Function at 0x140044b70
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [rcx + 0x10], 0x26
mov rbx, rcx
jne 0x1400451c9
cmp qword [rcx + 0x30], 0
je 0x1400451c9
cmp qword [rcx + 0x110], 0
je 0x1400451c9
cmp qword [rcx + 0xf0], 0
je 0x1400451c9
cmp qword [rcx + 0x50], 0
je 0x1400451c9
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.1400fa4e0
mov rcx, qword [str.SoftwareClassesCLSID]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140044c00
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x140044c20
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140140710]
mov dword [rcx], eax
jb 0x140044c3e
mov r8, qword [rbx]
jmp 0x140044c41
mov r8, rbx
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x140044c50
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x140044c60
lea rax, [rbp + 0x1d0]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x288], r15
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400451a7
mov r15, qword [rsp + 0x58]
lea rax, [rbp + 0x1d8]
lea rdx, str.DefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004518a
mov r13, qword [rsp + 0x68]
lea rax, [rbp + 0x1e0]
lea rdx, str.ShellOpenCommand
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x2a0], r12
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004516d
mov r12, qword [rsp + 0x50]
lea rcx, [rbx + 0xe0]
mov qword [rsp + 0x290], r14
cmp qword [rcx + 0x18], 8
jb 0x140044d93
mov rcx, qword [rcx]
or rdi, 0xffffffffffffffff
test rcx, rcx
je 0x140044dcf
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044da0
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx + 0x100]
cmp qword [rcx + 0x18], 8
jb 0x140044de0
mov rcx, qword [rcx]
test rcx, rcx
je 0x140044e1f
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044df0
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x38], 8
lea r14, [rbx + 0x20]
jb 0x140044e2f
mov rcx, qword [r14]
jmp 0x140044e32
mov rcx, r14
test rcx, rcx
je 0x140044e6f
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044e40
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x140044e7d
mov rcx, qword [rcx]
test rcx, rcx
je 0x140044eb9
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044e85
lea eax, [rax*2 + 2]
lea rdx, str.LocalizedString
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x70], rsi
je 0x140044f09
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x140044ecd
mov rcx, qword [rcx]
test rcx, rcx
je 0x140044f09
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044ed5
lea eax, [rax*2 + 2]
lea rdx, str.InfoTip
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x90], rsi
je 0x140044f64
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x140044f23
mov rcx, qword [rcx]
test rcx, rcx
je 0x140044f64
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044f30
lea eax, [rax*2 + 2]
lea rdx, str.System.ApplicationName
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xb0], rsi
je 0x140044fc4
lea rcx, [rbx + 0xa0]
cmp qword [rcx + 0x18], 8
jb 0x140044f7e
mov rcx, qword [rcx]
test rcx, rcx
je 0x140044fc4
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044f90
lea eax, [rax*2 + 2]
lea rdx, str.System.ControlPanel.Category
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xd0], rsi
je 0x140045024
lea rcx, [rbx + 0xc0]
cmp qword [rcx + 0x18], 8
jb 0x140044fde
mov rcx, qword [rcx]
test rcx, rcx
je 0x140045024
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140044ff0
lea eax, [rax*2 + 2]
lea rdx, str.System.Software.TasksFileUrl
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140045040
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x140045060
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140140710]
mov dword [rcx], eax
jb 0x14004507c
mov rbx, qword [rbx]
lea rdx, [rsp + 0x70]
sub rdx, 2
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x140045085
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x1400450a0
lea rax, [rbp + 0x1e8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140045150
cmp qword [r14 + 0x18], 8
mov rbx, qword [rsp + 0x60]
jb 0x14004510b
mov r14, qword [r14]
test r14, r14
je 0x140045140
cmp word [r14 + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x140045110
lea eax, [rdi*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140045155
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140045155
mov esi, 0xfffffffb
mov r14, qword [rsp + 0x290]
test r12, r12
je 0x140045172
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140045172
mov esi, 0xfffffffc
mov r12, qword [rsp + 0x2a0]
test r13, r13
je 0x14004518f
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004518f
mov esi, 0xfffffffd
mov r13, qword [rsp + 0x298]
test r15, r15
je 0x1400451ac
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400451ac
mov esi, 0xfffffffe
mov r15, qword [rsp + 0x288]
mov eax, esi
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret
or rax, 0xffffffffffffffff
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret