Function at 0x100042c04
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
xor r12d, r12d
mov r13d, 0x103
lea rdi, [0x100000000]
lea ebp, [r12 + 1]
lea r14d, [r12 + 2]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r15d, r12d
mov dword [rsp + 0x58], r12d
or rsi, 0xffffffffffffffff
cmp r15d, r12d
jne 0x100042c7b
mov ebx, r12d
lea rdx, [0x100026850]
jmp 0x100042c84
mov ebx, ebp
lea rdx, [0x10001edf0]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x1000445e5
cmp ebx, r12d
je 0x100042d7e
lea rax, [rsp + 0x290]
cmp rax, r12
je 0x100042d7e
lea rcx, [rsp + 0x290]
mov r8, r13
mov edx, ebp
call fcn.100040758
cmp eax, r12d
je 0x100042d7e
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x10001c3b0]
lea rcx, [rsp + 0x290]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x100042d7e
lea rcx, [rsp + 0x290]
call fcn.1000400f0
cmp eax, r12d
je 0x100042d7e
xor eax, eax
lea rdi, [rsp + 0x290]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x10001edd0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x10001eab8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
movsxd r14, ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x10004361d
xor r15d, r15d
mov r12d, r15d
mov rsi, r15
mov rdi, qword [rsi + rdi + 0x4a140]
cmp rdi, r15
je 0x1000435ef
cmp r14, r15
jne 0x100042df7
lea rax, [0x100000000]
cmp dword [rsi + rax + 0x4a1b8], r15d
je 0x1000435ef
lea rax, [rsp + 0x80]
mov rdx, r13
lea rcx, [rsp + 0x80]
sub rdi, rax
mov r8d, r15d
lea rax, [rdx + 0x7ffffefb]
cmp rax, r15
je 0x100042e32
movzx eax, word [rdi + rcx]
cmp ax, r15w
je 0x100042e32
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x100042e10
cmp rdx, r15
jne 0x100042e41
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r15d
mov word [rcx], r15w
jl 0x1000435ef
lea rbx, [rsp + 0x80]
lea rcx, [rsp + 0x80]
lea rdx, [0x1000268a0]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbp, rax
cmp rax, r15
je 0x100042e7b
mov word [rax], r15w
add rbp, 2
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x100043577
lea rdi, [0x100000000]
mov ebx, 1
mov rdx, qword [rsi + rdi + 0x4a148]
cmp rdx, r15
je 0x100042f10
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x10001eae8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
cmp r14, r15
je 0x100042f60
mov eax, dword [rsi + rdi + 0x4a1c8]
cmp eax, r15d
je 0x100042f60
cmp eax, 0xffffffff
je 0x100042f60
lea rcx, [0x10004a1c8]
mov eax, r12d
lea rdx, [0x1000268a8]
xor r8d, r8d
imul rax, rax, 0x98
add rax, rcx
mov ecx, 4
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsi + rdi + 0x4a1cc]
cmp eax, r15d
je 0x100042fab
cmp eax, 0xffffffff
je 0x100042fab
lea rcx, [0x10004a1cc]
mov eax, r12d
lea rdx, [0x1000268b8]
xor r8d, r8d
imul rax, rax, 0x98
add rax, rcx
mov ecx, 4
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsi + rdi + 0x4a1d0]
cmp rdx, r15
je 0x100042ff6
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100020a68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov edx, dword [rsi + rdi + 0x4a150]
cmp edx, r15d
je 0x1000430e4
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r15d
je 0x1000430e4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022ec0]
mov r9d, ebx
not rcx
xor r8d, r8d
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov r9d, dword [rsi + rdi + 0x4a150]
lea r8, [0x100023170]
lea rcx, [rsp + 0x80]
mov rdx, r13
call fcn.10002e570
cmp eax, r15d
jl 0x1000430e4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022ef0]
mov r9d, ebx
not rcx
xor r8d, r8d
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
cmp r14, r15
je 0x10004313d
mov rcx, qword [rsi + rdi + 0x4a1c0]
cmp rcx, r15
je 0x100043188
lea rdx, [rsp + 0x80]
xor r8d, r8d
call fcn.100045e8c
cmp eax, r15d
jl 0x100043188
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
jmp 0x100043169
mov rdx, qword [rsi + rdi + 0x4a158]
cmp rdx, r15
je 0x100043188
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022ea0]
mov r9d, ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rdx, qword [rsi + rdi + 0x4a160]
cmp rdx, r15
je 0x1000431d5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022f28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
jmp 0x1000431e7
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022f28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor r8d, r8d
mov r9d, ebx
cmp r14, r15
je 0x100043220
mov rdx, qword [rsi + rdi + 0x4a170]
cmp rdx, r15
je 0x100043260
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
jmp 0x100043274
mov rdx, qword [rsi + rdi + 0x4a168]
cmp rdx, r15
je 0x100043260
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100020528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004328b
lea rax, [0x100020520]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100020528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp r14, r15
jne 0x1000432b7
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001c3b0]
lea rdx, [0x100020500]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], 0x1a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rcx, qword [rsi + rdi + 0x4a178]
cmp rcx, r15
je 0x10004334f
lea rdx, [0x100020ae8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r8d, r8d
mov r9d, ebx
cmp eax, r15d
jne 0x10004330f
mov rcx, qword [rsp + 0x50]
lea rax, [0x100020aa0]
lea rdx, [0x100022e68]
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004334f
mov rdx, qword [rsi + rdi + 0x4a178]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022e68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rdx, qword [rsi + rdi + 0x4a1a0]
cmp rdx, r15
je 0x10004339a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100001da8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rdx, qword [rsi + rdi + 0x4a180]
cmp rdx, r15
je 0x1000433e5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022e08]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rdx, qword [rsi + rdi + 0x4a188]
cmp rdx, r15
je 0x100043430
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x1000268d0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rdx, qword [rsi + rdi + 0x4a198]
cmp rdx, r15
je 0x10004347b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022f48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov edx, dword [rsi + rdi + 0x4a190]
cmp edx, r15d
je 0x1000434f2
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r15d
je 0x1000434f2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x1000268f8]
mov r9d, ebx
not rcx
xor r8d, r8d
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdi, [0x100000000]
mov rcx, qword [rsi + rdi + 0x4a1b0]
cmp rcx, r15
je 0x10004355a
lea rdx, [rsp + 0x80]
mov r8d, ebx
call fcn.100045e8c
cmp eax, r15d
jl 0x10004356c
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022e48]
mov r9d, ebx
not rcx
xor r8d, r8d
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004356c
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022e48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, [0x100000000]
lea rax, [rsp + 0x80]
mov rbx, rbp
mov rdi, qword [rsi + rdi + 0x4a140]
mov rdx, r13
lea rcx, [rsp + 0x80]
sub rdi, rax
mov r8d, r15d
lea rax, [rdx + 0x7ffffefb]
cmp rax, r15
je 0x1000435c5
movzx eax, word [rcx + rdi]
cmp ax, r15w
je 0x1000435c5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000435a2
cmp rdx, r15
jne 0x1000435d4
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r15d
mov word [rcx], r15w
jl 0x1000435ea
cmp rbp, r15
je 0x1000435ea
mov rcx, rbp
jmp 0x100042e5e
mov ebp, 1
add r12d, ebp
add rsi, 0x98
lea rdi, [0x100000000]
cmp r12d, 0x23
jb 0x100042dcc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rsp + 0x58]
xor r12d, r12d
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x100022cf0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100043abc
mov rsi, r12
mov r12d, 0x1d
xor r9d, r9d
mov qword [rsp + 0x70], r12
lea r15, [0x100000000]
mov rdi, qword [rsi + r15 + 0x4bd90]
cmp rdi, r9
je 0x100043a97
cmp r14, r9
jne 0x10004369b
cmp dword [rsi + r15 + 0x4bdd4], r9d
je 0x100043a97
lea rax, [rsp + 0x80]
mov rdx, r13
lea rcx, [rsp + 0x80]
sub rdi, rax
mov r8d, r9d
lea rax, [rdx + 0x7ffffefb]
cmp rax, r9
je 0x1000436d6
movzx eax, word [rdi + rcx]
cmp ax, r9w
je 0x1000436d6
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x1000436b4
cmp rdx, r9
jne 0x1000436e5
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r9d
mov word [rcx], r9w
jl 0x100043a97
lea rdx, [0x1000268a0]
lea rcx, [rsp + 0x80]
lea rbx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
lea r12, [0x100020520]
xor ecx, ecx
mov rbp, rax
cmp rax, rcx
je 0x100043727
mov word [rax], cx
add rbp, 2
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor r9d, r9d
cmp eax, r9d
jne 0x100043a14
mov rdx, qword [rsi + r15 + 0x4bd98]
lea ebx, [r9 + 1]
cmp rdx, r9
je 0x1000437b2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022fe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
mov rdx, qword [rsi + r15 + 0x4bda0]
cmp rdx, r9
je 0x1000437f9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100023008]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
mov rdx, qword [rsi + r15 + 0x4bda8]
cmp rdx, r9
je 0x100043840
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, ebx
xor r8d, r8d
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022fc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
xor r8d, r8d
cmp r14, r9
je 0x100043880
mov rdx, qword [rsi + r15 + 0x4bdc0]
cmp rdx, r9
mov r9d, ebx
je 0x100043960
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
jmp 0x10004396d
mov rdx, qword [rsi + r15 + 0x4bdb8]
cmp rdx, r9
mov r9d, ebx
je 0x100043960
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100020528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [0x100001cd0]
mov dword [rsp + 0x28], 0x4e
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100001da8]
mov r9d, ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsi + r15 + 0x4bdc8]
test rcx, rcx
je 0x1000439bd
lea rdx, [rsp + 0x80]
mov r8d, ebx
call fcn.100045e8c
test eax, eax
js 0x1000439cf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022e48]
mov r9d, ebx
not rcx
xor r8d, r8d
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1000439cf
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100020528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r14, r14
je 0x1000438c5
mov rdx, qword [rsi + r15 + 0x4bdb0]
test rdx, rdx
je 0x1000438f1
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
jmp 0x1000438d9
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022e48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rsi + r15 + 0x4bdd0], 0
jne 0x100043a06
mov rcx, qword [rsp + 0x50]
lea rax, [0x10002692c]
lea rdx, [0x100026938]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov rdi, qword [rsi + r15 + 0x4bd90]
lea rax, [rsp + 0x80]
mov rbx, rbp
mov rdx, r13
lea rcx, [rsp + 0x80]
mov r8d, r9d
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, r9
je 0x100043a5b
movzx eax, word [rcx + rdi]
cmp ax, r9w
je 0x100043a5b
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100043a38
cmp rdx, r9
jne 0x100043a6a
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r9d
mov word [rcx], r9w
jl 0x100043a8d
cmp rbp, r9
je 0x100043a8d
lea rdx, [0x1000268a0]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcsstr]
jmp 0x100043716
mov r12, qword [rsp + 0x70]
mov ebp, 1
add rsi, 0x48
sub r12, rbp
mov qword [rsp + 0x70], r12
jne 0x100043677
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rsp + 0x58]
xor r12d, r12d
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x100022d08]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100043dcb
mov rdi, qword [0x10004b608]
cmp rdi, r12
je 0x100043dc0
cmp r14, r12
jne 0x100043b20
cmp dword [0x10004b628], r12d
je 0x100043dc0
lea rax, [rsp + 0x80]
mov rdx, r13
lea rcx, [rsp + 0x80]
sub rdi, rax
mov r8d, r12d
lea rax, [rdx + 0x7ffffefb]
cmp rax, r12
je 0x100043b5b
movzx eax, word [rdi + rcx]
cmp ax, r12w
je 0x100043b5b
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x100043b39
cmp rdx, r12
jne 0x100043b6a
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r12d
mov word [rcx], r12w
jl 0x100043dc0
lea rsi, [rsp + 0x80]
lea rcx, [rsp + 0x80]
lea rdx, [0x1000268a0]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbx, rax
cmp rax, r12
je 0x100043ba4
mov word [rax], r12w
add rbx, 2
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100043d56
mov rdx, qword [0x10004b610]
or rsi, 0xffffffffffffffff
cmp rdx, r12
je 0x100043c28
xor eax, eax
mov rdi, rdx
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100023048]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [0x10004b618]
cmp rdx, r12
je 0x100043c6a
xor eax, eax
mov rdi, rdx
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100020760]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x10004b620]
cmp rcx, r12
je 0x100043cd0
lea rdx, [rsp + 0x80]
mov r8d, ebp
call fcn.100045e8c
cmp eax, r12d
jl 0x100043ce2
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100022e48]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100043ce2
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022e48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp r14, r12
je 0x100043d4b
mov rcx, qword [0x10004b638]
cmp rcx, r12
je 0x100043d4b
lea rdx, [rsp + 0x80]
mov r8d, ebp
call fcn.100045e8c
cmp eax, r12d
jl 0x100043d4b
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x10001de60]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [0x10004b608]
lea rax, [rsp + 0x80]
mov rsi, rbx
mov rdx, r13
lea rcx, [rsp + 0x80]
mov r8d, r12d
sub rdi, rax
lea rax, [rdx + 0x7ffffefb]
cmp rax, r12
je 0x100043d9b
movzx eax, word [rcx + rdi]
cmp ax, r12w
je 0x100043d9b
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x100043d79
cmp rdx, r12
jne 0x100043daa
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r12d
mov word [rcx], r12w
jl 0x100043dc0
cmp rbx, r12
je 0x100043dc0
mov rcx, rbx
jmp 0x100043b87
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x100022d20]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x10004402c
lea rbx, [0x10004b640]
mov esi, 2
lea r15, [0x100020520]
mov rdx, qword [rbx]
cmp rdx, r12
je 0x10004400f
cmp r14, r12
jne 0x100043e3b
cmp dword [rbx + 0x28], r12d
je 0x10004400f
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x10004400f
mov edx, dword [rbx + 8]
cmp edx, r12d
je 0x100043edd
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x100043edd
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx + 0x10]
cmp rcx, r12
je 0x100043f3f
lea rdx, [rsp + 0x80]
mov r8d, ebp
call fcn.100045e8c
cmp eax, r12d
jl 0x100043f3f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x1000207e0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx + 0x18]
xor r8d, r8d
mov r9d, ebp
cmp rdx, r12
je 0x100043f6f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
jmp 0x100043f7c
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100020528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx + 0x20]
cmp rcx, r12
je 0x100043ff2
lea rdx, [rsp + 0x80]
mov r8d, ebp
call fcn.100045e8c
cmp eax, r12d
jl 0x100044004
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022e48]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100044004
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022e48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x30
sub rsi, rbp
jne 0x100043e20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x100026950]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x1000445cb
mov ebp, 0x13
lea rbx, [0x10004b6a8]
lea eax, [rbp + 0x2d]
mov rdx, qword [rbx - 8]
cmp rdx, r12
je 0x1000445ae
cmp r14, r12
jne 0x100044099
cmp dword [rbx + 0x30], r12d
je 0x1000445ae
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x1000445a9
mov edx, dword [rbx]
cmp edx, r12d
je 0x10004422b
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x10004422b
xor eax, eax
or rsi, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
mov rcx, rsi
lea r9d, [rsi + 2]
xor r8d, r8d
repne scasw ax, word [rdi]
xor edx, edx
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [rsi + 0x41]
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x82]
cmp rax, r12
je 0x10004416c
lea rcx, [rsp + 0x82]
mov edx, r13d
call fcn.10003fbdc
jmp 0x10004416f
mov eax, r12d
cmp eax, r12d
je 0x10004422b
lea r8, [0x100022f20]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x10004422b
lea rcx, [rsp + 0x80]
mov edx, 0x2d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r11, rax
cmp rax, r12
je 0x10004422b
mov r9d, dword [rbx]
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
mov rdx, r13
lea r8, [0x100023170]
repne scasw ax, word [rdi]
not rcx
dec rcx
sub rdx, rcx
lea rcx, [r11 + 2]
call fcn.10002e570
cmp eax, r12d
jl 0x10004422b
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100026960]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [rbx + 4]
cmp esi, r12d
je 0x1000443c7
mov edx, 1
mov r9d, 0x452
mov r8d, 0xa28
lea ecx, [rdx + 4]
call fcn.1000404f0
cmp eax, r12d
je 0x100044271
mov rdx, qword [rbx - 8]
lea rcx, [0x1000242f8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov ecx, 0x2727
cmp eax, r12d
cmove esi, ecx
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov edx, esi
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x1000443c7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100026988]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 0x40
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x82]
cmp rax, r12
je 0x100044306
lea rcx, [rsp + 0x82]
mov edx, r13d
call fcn.10003fbdc
jmp 0x100044309
mov eax, r12d
cmp eax, r12d
je 0x1000443c7
lea r8, [0x100022f20]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x1000443c7
lea rcx, [rsp + 0x80]
mov edx, 0x2d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r11, rax
cmp rax, r12
je 0x1000443c7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
mov rdx, r13
lea r8, [0x100023170]
not rcx
mov r9d, esi
dec rcx
sub rdx, rcx
lea rcx, [r11 + 2]
call fcn.10002e570
cmp eax, r12d
jl 0x1000443c7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x1000269a0]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 8], r12
je 0x100044455
mov edx, 1
mov r9d, 0x452
mov r8d, 0xa28
lea ecx, [rdx + 4]
call fcn.1000404f0
cmp eax, r12d
je 0x10004441b
mov rdx, qword [rbx - 8]
lea rcx, [0x1000242f8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
jne 0x10004441b
lea rax, [0x1000241d0]
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
jmp 0x10004443a
mov rdx, qword [rbx + 8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10001eab8]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx + 0x10]
cmp rdx, r12
je 0x100044494
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 1
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022cf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx + 0x18]
cmp rdx, r12
je 0x1000444d3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 1
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022d08]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx + 0x20]
cmp rdx, r12
je 0x100044514
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 1
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100022d20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100044526
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022d20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbx + 0x28]
cmp rcx, r12
je 0x10004458c
lea rdx, [rsp + 0x80]
mov r8d, 1
call fcn.100045e8c
cmp eax, r12d
jl 0x10004459e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x100022e48]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004459e
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100022e48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x40
add rbx, rax
sub rbp, 1
jne 0x10004407d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or rsi, 0xffffffffffffffff
lea rdi, [0x100000000]
lea r14d, [rsi + 3]
add r15d, ebp
cmp r15d, r14d
mov dword [rsp + 0x58], r15d
jl 0x100042c6a
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1000404f0
cmp eax, r12d
jne 0x100044a38
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov rbx, 0xffffffff80000000
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x1000269d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x100026a60]
mov r15d, 0x4e
cmp eax, r12d
jne 0x1000446db
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026a10]
lea rdx, [0x100020760]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100026ab0]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026ad0]
lea rdx, [0x100026b20]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026b30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100044793
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026b70]
lea rdx, [0x100020760]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100026ab0]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026bc0]
lea rdx, [0x100026b20]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026c10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x100026c20]
cmp eax, r12d
jne 0x1000447fe
mov rcx, qword [rsp + 0x50]
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x1a
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x10004495e
mov rcx, qword [rsp + 0x50]
lea rax, [0x100001db4]
lea rdx, [0x100026c40]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov edx, 0x26c4
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x1000448c3
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x80]
cmp rax, r12
je 0x1000448e2
lea rcx, [rsp + 0x80]
mov edx, r13d
call fcn.10003fbdc
jmp 0x1000448e5
mov eax, r12d
cmp eax, r12d
je 0x100044953
lea r9, [rsp + 0x80]
lea r8, [0x100026c50]
lea rcx, [rsp + 0x290]
mov edx, 0x104
call fcn.10002e570
cmp eax, r12d
jl 0x100044953
xor eax, eax
lea rdi, [rsp + 0x290]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100026960]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026c68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100044a38
lea rax, [rsp + 0x80]
cmp rax, r12
je 0x100044a2d
lea rcx, [rsp + 0x80]
mov r8, r13
mov edx, ebp
call fcn.100040758
cmp eax, r12d
je 0x100044a2d
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x100026ca0]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x100044a2d
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x452
mov r8d, 0xa28
mov edx, ebp
mov ecx, 5
call fcn.1000404f0
cmp eax, r12d
je 0x100044f6d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov r15, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [0x100026cd0]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x26c7
cmp eax, r12d
jne 0x100044cf9
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026d48]
lea rdx, [0x10001eae8]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], 0x1e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [rsp + 0x80]
cmp rdx, r12
je 0x100044b6a
lea rcx, [rsp + 0x80]
mov r8, r13
mov edx, ebp
call fcn.100040758
cmp eax, r12d
je 0x100044b6a
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x100026ca0]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x100044b6a
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100022ea0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov edx, ebx
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x100044c35
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100022ec0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [0x100023170]
lea rcx, [rsp + 0x80]
mov r9d, ebx
mov rdx, r13
call fcn.10002e570
cmp eax, r12d
jl 0x100044c35
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [0x100022ef0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x100025808]
lea rdx, [0x100020a68]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x10001c3b0]
lea rdx, [0x100020528]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], 0x1a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, 4
lea rax, [rsp + 0x58]
lea rdx, [0x1000268a8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x58], 7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [0x1000268b8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x58], 0xf
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov edx, ebx
mov dword [rsp + 0x58], ebx
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x100044f6d
lea r8, [0x100026d68]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x100044f6d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026d80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, [0x100026dfc]
cmp eax, r12d
jne 0x100044dcf
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
mov rdx, rbx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026e00]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100044f01
mov eax, 0x40
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x82]
cmp rax, r12
je 0x100044e38
lea rcx, [rsp + 0x82]
mov edx, r13d
call fcn.10003fbdc
jmp 0x100044e3b
mov eax, r12d
cmp eax, r12d
je 0x100044ef6
lea r8, [0x100022f20]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, r12d
jl 0x100044ef6
lea rcx, [rsp + 0x80]
mov edx, 0x2d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r11, rax
cmp rax, r12
je 0x100044ef6
mov r9d, dword [rsp + 0x58]
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
lea r8, [0x100023170]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
sub r13, rcx
lea rcx, [r11 + 2]
mov rdx, r13
call fcn.10002e570
cmp eax, r12d
jl 0x100044ef6
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
mov r9d, ebp
xor r8d, r8d
not rcx
mov rdx, rbx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [0x100026e90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100044f6d
mov rcx, qword [rsp + 0x50]
lea rax, [0x100026f00]
mov r9d, ebp
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 0x12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret