Function at 0x140003b00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140003b69
cmp dword [rsp + 0x30], 1
je 0x140003c18
cmp dword [rsp + 0x30], 2
je 0x140003cc7
cmp dword [rsp + 0x30], 3
je 0x140003d76
cmp dword [rsp + 0x30], 4
je 0x140003e2b
jmp 0x140003ed8
lea rax, [0x14002bd80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003c0c
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x140003bad
mov rax, qword [rsp + 0x38]
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140003c0a
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003c13
xor eax, eax
jmp 0x140003ee5
jmp 0x140003ed8
lea rax, [0x14002bd80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003cbb
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
inc qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
cmp byte [rax + rcx], 0
jne 0x140003c5c
mov rax, qword [rsp + 0x40]
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140003cb9
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003cc2
xor eax, eax
jmp 0x140003ee5
jmp 0x140003ed8
lea rax, [0x14002bd80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003d6a
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
cmp byte [rax + rcx], 0
jne 0x140003d0b
mov rax, qword [rsp + 0x48]
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140003d68
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003d71
xor eax, eax
jmp 0x140003ee5
jmp 0x140003ed8
lea rax, [0x14002bd80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003e1f
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
cmp byte [rax + rcx], 0
jne 0x140003dbd
mov rax, qword [rsp + 0x50]
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140003e1d
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003e26
xor eax, eax
jmp 0x140003ee5
jmp 0x140003ed8
lea rax, [0x14002bd80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000005
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003ed4
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x140003e72
mov rax, qword [rsp + 0x58]
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140003ed2
mov rcx, qword [0x14002bd80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003ed8
xor eax, eax
jmp 0x140003ee5
mov eax, 1
jmp 0x140003ee5
add rsp, 0xa8
ret