Function at 0x100024c20
Capabilities:
Set registry value

Disassembly:
mov edx, r10d
jmp 0x100024c8c
mov edx, r11d
jmp 0x100024c8c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x480
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15d, 0x131
xor edi, edi
mov rsi, r8
mov r8d, dword [0x100073580]
mov rbp, r9
mov edx, r15d
lea r9d, [r15 + 2]
lea r11d, [r15 + 1]
lea r10d, [r15 - 1]
mov ecx, r8d
lea r12d, [rdi + 1]
cmp r8d, edi
je 0x10000e340
sub ecx, 2
je 0x10001369a
cmp ecx, r12d
jne 0x100024c8c
mov edx, r9d
jmp 0x100024c8c
movzx ebx, si
cmp edx, ebx
je 0x100024cff
mov ecx, 0x137
cmp dword [0x100074008], r12d
je 0x10002e7bc
mov r15d, 0x2710
movzx eax, si
mov edx, 3
sub ax, r15w
cmp ax, dx
jbe 0x10002e830
cmp ebx, r9d
jg 0x100024f81
je 0x100025b20
sub ebx, 0x12e
je 0x10002e9d5
sub ebx, r12d
je 0x10002e8e9
sub ebx, r12d
je 0x10002b5fe
sub ebx, r12d
je 0x10002e8de
cmp ebx, r12d
je 0x100025b1b
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
sub ebx, ecx
je 0x10002eaac
sub ebx, 0x28e
je 0x10002b069
sub ebx, 8
je 0x10002ea68
sub ebx, 2
jne 0x10002ea41
cmp byte [0x100073585], dil
jne 0x100024cff
lea rcx, [0x100073460]
call fcn.10000fe70
jmp 0x100024cff
mov edx, 2
mov r8d, edx
lea rcx, [0x100073460]
call fcn.100025b3c
jmp 0x100024cff
cmp r8d, r12d
jne 0x10002ea9e
lea rcx, [0x100073460]
call fcn.10002b08c
jmp 0x100024cff
xor r8d, r8d
xor edx, edx
jmp 0x100025b23
movzx eax, si
cmp rax, r15
je 0x100024cff
cmp rax, r10
je 0x100024cff
cmp rax, r11
je 0x100024cff
cmp rax, 0x12f
je 0x100024cff
cmp rax, rcx
je 0x100024cff
cmp rax, 0x12e
je 0x100024cff
cmp rax, 0x3c5
je 0x100024cff
cmp rax, 0x3cf
je 0x100024cff
cmp rax, 0x3d3
je 0x100024cff
cmp rax, 0x3cd
jne 0x100024ca5
jmp 0x100024cff
cmp byte [0x100073586], dil
jne 0x10002e847
lea rcx, [0x100073460]
mov edx, ebx
call fcn.10003ee60
mov rcx, qword [0x1000735d0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x3cd
or r9d, 0xffffffff
lea r8d, [rdx + 6]
mov rcx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov rcx, qword [0x1000735d0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, ebx
mov r8d, 0x2713
mov edx, r15d
mov rcx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov r11, qword [0x1000735e0]
mov r9, rbp
mov rcx, qword [r11 + 0x30]
mov r8, rsi
mov edx, 0x111
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11d, [rbx - 0x2710]
mov dword [0x10007400c], r11d
call fcn.10000fed8
jmp 0x100024cff
mov r8d, r12d
mov edx, r12d
jmp 0x100025b23
mov rax, qword [0x100073578]
mov ebx, edi
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx]
cmp dword [rcx + 0x358], edi
sete bl
cmp dword [rcx + 0x358], ebx
je 0x10002e91d
mov dword [rcx + 0x358], ebx
cmp dword [rcx + 0x35c], edi
jne 0x10002e91d
call fcn.100003eb4
mov rcx, qword [0x1000735d0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov ecx, ebx
mov edx, 0x12f
neg ecx
mov rcx, rax
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, str.SoftwareMicrosoftCalc
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x100024cff
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
cmp ebx, edi
setne dil
lea rdx, str.UseSep
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100024cff
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
lea r8, [rsp + 0x70]
mov r9d, 0x200
mov rcx, rax
mov edx, 0xd9
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, edi
jne 0x10002e9ff
mov word [rsp + 0x70], di
xor ecx, ecx
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
lea r9, [rsp + 0x50]
mov r8d, r12d
mov rcx, rax
mov edx, 0xea
call qword [sym.imp.COMCTL32.dll_Ordinal_380]
mov r9, qword [rsp + 0x50]
mov rcx, qword [0x1000735d0]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_ShellAboutW]
jmp 0x100024cff
cmp ebx, 4
jne 0x100024cff
cmp byte [0x100073587], dil
jne 0x100024cff
lea rcx, [0x100073460]
call fcn.10003ef20
jmp 0x100024cff
cmp byte [0x100073585], dil
jne 0x100024fb4
cmp byte [0x100073587], dil
jne 0x10002ea57
cmp byte [0x100073586], dil
je 0x100024cff
lea rcx, [0x100073460]
xor edx, edx
call fcn.10003ee60
jmp 0x100024cff
cmp r8d, edi
je 0x10002b072
jmp 0x100024cff
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x100064e80]
lea r8d, [rdx + 0x17]
lea rcx, [0x100064e90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x100024cff
xor eax, eax
lea r9, [rsp + 0x60]
mov r8d, r12d
mov qword [rsp + 0x68], rax
lea rax, str.HELP_ENTRY_ID_CALCULATOR_HELP
mov edx, 0x38f
xor ecx, ecx
mov dword [rsp + 0x60], 2
mov qword [rsp + 0x68], rax
call sub.ntdll.dll_WinSqmAddToStream
lea rcx, str.mshelp:__windows__idf15f7d3e_ee9c_465a_a7e8_4e6af5cfee5d
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
cmp rax, rdi
je 0x10002eb34
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0x18]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x100024cff