Function at 0x104f3b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd38
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0xd28], rax
lea rax, [rsp + 0xcd0]
lea rcx, [0x0100c6b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
movzx eax, word [0x01001c38]
mov word [rsp + 0x450], ax
lea rax, [rsp + 0x452]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x860], ax
lea rax, [rsp + 0x862]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xc70], ax
lea rax, [rsp + 0xc72]
mov rdi, rax
xor eax, eax
mov ecx, SQLBindParameter
rep stosb byte [rdi], al
mov dword [rsp + 0xcc4], 0
mov dword [rsp + 0xcc0], 0
mov qword [rsp + 0xd08], 0
mov qword [rsp + 0x858], 0
mov dword [rsp + 0xcc8], 0
mov dword [rsp + 0xc60], 0
mov dword [rsp + 0x850], 0
mov dword [rsp + 0xccc], 0
mov rdx, qword [rsp + 0xd50]
lea rcx, [0x0100c670]
call fcn.01052e60
mov rax, qword [rsp + 0xd60]
mov eax, dword [rax + 4]
mov dword [rsp + 0xd10], eax
cmp dword [rsp + 0xd10], 6
je 0x104f53a
cmp dword [rsp + 0xd10], 7
je 0x104f5e9
cmp dword [rsp + 0xd10], 8
je 0x104f615
cmp dword [rsp + 0xd10], 9
je 0x104f891
jmp 0x104fb31
mov r9, qword [rsp + 0xd50]
lea r8, [0x0100c600]
mov edx, 0x200
lea rcx, [rsp + 0x450]
call fcn.01015ef0
movsxd rax, dword [rsp + 0xd70]
lea rcx, [rsp + 0xcd0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcc8]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 1
lea rdx, [rsp + 0x450]
mov rcx, qword [rsp + 0xd58]
call fcn.01020da0
test eax, eax
je 0x104f5e4
cmp dword [rsp + 0xcc8], 0
je 0x104f5cb
mov dword [rsp + 0xd14], 0
jmp 0x104f5d6
mov dword [rsp + 0xd14], 1
mov eax, dword [rsp + 0xd14]
mov dword [rsp + 0xcc4], eax
jmp 0x104fb77
cmp qword [rsp + 0xd80], 0
je 0x104f610
mov dword [rsp + 0xcc4], 1
mov rax, qword [rsp + 0xd80]
mov ecx, dword [rsp + 0xcc4]
mov dword [rax], ecx
jmp 0x104fb77
mov rax, qword [rsp + 0xd50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 2
mov r8d, 0xc00000d6
mov edx, 2
mov ecx, 3
call fcn.01033610
lea rcx, [0x01065ad8]
call qword [0x01068178]
test eax, eax
jne 0x104f689
cmp dword [0x010679c0], 0
je 0x104f67c
cmp dword [0x01067484], 0
je 0x104f67c
lea rdx, [0x0100c6b8]
lea rcx, [0x01001b70]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065ad8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010679c0], 0
je 0x104f6af
cmp dword [0x01067484], 0
je 0x104f6af
lea rdx, [0x0100c6b8]
lea rcx, [0x01001b38]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov rax, qword [rsp + 0xd60]
add rax, 0xc
lea rdx, [rsp + 0xc70]
mov rcx, rax
call fcn.01048400
mov rax, qword [rsp + 0xd50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc70]
lea r8, [0x0100c4c0]
mov edx, 0x200
lea rcx, [rsp + 0x450]
call fcn.01015ef0
movsxd rax, dword [rsp + 0xd70]
lea rcx, [rsp + 0xcd0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcc8]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 1
lea rdx, [rsp + 0x450]
mov rcx, qword [rsp + 0xd58]
call fcn.01020da0
test eax, eax
je 0x104f782
cmp dword [rsp + 0xcc8], 0
je 0x104f769
mov dword [rsp + 0xd18], 0
jmp 0x104f774
mov dword [rsp + 0xd18], 1
mov eax, dword [rsp + 0xd18]
mov dword [rsp + 0xcc4], eax
cmp dword [rsp + 0xcc4], 0
je 0x104f859
mov dword [rsp + 0xc60], 0
jmp 0x104f7ae
mov eax, dword [rsp + 0xc60]
add eax, 1
mov dword [rsp + 0xc60], eax
mov eax, dword [0x01065dd4]
cmp dword [rsp + 0xc60], eax
jge 0x104f842
mov qword [rsp + 0xd08], 0
mov edx, dword [rsp + 0xc60]
lea rcx, [0x01065dc8]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
mov qword [rsp + 0xd08], rax
cmp qword [rsp + 0xd08], 0
je 0x104f83d
mov rax, qword [rsp + 0xd08]
mov dword [rax + 0x364], 0
mov rax, qword [rsp + 0xd08]
mov dword [rax + 0x360], 0
lea r9, [rsp + 0xcd0]
lea r8, [rsp + 0xcc0]
mov rdx, qword [rsp + 0xd08]
mov rcx, qword [rsp + 0xd58]
call fcn.01047350
jmp 0x104f79d
call fcn.01045be0
mov r8d, 0x131
xor edx, edx
mov ecx, 3
call fcn.01033fa0
lea rcx, [0x01065ad8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010679c0], 0
je 0x104f88c
cmp dword [0x01067484], 0
je 0x104f88c
lea rdx, [0x0100c6b8]
lea rcx, [0x01001b00]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x104fb77
lea rax, [rsp + 0x858]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001b
xor r8d, r8d
lea rdx, [0x01067c20]
mov rcx, 0xffffffff80000002
call fcn.01052d70
mov dword [rsp + 0xccc], eax
cmp dword [rsp + 0xccc], 0
jne 0x104fa36
mov rax, qword [rsp + 0xd60]
movzx eax, byte [rax + 0x1b]
and rax, 0xff
movzx eax, al
mov rcx, qword [rsp + 0xd60]
movzx ecx, byte [rcx + 0x1a]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
movzx eax, ax
mov dword [rsp + 0x850], eax
cmp dword [rsp + 0x850], 0
je 0x104f9ec
cmp dword [rsp + 0x850], 0xa
jl 0x104f9ec
cmp dword [rsp + 0x850], 0x7080
jg 0x104f9ec
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x850]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x010082c0]
mov rcx, qword [rsp + 0x858]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xccc], eax
cmp dword [rsp + 0xccc], 0
jne 0x104f987
mov dword [rsp + 0xd1c], 1
jmp 0x104f992
mov dword [rsp + 0xd1c], 0
mov eax, dword [rsp + 0xd1c]
mov dword [rsp + 0xcc4], eax
cmp dword [rsp + 0xcc4], 0
je 0x104f9ea
mov eax, dword [rsp + 0x850]
mov dword [0x01067498], eax
cmp qword [rsp + 0xd78], 0
je 0x104f9d0
mov rax, qword [rsp + 0xd78]
mov dword [rax], 1
mov r9d, dword [rsp + 0x850]
mov r8d, 0x15b
xor edx, edx
mov ecx, 3
call fcn.01033fa0
jmp 0x104fa28
mov r9d, 0x200
lea r8, [rsp + 0x50]
mov edx, 0x160
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, dword [rsp + 0x850]
lea r8, [rsp + 0x50]
mov edx, 0x200
lea rcx, [rsp + 0x860]
call fcn.01015ef0
mov rcx, qword [rsp + 0x858]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0xcc4], 0
jne 0x104fb2f
mov r9d, 0x200
lea r8, [rsp + 0x50]
mov edx, 0x142
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp dword [rsp + 0xccc], 0
je 0x104fa87
mov r8d, 0x400
lea rdx, [rsp + 0x860]
mov ecx, dword [rsp + 0xccc]
call fcn.010529a0
jmp 0x104fab3
movzx eax, word [rsp + 0x860]
test eax, eax
jne 0x104fab3
mov r9d, 0x200
lea r8, [rsp + 0x860]
mov edx, 0x17
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rcx, [rsp + 0x860]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov qword [rsp + 0xd20], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov rcx, qword [rsp + 0xd20]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0xd70]
cmp rax, rcx
jae 0x104fb2f
movsxd rax, dword [rsp + 0xd70]
lea r9, [rsp + 0x860]
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0xd68]
call fcn.01015ef0
mov r9, qword [rsp + 0xd68]
xor r8d, r8d
lea rdx, [0x01001bbc]
mov ecx, 1
call fcn.01033fa0
jmp 0x104fb77
mov r9d, 0x200
lea r8, [rsp + 0x50]
mov edx, 0x124
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
movsxd rax, dword [rsp + 0xd70]
mov rcx, qword [rsp + 0xd60]
mov r9d, dword [rcx + 4]
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0xd68]
call fcn.01015ef0
mov eax, dword [rsp + 0xcc4]
mov rcx, qword [rsp + 0xd28]
xor rcx, rsp
call fcn.010588f0
add rsp, 0xd38
pop rdi
pop rsi
ret