Function at 0x14003b0b0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [rcx + 0x10], 0x26
mov rbx, rcx
jne 0x14003b709
cmp qword [rcx + 0x30], 0
je 0x14003b709
cmp qword [rcx + 0x110], 0
je 0x14003b709
cmp qword [rcx + 0xf0], 0
je 0x14003b709
cmp qword [rcx + 0x50], 0
je 0x14003b709
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.1400e4040
mov rcx, qword [str.SoftwareClassesCLSID]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003b140
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b160
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140122f68]
mov dword [rcx], eax
jb 0x14003b17e
mov r8, qword [rbx]
jmp 0x14003b181
mov r8, rbx
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b190
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14003b1a0
lea rax, [rbp + 0x1d0]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x288], r15
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b6e7
mov r15, qword [rsp + 0x58]
lea rax, [rbp + 0x1d8]
lea rdx, str.DefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b6ca
mov r13, qword [rsp + 0x68]
lea rax, [rbp + 0x1e0]
lea rdx, str.ShellOpenCommand
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x2a0], r12
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b6ad
mov r12, qword [rsp + 0x50]
lea rcx, [rbx + 0xe0]
mov qword [rsp + 0x290], r14
cmp qword [rcx + 0x18], 8
jb 0x14003b2d3
mov rcx, qword [rcx]
or rdi, 0xffffffffffffffff
test rcx, rcx
je 0x14003b30f
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b2e0
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx + 0x100]
cmp qword [rcx + 0x18], 8
jb 0x14003b320
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b35f
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b330
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x38], 8
lea r14, [rbx + 0x20]
jb 0x14003b36f
mov rcx, qword [r14]
jmp 0x14003b372
mov rcx, r14
test rcx, rcx
je 0x14003b3af
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b380
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x14003b3bd
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b3f9
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b3c5
lea eax, [rax*2 + 2]
lea rdx, str.LocalizedString
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x70], rsi
je 0x14003b449
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x14003b40d
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b449
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b415
lea eax, [rax*2 + 2]
lea rdx, str.InfoTip
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x90], rsi
je 0x14003b4a4
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x14003b463
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b4a4
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b470
lea eax, [rax*2 + 2]
lea rdx, str.System.ApplicationName
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xb0], rsi
je 0x14003b504
lea rcx, [rbx + 0xa0]
cmp qword [rcx + 0x18], 8
jb 0x14003b4be
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b504
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b4d0
lea eax, [rax*2 + 2]
lea rdx, str.System.ControlPanel.Category
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xd0], rsi
je 0x14003b564
lea rcx, [rbx + 0xc0]
cmp qword [rcx + 0x18], 8
jb 0x14003b51e
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b564
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b530
lea eax, [rax*2 + 2]
lea rdx, str.System.Software.TasksFileUrl
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003b580
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b5a0
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140122f68]
mov dword [rcx], eax
jb 0x14003b5bc
mov rbx, qword [rbx]
lea rdx, [rsp + 0x70]
sub rdx, 2
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x14003b5c5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x14003b5e0
lea rax, [rbp + 0x1e8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b690
cmp qword [r14 + 0x18], 8
mov rbx, qword [rsp + 0x60]
jb 0x14003b64b
mov r14, qword [r14]
test r14, r14
je 0x14003b680
cmp word [r14 + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x14003b650
lea eax, [rdi*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14003b695
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b695
mov esi, 0xfffffffb
mov r14, qword [rsp + 0x290]
test r12, r12
je 0x14003b6b2
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6b2
mov esi, 0xfffffffc
mov r12, qword [rsp + 0x2a0]
test r13, r13
je 0x14003b6cf
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6cf
mov esi, 0xfffffffd
mov r13, qword [rsp + 0x298]
test r15, r15
je 0x14003b6ec
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6ec
mov esi, 0xfffffffe
mov r15, qword [rsp + 0x288]
mov eax, esi
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret
or rax, 0xffffffffffffffff
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret