Function at 0x100042360
Capabilities:
Connect to wmi namespace via wbemlocator
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov qword [rsp + 0xb0], 0xfffffffffffffffe
lea r15, [0x100152eb8]
mov ebx, 1
lea r14, [0x10001e5a0]
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000423b5
test byte [rcx + 0x1c], bl
je 0x1000423b5
mov edx, 0x8a
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034764
xor r13d, r13d
mov r12d, r13d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1000203a0]
mov r8d, ebx
xor edx, edx
lea rcx, [0x100020340]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
lea ebp, [r13 + 5]
lea ebx, [rbp - 3]
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042438
test byte [rcx + 0x1c], bl
je 0x100042438
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x100042438
mov edx, 0x8b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bdc0
cmp edi, r13d
jl 0x100042a2e
lea rcx, [0x10001f170]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
cmp rax, r13
jne 0x10004248e
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042a2e
test byte [rcx + 0x1c], bl
je 0x100042a2e
cmp byte [rcx + 0x19], bl
jb 0x100042a2e
mov edx, 0x8c
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034764
jmp 0x100042a2e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x118]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042507
test byte [rcx + 0x1c], bl
je 0x100042507
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp esi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x100042507
mov edx, 0x8d
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bdc0
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, r13d
jl 0x100042a2e
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
or r9, 0xffffffffffffffff
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x10004258c
test byte [rcx + 0x1c], bl
je 0x10004258c
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x10004258c
mov edx, 0x8e
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bdc0
cmp edi, r13d
jl 0x100042a2e
lea rcx, [0x10001f188]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
lea rcx, [0x10001f190]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
cmp rbp, r13
je 0x100042647
cmp rax, r13
je 0x100042647
mov rcx, qword [rsp + 0x118]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x20
mov r8, rdi
mov rdx, rbp
call qword [rax + 0xa0]
mov esi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042673
test byte [rcx + 0x1c], bl
je 0x100042673
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp esi, r13d
mov r8d, 5
cmovge eax, r8d
cmp edx, eax
jl 0x100042673
mov edx, 0x90
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
mov r9d, esi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003ba30
jmp 0x100042673
mov esi, 0x8007000e
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042673
test byte [rcx + 0x1c], bl
je 0x100042673
cmp byte [rcx + 0x19], bl
jb 0x100042673
mov edx, 0x8f
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, r13d
jl 0x100042a22
mov ebp, 0xd
cmp r12d, r13d
jne 0x100042a1b
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x110], r13d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x110], r13d
je 0x100042a04
cmp eax, r13d
jl 0x100042a04
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x10001f1d8]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042766
test byte [rcx + 0x1c], bl
je 0x10004276d
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
mov esi, 5
cmovge eax, esi
cmp edx, eax
jl 0x100042772
movzx eax, word [rsp + 0x80]
mov edx, 0x91
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003b338
jmp 0x100042772
mov esi, 5
jmp 0x100042772
mov esi, 5
cmp edi, r13d
jl 0x1000429dc
cmp bp, word [rsp + 0x80]
jne 0x1000429dc
mov qword [rsp + 0x128], r13
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea r8, [rsp + 0x128]
lea rdx, [0x100020350]
call qword [rax]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000427f1
test byte [rcx + 0x1c], bl
je 0x1000427f1
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x1000427f1
mov edx, 0x92
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bdc0
cmp edi, r13d
jl 0x1000429c8
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, [0x10001f200]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042876
test byte [rcx + 0x1c], bl
je 0x100042876
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x100042876
movzx eax, word [rsp + 0x98]
mov edx, 0x93
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003b338
cmp edi, r13d
jl 0x1000429b9
cmp bp, word [rsp + 0x98]
jne 0x1000429b9
mov qword [rsp + 0x120], r13
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
lea r8, [rsp + 0x120]
lea rdx, [0x100020350]
call qword [rax]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x1000428f5
test byte [rcx + 0x1c], bl
je 0x1000428f5
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x1000428f5
mov edx, 0x94
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bdc0
cmp edi, r13d
jl 0x1000429a5
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [0x10001f228]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x10004297b
test byte [rcx + 0x1c], bl
je 0x10004297b
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x10004297b
movzx r8d, word [rsp + 0x68]
mov edx, 0x95
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bc38
cmp edi, r13d
jl 0x100042999
mov eax, 3
cmp ax, word [rsp + 0x68]
jne 0x100042999
cmp dword [rsp + 0x70], ebx
mov eax, 1
cmove r12d, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x120]
cmp rcx, r13
je 0x1000429b9
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x128]
cmp rcx, r13
je 0x1000429dc
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x100042693
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x100042693
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x100042a29
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebp, 5
jmp 0x100042a2e
mov ebp, 5
jmp 0x100042a2e
mov ebp, 5
jmp 0x100042a2e
mov ebp, 5
mov rsi, r13
mov qword [rsp + 0x120], r13
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, [0x10001e7f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r13d
jne 0x100042a75
mov edi, r13d
mov rsi, qword [rsp + 0x120]
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042aaf
test byte [rcx + 0x1c], bl
je 0x100042aaf
cmp edi, r13d
cmove ebx, ebp
movzx eax, byte [rcx + 0x19]
cmp eax, ebx
jl 0x100042aaf
mov edx, 0x96
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, qword [0x100152eb8]
cmp edi, r13d
jne 0x100042aee
mov dword [rsp + 0x110], r12d
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x10001f258]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x100152eb8]
cmp rcx, r15
je 0x100042b17
mov eax, 1
test byte [rcx + 0x1c], al
je 0x100042b17
cmp byte [rcx + 0x19], bpl
jb 0x100042b17
mov edx, 0x97
mov r9d, r12d
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp rsi, r13
je 0x100042b26
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x100042b37
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r13
je 0x100042b4b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100042b5b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, r12d
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret