Function at 0x417b70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2088]
mov eax, 0x2150
call fcn.00422ec0
sub rsp, rax
mov r12, rdx
mov r15, r8
lea rdx, [rbp + 0x50]
mov r13, rcx
call fcn.00418370
xor ebx, ebx
test eax, eax
js 0x41801a
lea rdx, str.SMDB
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, 0x4008
test eax, eax
jne 0x417bdd
lea edi, [rbx + 8]
jmp 0x417c2c
lea rdx, [0x0049471c]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x417bf6
mov edi, esi
jmp 0x417c2c
lea rdx, [0x00494720]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x417c10
lea edi, [rax + 0x13]
jmp 0x417c2c
lea rdx, [0x00494724]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x418015
lea edi, [rax + 0x11]
mov rcx, qword [r13]
movzx edx, word [rcx]
sub edx, 9
je 0x417c47
sub edx, 1
je 0x417c47
sub edx, 3
je 0x417c47
cmp edx, 0x13
jne 0x417c53
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r13], rax
jmp 0x417c2c
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.00418370
test eax, eax
js 0x41801a
cmp edi, 8
je 0x417fb3
cmp edi, 0x11
je 0x417df7
cmp edi, 0x13
je 0x417dbb
cmp edi, esi
jne 0x417ffd
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov rax, rsi
lea rcx, [rbp + 0x50]
inc rax
cmp word [rcx + rax*2], bx
jne 0x417c9a
add eax, 2
movsxd rcx, eax
je 0x417cdb
xor edx, edx
mov rax, rsi
div rcx
cmp rax, 2
jb 0x418040
lea rdx, [rcx + rcx]
cmp rdx, 0x100
jbe 0x417cdb
lea rcx, [rsp + 0x40]
call fcn.00417614
mov rdi, qword [rsp + 0x40]
jmp 0x417ce5
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
test rdi, rdi
je 0x417d99
lea r14, [rbp + 0x50]
cmp word [rbp + 0x50], bx
je 0x417d40
mov r15d, 0x30
mov rcx, r14
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [r14]
cmp cx, 0x5c
jne 0x417d28
cmp word [rax], r15w
jne 0x417d28
mov rcx, rax
mov word [rdi], bx
call qword [sym.imp.USER32.dll_CharNextW]
mov r14, rax
jmp 0x417d2f
mov word [rdi], cx
add r14, 2
add rdi, 2
cmp word [r14], bx
jne 0x417cfe
mov r15, qword [rbp + 0x20a0]
mov dword [rdi], ebx
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x417d51
lea esi, [rdi + 0xd]
jmp 0x417d9e
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
inc rcx
cmp word [rdx + rcx*2], bx
jne 0x417d5a
inc ecx
lea rdx, [rdx + rcx*2]
lea r8d, [r8 + rcx*2]
cmp ecx, 1
jne 0x417d57
mov dword [rsp + 0x28], r8d
lea r9d, [rcx + 6]
mov rcx, qword [r12]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x40]
mov esi, eax
jmp 0x417d9e
mov esi, select
lea rax, [rsp + 0x48]
cmp rdi, rax
je 0x417ff0
lea rcx, [rsp + 0x40]
call fcn.0041760c
jmp 0x417ff0
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x41801a
mov eax, dword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
jmp 0x417fd9
or rsi, 0xffffffffffffffff
lea rax, [rbp + 0x50]
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], bx
jne 0x417e02
test dil, 1
jne 0x417e6d
mov eax, edi
mov qword [rsp + 0x40], rbx
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
mov r14, r12
je 0x417e54
xor edx, edx
mov rax, rsi
div r14
cmp rax, 1
jb 0x418035
cmp r12, 0x100
jbe 0x417e54
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.00417614
mov rcx, qword [rsp + 0x40]
jmp 0x417e5e
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rcx
test rcx, rcx
jne 0x417e77
lea rcx, [rsp + 0x40]
call fcn.0041760c
mov eax, 0x80004005
jmp 0x41801a
mov r8, r14
xor edx, edx
call fcn.00424830
movsxd rdi, edi
mov r10d, ebx
test rdi, rdi
jle 0x417f6e
mov r11, rbx
mov r15d, 0x30
movzx r9d, word [rbp + r11*2 + 0x50]
mov ecx, r9d
cmp r9d, 0x61
ja 0x417f07
je 0x417f25
cmp ecx, 0x38
ja 0x417ede
je 0x417ed9
sub ecx, r15d
je 0x417ed9
sub ecx, 1
je 0x417ed9
sub ecx, 1
je 0x417ed9
sub ecx, 1
je 0x417ed9
sub ecx, 1
je 0x417ed9
sub ecx, 1
je 0x417ed9
sub ecx, 1
je 0x417ed9
cmp ecx, 1
jne 0x417f20
sub r9b, r15b
jmp 0x417f29
sub ecx, 0x39
je 0x417ed9
sub ecx, 8
je 0x417f01
sub ecx, 1
je 0x417f01
sub ecx, 1
je 0x417f01
sub ecx, 1
je 0x417f01
sub ecx, 1
je 0x417f01
cmp ecx, 1
jne 0x417f20
sub r9b, 0x37
jmp 0x417f29
sub ecx, 0x62
je 0x417f25
sub ecx, 1
je 0x417f25
sub ecx, 1
je 0x417f25
sub ecx, 1
je 0x417f25
cmp ecx, 1
je 0x417f25
mov r9b, bl
jmp 0x417f29
sub r9b, 0x57
mov eax, r10d
test r10d, r10d
jns 0x417f35
lea eax, [r10 + 1]
mov rdx, qword [rsp + 0x40]
mov ecx, r10d
sar eax, 1
and ecx, 1
movsxd r8, eax
inc r10d
shl ecx, 2
mov eax, 4
sub eax, ecx
inc r11
mov cl, al
shl r9b, cl
or byte [r8 + rdx], r9b
cmp r11, rdi
jl 0x417e99
mov r15, qword [rbp + 0x20a0]
mov rax, qword [rsp + 0x40]
mov r9d, 3
mov rcx, qword [rbp + 0x2098]
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x417ff0
lea rcx, [rsp + 0x40]
call fcn.0041760c
jmp 0x417ff0
lea rax, [rbp + 0x50]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], bx
jne 0x417fbb
lea eax, [rsi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov rcx, qword [r12]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x417ffd
mov ecx, esi
call fcn.00418360
jmp 0x41801a
mov rdx, qword [rbp + 0x20a8]
mov rcx, r13
call fcn.00418370
test eax, eax
cmovs ebx, eax
mov eax, ebx
jmp 0x41801a
mov eax, 0x80020009
mov rbx, qword [rsp + 0x2190]
add rsp, 0x2150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.0041805c
int3
mov ecx, 0x80070216
call fcn.0041805c
int3