Function at 0x14003b090
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [rcx + 0x10], 0x26
mov rbx, rcx
jne 0x14003b6e9
cmp qword [rcx + 0x30], 0
je 0x14003b6e9
cmp qword [rcx + 0x110], 0
je 0x14003b6e9
cmp qword [rcx + 0xf0], 0
je 0x14003b6e9
cmp qword [rcx + 0x50], 0
je 0x14003b6e9
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.1400e5ee0
mov rcx, qword [str.SoftwareClassesCLSID]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003b120
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b140
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140124f70]
mov dword [rcx], eax
jb 0x14003b15e
mov r8, qword [rbx]
jmp 0x14003b161
mov r8, rbx
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b170
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14003b180
lea rax, [rbp + 0x1d0]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x288], r15
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b6c7
mov r15, qword [rsp + 0x58]
lea rax, [rbp + 0x1d8]
lea rdx, str.DefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b6aa
mov r13, qword [rsp + 0x68]
lea rax, [rbp + 0x1e0]
lea rdx, str.ShellOpenCommand
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x2a0], r12
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b68d
mov r12, qword [rsp + 0x50]
lea rcx, [rbx + 0xe0]
mov qword [rsp + 0x290], r14
cmp qword [rcx + 0x18], 8
jb 0x14003b2b3
mov rcx, qword [rcx]
or rdi, 0xffffffffffffffff
test rcx, rcx
je 0x14003b2ef
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b2c0
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx + 0x100]
cmp qword [rcx + 0x18], 8
jb 0x14003b300
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b33f
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b310
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x38], 8
lea r14, [rbx + 0x20]
jb 0x14003b34f
mov rcx, qword [r14]
jmp 0x14003b352
mov rcx, r14
test rcx, rcx
je 0x14003b38f
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b360
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x14003b39d
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b3d9
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b3a5
lea eax, [rax*2 + 2]
lea rdx, str.LocalizedString
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x70], rsi
je 0x14003b429
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x14003b3ed
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b429
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b3f5
lea eax, [rax*2 + 2]
lea rdx, str.InfoTip
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x90], rsi
je 0x14003b484
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x14003b443
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b484
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b450
lea eax, [rax*2 + 2]
lea rdx, str.System.ApplicationName
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xb0], rsi
je 0x14003b4e4
lea rcx, [rbx + 0xa0]
cmp qword [rcx + 0x18], 8
jb 0x14003b49e
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b4e4
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b4b0
lea eax, [rax*2 + 2]
lea rdx, str.System.ControlPanel.Category
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xd0], rsi
je 0x14003b544
lea rcx, [rbx + 0xc0]
cmp qword [rcx + 0x18], 8
jb 0x14003b4fe
mov rcx, qword [rcx]
test rcx, rcx
je 0x14003b544
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14003b510
lea eax, [rax*2 + 2]
lea rdx, str.System.Software.TasksFileUrl
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003b560
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14003b580
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140124f70]
mov dword [rcx], eax
jb 0x14003b59c
mov rbx, qword [rbx]
lea rdx, [rsp + 0x70]
sub rdx, 2
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x14003b5a5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x14003b5c0
lea rax, [rbp + 0x1e8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b670
cmp qword [r14 + 0x18], 8
mov rbx, qword [rsp + 0x60]
jb 0x14003b62b
mov r14, qword [r14]
test r14, r14
je 0x14003b660
cmp word [r14 + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x14003b630
lea eax, [rdi*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14003b675
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b675
mov esi, 0xfffffffb
mov r14, qword [rsp + 0x290]
test r12, r12
je 0x14003b692
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b692
mov esi, 0xfffffffc
mov r12, qword [rsp + 0x2a0]
test r13, r13
je 0x14003b6af
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6af
mov esi, 0xfffffffd
mov r13, qword [rsp + 0x298]
test r15, r15
je 0x14003b6cc
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6cc
mov esi, 0xfffffffe
mov r15, qword [rsp + 0x288]
mov eax, esi
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret
or rax, 0xffffffffffffffff
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret