Function at 0x14003b680
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [rcx + 0x10], 0x26
mov rbx, rcx
jne 0x14003bcd9
cmp qword [rcx + 0x30], 0
je 0x14003bcd9
cmp qword [rcx + 0x110], 0
je 0x14003bcd9
cmp qword [rcx + 0xf0], 0
je 0x14003bcd9
cmp qword [rcx + 0x50], 0
je 0x14003bcd9
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.1400e4220
mov rcx, qword [str.SoftwareClassesCLSID]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003b710
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b730
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140122f58]
mov dword [rcx], eax
jb 0x14003b74e
mov r8, qword [rbx]
jmp 0x14003b751
mov r8, rbx
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b760
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14003b770
lea rax, [rbp + 0x1d0]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x288], r15
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003bcb7
mov r15, qword [rsp + 0x58]
lea rax, [rbp + 0x1d8]
lea rdx, str.DefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003bc9a
mov r13, qword [rsp + 0x68]
lea rax, [rbp + 0x1e0]
lea rdx, str.ShellOpenCommand
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x2a0], r12
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003bc7d
mov r12, qword [rsp + 0x50]
lea rcx, [rbx + 0xe0]
mov qword [rsp + 0x290], r14
cmp qword [rcx + 0x18], 8
jb 0x14003b8a3
mov rcx, qword [rcx]
or rdi, 0xffffffffffffffff
test rcx, rcx
je 0x14003b8df
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b8b0
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx + 0x100]
cmp qword [rcx + 0x18], 8
jb 0x14003b8f0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b92f
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b900
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x38], 8
lea r14, [rbx + 0x20]
jb 0x14003b93f
mov rcx, qword [r14]
jmp 0x14003b942
mov rcx, r14
test rcx, rcx
je 0x14003b97f
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b950
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x14003b98d
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b9c9
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b995
lea eax, [rax*2 + 2]
lea rdx, str.LocalizedString
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x70], rsi
je 0x14003ba19
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x14003b9dd
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003ba19
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b9e5
lea eax, [rax*2 + 2]
lea rdx, str.InfoTip
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x90], rsi
je 0x14003ba74
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x14003ba33
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003ba74
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003ba40
lea eax, [rax*2 + 2]
lea rdx, str.System.ApplicationName
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xb0], rsi
je 0x14003bad4
lea rcx, [rbx + 0xa0]
cmp qword [rcx + 0x18], 8
jb 0x14003ba8e
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003bad4
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003baa0
lea eax, [rax*2 + 2]
lea rdx, str.System.ControlPanel.Category
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xd0], rsi
je 0x14003bb34
lea rcx, [rbx + 0xc0]
cmp qword [rcx + 0x18], 8
jb 0x14003baee
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003bb34
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003bb00
lea eax, [rax*2 + 2]
lea rdx, str.System.Software.TasksFileUrl
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003bb50
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003bb70
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140122f58]
mov dword [rcx], eax
jb 0x14003bb8c
mov rbx, qword [rbx]
lea rdx, [rsp + 0x70]
sub rdx, 2
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x14003bb95
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x14003bbb0
lea rax, [rbp + 0x1e8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003bc60
cmp qword [r14 + 0x18], 8
mov rbx, qword [rsp + 0x60]
jb 0x14003bc1b
mov r14, qword [r14]
test r14, r14
je 0x14003bc50
cmp word [r14 + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x14003bc20
lea eax, [rdi*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14003bc65
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003bc65
mov esi, 0xfffffffb
mov r14, qword [rsp + 0x290]
test r12, r12
je 0x14003bc82
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003bc82
mov esi, 0xfffffffc
mov r12, qword [rsp + 0x2a0]
test r13, r13
je 0x14003bc9f
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003bc9f
mov esi, 0xfffffffd
mov r13, qword [rsp + 0x298]
test r15, r15
je 0x14003bcbc
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003bcbc
mov esi, 0xfffffffe
mov r15, qword [rsp + 0x288]
mov eax, esi
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret
or rax, 0xffffffffffffffff
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret