mov eax, 5
lea r12, [0x10001dc08]
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000f10d6
test byte [rcx + 0x1c], 1
je 0x1000f10d6
cmp byte [rcx + 0x19], al
jb 0x1000f10d6
lea edx, [rax + 0x28]
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdi
mov r9d, r13d
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1000f0354
xor r14d, r14d
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.1000f19d4
mov ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000f1141
test byte [rcx + 0x1c], 2
je 0x1000f1141
cmp byte [rcx + 0x19], 4
jb 0x1000f1141
lea edx, [r14 + 0x2e]
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp ebx, r14d
jne 0x1000f1186
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.1000e55c4
mov ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000f1186
test byte [rcx + 0x1c], 2
je 0x1000f1186
cmp byte [rcx + 0x19], 4
jb 0x1000f1186
mov edx, 0x2f
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.100035db8
nop
lea rdx, [0x100026c70]
lea rcx, [rsp + 0x68]
call fcn.100035db8
nop
lea rdx, [0x100026c70]
lea rcx, [rsp + 0x58]
call fcn.100035db8
nop
or r15, 0xffffffffffffffff
cmp ebx, r14d
jne 0x1000f1271
cmp rsi, r14
je 0x1000f121b
xor eax, eax
mov rcx, r15
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.1000361b0
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f121b
test byte [rcx + 0x1c], 2
je 0x1000f121b
cmp byte [rcx + 0x19], 4
jb 0x1000f121b
lea edx, [r15 + 0x31]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034784
cmp rbp, r14
je 0x1000f127a
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x58]
call fcn.1000361b0
mov rcx, qword [0x100153eb8]
lea rbp, [0x100153eb8]
cmp rcx, rbp
je 0x1000f1281
test byte [rcx + 0x1c], 2
je 0x1000f1281
cmp byte [rcx + 0x19], 4
jb 0x1000f1281
mov edx, 0x31
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034784
jmp 0x1000f1281
lea rbp, [0x100153eb8]
jmp 0x1000f1281
lea rbp, [0x100153eb8]
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp ebx, r14d
jne 0x1000f18ca
lea rcx, [rsp + 0x70]
call fcn.1000e43a4
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rbp
je 0x1000f12e3
test byte [rcx + 0x1c], 2
je 0x1000f12e3
cmp byte [rcx + 0x19], 4
jb 0x1000f12e3
mov edx, 0x32
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, qword [0x100153eb8]
mov eax, 0x54f
cmp edi, r14d
cmovge eax, r14d
cmp eax, r14d
jne 0x1000f18d1
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdi, r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov esi, r14d
mov eax, dword [rsp + 0x50]
cmp eax, r14d
jle 0x1000f1887
mov rbp, r14
cmp esi, r14d
jl 0x1000f1871
cmp esi, eax
jge 0x1000f1871
movsxd r12, esi
mov rax, qword [rsp + 0x48]
lea rdx, [rax + r12*8]
lea rcx, [rsp + 0x40]
call fcn.100035ef8
xor eax, eax
mov rcx, r15
lea rdi, [0x1000021e8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1000021e8]
lea rcx, [rsp + 0x40]
call fcn.10003579c
mov rdx, qword [rsp + 0x70]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.10003579c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.10004f55c
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f140e
test byte [rcx + 0x1c], 2
je 0x1000f140e
cmp byte [rcx + 0x19], 4
jb 0x1000f140e
mov edx, 0x33
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rdi, qword [rsp + 0x88]
cmp ebx, r14d
jne 0x1000f1625
mov dword [rsp + 0xf0], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x100026c38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f148e
test byte [rcx + 0x1c], 2
je 0x1000f148e
cmp byte [rcx + 0x19], 4
jb 0x1000f148e
mov edx, 0x34
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp ebx, r14d
jne 0x1000f1625
mov rbx, qword [rsp + 0x80]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f182a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f1519
test byte [rcx + 0x1c], 2
je 0x1000f1519
cmp byte [rcx + 0x19], 4
jb 0x1000f1519
mov edx, 0x35
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp ebx, r14d
jne 0x1000f1625
mov rbx, qword [rsp + 0x68]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f181f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f15a1
test byte [rcx + 0x1c], 2
je 0x1000f15a1
cmp byte [rcx + 0x19], 4
jb 0x1000f15a1
mov edx, 0x36
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp ebx, r14d
jne 0x1000f1625
mov rbx, qword [rsp + 0x58]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f1814
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f1625
test byte [rcx + 0x1c], 2
je 0x1000f1625
cmp byte [rcx + 0x19], 4
jb 0x1000f1625
mov edx, 0x37
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp rdi, r14
je 0x1000f163e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
mov qword [rsp + 0x88], r14
cmp ebx, r14d
jne 0x1000f1801
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp esi, dword [rsp + 0x50]
jge 0x1000f184b
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + r12*8]
lea rdx, [0x100026c20]
lea rcx, [rsp + 0x78]
call fcn.100039dd4
mov rdi, qword [rsp + 0x78]
mov r8, rdi
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, r14
jne 0x1000f16f7
call sub.KERNEL32.dll_GetLastError
mov r9d, eax
mov rcx, qword [0x100153eb8]
lea r12, [0x100153eb8]
cmp rcx, r12
je 0x1000f1705
test byte [rcx + 0x1c], 2
je 0x1000f1705
mov edx, 2
cmp eax, r14d
lea eax, [rdx + 3]
cmove edx, eax
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jl 0x1000f1705
mov edx, 0x38
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, qword [0x100153eb8]
jmp 0x1000f1705
mov rcx, qword [0x100153eb8]
lea r12, [0x100153eb8]
mov qword [rsp + 0x60], rbx
cmp rcx, r12
je 0x1000f1733
test byte [rcx + 0x1c], 2
je 0x1000f1733
cmp byte [rcx + 0x19], 4
jb 0x1000f1733
mov edx, 0x39
mov r9, rbx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100034834
cmp rbx, r14
je 0x1000f1781
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000f1771
test byte [rcx + 0x1c], 2
je 0x1000f1771
cmp byte [rcx + 0x19], 4
jb 0x1000f1771
mov edx, 0x3a
mov r9d, eax
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r14
jmp 0x1000f17d2
cmp esi, dword [rsp + 0x50]
jge 0x1000f1835
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + rbp]
lea rcx, [rsp + 0xa0]
call fcn.1000e5b6c
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000f17d2
test byte [rcx + 0x1c], 2
je 0x1000f17d2
cmp byte [rcx + 0x19], 4
jb 0x1000f17d2
mov edx, 0x3b
mov r9d, eax
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
nop
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f17f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x88]
jmp 0x1000f1801
mov rdi, qword [rsp + 0x88]
inc esi
add rbp, 8
mov eax, dword [rsp + 0x50]
cmp esi, eax
jge 0x1000f1861
jmp 0x1000f1340
mov ecx, 0x80004005
call fcn.100036284
int3
mov ecx, 0x80004005
call fcn.100036284
int3
mov ecx, 0x80004005
call fcn.100036284
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea r12, [0x10001dc08]
lea rbp, [0x100153eb8]
jmp 0x1000f1887
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp rdi, r14
je 0x1000f1896
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f18c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x100153eb8]
jmp 0x1000f18d1
mov rcx, qword [0x100153eb8]
jmp 0x1000f18d1
mov rcx, qword [0x100153eb8]
cmp rcx, rbp
je 0x1000f18ee
test byte [rcx + 0x1c], 1
je 0x1000f18ee
mov edx, 0x3c
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034784
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1911
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1934
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1957
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f197d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x48]
call fcn.10004d050
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1000f1999
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xa0]
cmp rcx, r14
je 0x1000f19ac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret