Function at 0x1000f0b60
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov r13d, ecx
lea r15, [0x100152eb8]
mov eax, 5
lea r12, [0x10001dc08]
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000f0be2
test byte [rcx + 0x1c], 1
je 0x1000f0be2
cmp byte [rcx + 0x19], al
jb 0x1000f0be2
lea edx, [rax + 0x28]
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdi
mov r9d, r13d
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1000efe60
xor r14d, r14d
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.1000f14e0
mov ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000f0c4d
test byte [rcx + 0x1c], 2
je 0x1000f0c4d
cmp byte [rcx + 0x19], 4
jb 0x1000f0c4d
lea edx, [r14 + 0x2e]
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp ebx, r14d
jne 0x1000f0c92
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.1000e4f6c
mov ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000f0c92
test byte [rcx + 0x1c], 2
je 0x1000f0c92
cmp byte [rcx + 0x19], 4
jb 0x1000f0c92
mov edx, 0x2f
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.100035d98
nop
lea rdx, [0x100026c60]
lea rcx, [rsp + 0x68]
call fcn.100035d98
nop
lea rdx, [0x100026c60]
lea rcx, [rsp + 0x58]
call fcn.100035d98
nop
or r15, 0xffffffffffffffff
cmp ebx, r14d
jne 0x1000f0d7d
cmp rsi, r14
je 0x1000f0d27
xor eax, eax
mov rcx, r15
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.100036190
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f0d27
test byte [rcx + 0x1c], 2
je 0x1000f0d27
cmp byte [rcx + 0x19], 4
jb 0x1000f0d27
lea edx, [r15 + 0x31]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034764
cmp rbp, r14
je 0x1000f0d86
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x58]
call fcn.100036190
mov rcx, qword [0x100152eb8]
lea rbp, [0x100152eb8]
cmp rcx, rbp
je 0x1000f0d8d
test byte [rcx + 0x1c], 2
je 0x1000f0d8d
cmp byte [rcx + 0x19], 4
jb 0x1000f0d8d
mov edx, 0x31
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034764
jmp 0x1000f0d8d
lea rbp, [0x100152eb8]
jmp 0x1000f0d8d
lea rbp, [0x100152eb8]
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp ebx, r14d
jne 0x1000f13d6
lea rcx, [rsp + 0x70]
call fcn.1000e3d4c
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rbp
je 0x1000f0def
test byte [rcx + 0x1c], 2
je 0x1000f0def
cmp byte [rcx + 0x19], 4
jb 0x1000f0def
mov edx, 0x32
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, qword [0x100152eb8]
mov eax, 0x54f
cmp edi, r14d
cmovge eax, r14d
cmp eax, r14d
jne 0x1000f13dd
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdi, r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov esi, r14d
mov eax, dword [rsp + 0x50]
cmp eax, r14d
jle 0x1000f1393
mov rbp, r14
cmp esi, r14d
jl 0x1000f137d
cmp esi, eax
jge 0x1000f137d
movsxd r12, esi
mov rax, qword [rsp + 0x48]
lea rdx, [rax + r12*8]
lea rcx, [rsp + 0x40]
call fcn.100035ed8
xor eax, eax
mov rcx, r15
lea rdi, [0x1000021e8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1000021e8]
lea rcx, [rsp + 0x40]
call fcn.10003577c
mov rdx, qword [rsp + 0x70]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.10003577c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.10004f40c
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f0f1a
test byte [rcx + 0x1c], 2
je 0x1000f0f1a
cmp byte [rcx + 0x19], 4
jb 0x1000f0f1a
mov edx, 0x33
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rdi, qword [rsp + 0x88]
cmp ebx, r14d
jne 0x1000f1131
mov dword [rsp + 0xf0], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x100026c28]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f0f9a
test byte [rcx + 0x1c], 2
je 0x1000f0f9a
cmp byte [rcx + 0x19], 4
jb 0x1000f0f9a
mov edx, 0x34
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp ebx, r14d
jne 0x1000f1131
mov rbx, qword [rsp + 0x80]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f1336
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f1025
test byte [rcx + 0x1c], 2
je 0x1000f1025
cmp byte [rcx + 0x19], 4
jb 0x1000f1025
mov edx, 0x35
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp ebx, r14d
jne 0x1000f1131
mov rbx, qword [rsp + 0x68]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f132b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f10ad
test byte [rcx + 0x1c], 2
je 0x1000f10ad
cmp byte [rcx + 0x19], 4
jb 0x1000f10ad
mov edx, 0x36
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp ebx, r14d
jne 0x1000f1131
mov rbx, qword [rsp + 0x58]
mov eax, r14d
cmp rbx, r14
setne al
cmp eax, r14d
je 0x1000f1320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x100026c50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f1131
test byte [rcx + 0x1c], 2
je 0x1000f1131
cmp byte [rcx + 0x19], 4
jb 0x1000f1131
mov edx, 0x37
mov r9d, ebx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp rdi, r14
je 0x1000f114a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
mov qword [rsp + 0x88], r14
cmp ebx, r14d
jne 0x1000f130d
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp esi, dword [rsp + 0x50]
jge 0x1000f1357
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + r12*8]
lea rdx, [0x100026c10]
lea rcx, [rsp + 0x78]
call fcn.100039d9c
mov rdi, qword [rsp + 0x78]
mov r8, rdi
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, r14
jne 0x1000f1203
call sub.KERNEL32.dll_GetLastError
mov r9d, eax
mov rcx, qword [0x100152eb8]
lea r12, [0x100152eb8]
cmp rcx, r12
je 0x1000f1211
test byte [rcx + 0x1c], 2
je 0x1000f1211
mov edx, 2
cmp eax, r14d
lea eax, [rdx + 3]
cmove edx, eax
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jl 0x1000f1211
mov edx, 0x38
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, qword [0x100152eb8]
jmp 0x1000f1211
mov rcx, qword [0x100152eb8]
lea r12, [0x100152eb8]
mov qword [rsp + 0x60], rbx
cmp rcx, r12
je 0x1000f123f
test byte [rcx + 0x1c], 2
je 0x1000f123f
cmp byte [rcx + 0x19], 4
jb 0x1000f123f
mov edx, 0x39
mov r9, rbx
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100034814
cmp rbx, r14
je 0x1000f128d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000f127d
test byte [rcx + 0x1c], 2
je 0x1000f127d
cmp byte [rcx + 0x19], 4
jb 0x1000f127d
mov edx, 0x3a
mov r9d, eax
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r14
jmp 0x1000f12de
cmp esi, dword [rsp + 0x50]
jge 0x1000f1341
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + rbp]
lea rcx, [rsp + 0xa0]
call fcn.1000e5514
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000f12de
test byte [rcx + 0x1c], 2
je 0x1000f12de
cmp byte [rcx + 0x19], 4
jb 0x1000f12de
mov edx, 0x3b
mov r9d, eax
lea r8, [0x10001dc08]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
nop
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1305
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x88]
jmp 0x1000f130d
mov rdi, qword [rsp + 0x88]
inc esi
add rbp, 8
mov eax, dword [rsp + 0x50]
cmp esi, eax
jge 0x1000f136d
jmp 0x1000f0e4c
mov ecx, 0x80004005
call fcn.100036264
int3
mov ecx, 0x80004005
call fcn.100036264
int3
mov ecx, 0x80004005
call fcn.100036264
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea r12, [0x10001dc08]
lea rbp, [0x100152eb8]
jmp 0x1000f1393
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp rdi, r14
je 0x1000f13a2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f13cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [0x100152eb8]
jmp 0x1000f13dd
mov rcx, qword [0x100152eb8]
jmp 0x1000f13dd
mov rcx, qword [0x100152eb8]
cmp rcx, rbp
je 0x1000f13fa
test byte [rcx + 0x1c], 1
je 0x1000f13fa
mov edx, 0x3c
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.100034764
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f141d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1440
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1463
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x1000f1489
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x48]
call fcn.10004ce40
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1000f14a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xa0]
cmp rcx, r14
je 0x1000f14b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret