Function at 0x100031418
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r13d, r13d
mov rbx, rcx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov r12d, r13d
mov qword [rsp + 0x50], r13
mov word [rsp + 0x60], r13w
call sub.msvcrt.dll_memset
cmp rbx, r13
jne 0x100031481
lea ecx, [r13 + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100031747
mov eax, 0x7fffffff
mov r8, rbx
mov ecx, r13d
mov rdx, rax
cmp word [r8], r13w
je 0x10003149f
add r8, 2
sub rdx, 1
jne 0x10003148f
cmp rdx, r13
jne 0x1000314ae
mov ecx, 0x80070057
mov rax, r13
jmp 0x1000314b1
sub rax, rdx
cmp ecx, r13d
jge 0x1000314cd
movzx edx, cx
mov eax, edx
or eax, 0x80070000
cmp edx, r13d
cmovle eax, edx
cmp eax, ecx
cmove ecx, edx
jmp 0x100031474
mov edx, 0x104
cmp rax, rdx
jbe 0x1000314de
mov ecx, 0x32
jmp 0x100031474
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov r8, rbx
call fcn.100014fe8
cmp eax, r13d
mov r11d, eax
jge 0x100031515
movzx ecx, ax
mov eax, ecx
or eax, 0x80070000
cmp ecx, r13d
cmovle eax, ecx
cmp eax, r11d
cmove r11d, ecx
mov ecx, r11d
jmp 0x100031474
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
lea rcx, [rsp + 0x60]
cmp eax, r13d
je 0x100031532
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
jmp 0x100031538
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor r8d, r8d
mov ebx, 0xa28
lea ecx, [r8 + 2]
mov rdx, rbx
call fcn.10003228c
mov rdi, rax
cmp rax, r13
je 0x10003147a
mov rdx, rbx
mov rcx, rax
call fcn.100031370
cmp eax, r13d
je 0x100031571
cmp eax, 2
jne 0x10003171b
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
je 0x100031715
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.10002c644
cmp eax, r13d
jl 0x10003171b
mov rbx, r13
mov rax, rdi
mov qword [rsp + 0x58], rbx
cmp word [rdi], r13w
je 0x10003164f
inc rbx
cmp rax, r13
jne 0x1000315c0
mov rax, r13
jmp 0x1000315cf
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
add rax, 2
cmp word [rax], r13w
jne 0x1000315b3
mov qword [rsp + 0x58], rbx
cmp rbx, 9
jbe 0x10003164f
lea rbp, [rbx - 9]
sub rbx, rbp
mov qword [rsp + 0x58], rbx
mov rsi, rdi
mov rax, rdi
mov rbx, r13
cmp word [rdi], r13w
je 0x100031645
inc rbx
cmp rax, r13
jne 0x100031608
mov rax, r13
jmp 0x100031617
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
add rax, 2
cmp word [rax], r13w
jne 0x1000315fb
cmp rbx, 1
jbe 0x100031645
dec rbx
cmp rsi, r13
jne 0x100031630
mov rsi, r13
jmp 0x10003163f
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
lea rsi, [rax + 2]
sub rbx, 1
jne 0x100031626
sub rbp, 1
mov word [rsi], r13w
jne 0x1000315ec
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.10002c734
cmp eax, r13d
mov r11d, eax
jl 0x100031679
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.10002c5ac
cmp eax, r13d
mov r11d, eax
jge 0x100031695
movzx ecx, ax
mov eax, ecx
or eax, 0x80070000
cmp ecx, r13d
cmovle eax, ecx
cmp eax, r11d
cmove r11d, ecx
mov ecx, r11d
jmp 0x10003170d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
lea rdx, [0x100003e38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r13d
je 0x1000316dc
mov qword [rsp + 0x50], r13
jmp 0x10003170b
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100007780]
add eax, eax
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x100031715
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10003171b
mov r12d, 1
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10003172b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r12d
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100068440
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret