Function at 0x1000082ec
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4070
call fcn.10001ed40
sub rsp, rax
mov rax, qword [0x10002e120]
xor rax, rsp
mov qword [rsp + 0x4060], rax
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
cmp edx, ebp
je 0x1000085e1
cmp rcx, rbp
je 0x1000087ee
mov rsi, rcx
lea rcx, [rsp + 0x2062]
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x2060], bp
call sub.msvcrt.dll_memset
cmp dword [rsi + 0x28], 0xffffffff
je 0x1000087ee
xor ecx, ecx
mov word [rsp + 0x60], cx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x1ffe
mov ebx, 0x1000
call sub.msvcrt.dll_memset
xor r11d, r11d
mov r8, rbx
mov edx, r11d
cmp qword [rdi], r11
je 0x100008440
mov r10, qword [rdi + 8]
mov rbp, qword [rdi]
lea rax, [rsp + 0x2060]
mov r9, r10
lea rcx, [rsp + 0x2060]
sub r9, rax
lea rax, [r8 + 0x7fffeffe]
cmp rax, r11
je 0x1000083ce
movzx eax, word [r9 + rcx]
cmp ax, r11w
je 0x1000083ce
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x1000083aa
cmp r8, r11
jne 0x1000083dc
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r11d
mov word [rcx], r11w
jl 0x1000085c6
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
sub r10, rax
mov ebx, r11d
lea rax, [rdx + 0x7fffeffe]
cmp rax, r11
je 0x100008420
movzx eax, word [r10 + rcx]
cmp ax, r11w
je 0x100008420
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000083fc
cmp rdx, r11
jne 0x10000842e
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r11d
mov word [rcx], r11w
jl 0x1000087ee
jmp 0x1000084d1
lea r9, [rsp + 0x2060]
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x60]
sub r9, rax
lea rax, [r8 + 0x7fffeffe]
cmp rax, r11
je 0x100008479
movzx eax, word [r9 + rcx]
cmp ax, r11w
je 0x100008479
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x100008455
cmp r8, r11
jne 0x100008487
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r11d
mov word [rcx], r11w
jl 0x1000085c6
lea r8, [0x1000017a0]
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.100008820
xor ecx, ecx
cmp eax, ecx
jl 0x1000087f0
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.100008820
xor r11d, r11d
cmp eax, r11d
mov ebx, eax
jl 0x1000087f0
cmp rbp, r11
je 0x1000085cd
test byte [rdi + 0x28], 6
je 0x1000084fe
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.10000813c
xor r11d, r11d
cmp eax, r11d
je 0x1000084fe
cmp eax, 2
jne 0x1000085cd
test byte [rdi + 0x28], 8
lea rdx, [rsp + 0x60]
mov rcx, rbp
je 0x100008532
mov r8, qword [rdi + 0x10]
call fcn.100008258
xor ecx, ecx
cmp eax, ecx
je 0x1000085b3
cmp eax, 2
je 0x1000085b3
mov ebx, 0x80040201
jmp 0x1000085b3
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edx, edx
cmp eax, edx
jne 0x1000085cf
mov rcx, qword [rdi + 0x18]
cmp rcx, rdx
je 0x1000085a6
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rsp + 0x50]
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
add rdi, 0x30
cmp dword [rdi + 0x28], 0xffffffff
je 0x1000087ee
jmp 0x10000835f
mov eax, edx
jmp 0x1000087f0
xor edx, edx
mov rcx, rsi
call fcn.1000082ec
mov eax, 0x80040201
jmp 0x1000087f0
cmp rcx, rbp
je 0x1000087ee
lea rcx, [rsp + 0x2062]
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x2060], bp
call sub.msvcrt.dll_memset
xor r11d, r11d
cmp dword [rdi + 0x28], 0xffffffff
mov rsi, r11
je 0x1000087ee
mov ebp, 0x80040201
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x1ffe
mov ebx, 0x1000
mov word [rsp + 0x60], r11w
call sub.msvcrt.dll_memset
xor r11d, r11d
mov r8, rbx
mov edx, r11d
cmp qword [rdi], r11
je 0x1000086fe
mov r10, qword [rdi + 8]
mov rsi, qword [rdi]
lea rax, [rsp + 0x2060]
mov r9, r10
lea rcx, [rsp + 0x2060]
sub r9, rax
lea rax, [r8 + 0x7fffeffe]
cmp rax, r11
je 0x10000868c
movzx eax, word [rcx + r9]
cmp ax, r11w
je 0x10000868c
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x100008668
cmp r8, r11
jne 0x10000869a
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r11d
mov word [rcx], r11w
jl 0x1000085c6
lea rax, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x60]
sub r10, rax
mov ebx, r11d
lea rax, [rdx + 0x7fffeffe]
cmp rax, r11
je 0x1000086de
movzx eax, word [rcx + r10]
cmp ax, r11w
je 0x1000086de
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000086ba
cmp rdx, r11
jne 0x1000086ec
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r11d
mov word [rcx], r11w
jl 0x1000087ee
jmp 0x10000878b
lea r9, [rsp + 0x2060]
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x60]
sub r9, rax
lea rax, [r8 + 0x7fffeffe]
cmp rax, r11
je 0x100008737
movzx eax, word [rcx + r9]
cmp ax, r11w
je 0x100008737
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x100008713
cmp r8, r11
jne 0x100008745
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r11d
mov word [rcx], r11w
jl 0x1000085c6
lea r8, [0x1000017a0]
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.100008820
xor ecx, ecx
cmp eax, ecx
jl 0x1000087f0
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.100008820
xor r11d, r11d
cmp eax, r11d
mov ebx, eax
jl 0x1000087f0
cmp rsi, r11
je 0x1000087e0
mov eax, dword [rdi + 0x28]
test al, 1
jne 0x1000087bd
test al, 2
jne 0x1000087bd
test al, 8
jne 0x1000087c1
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.10000813c
xor r11d, r11d
cmp eax, r11d
je 0x1000087e0
cmp eax, 2
je 0x1000087e0
mov ebx, ebp
jmp 0x1000087e0
test al, 8
je 0x1000087e0
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.100008258
xor r11d, r11d
cmp eax, r11d
je 0x1000087e0
cmp eax, 2
cmovne ebx, ebp
add rdi, 0x30
cmp dword [rdi + 0x28], 0xffffffff
jne 0x10000861c
mov eax, ebx
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.10001e360
lea r11, [rsp + 0x4070]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret