Function at 0x1400490e0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [rcx + 0x10], 0x26
mov rbx, rcx
jne 0x140049739
cmp qword [rcx + 0x30], 0
je 0x140049739
cmp qword [rcx + 0x110], 0
je 0x140049739
cmp qword [rcx + 0xf0], 0
je 0x140049739
cmp qword [rcx + 0x50], 0
je 0x140049739
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.14011fa60
mov rcx, qword [str.SoftwareClassesCLSID]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140049170
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x140049190
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140167e60]
mov dword [rcx], eax
jb 0x1400491ae
mov r8, qword [rbx]
jmp 0x1400491b1
mov r8, rbx
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1400491c0
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400491d0
lea rax, [rbp + 0x1d0]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x288], r15
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140049717
mov r15, qword [rsp + 0x58]
lea rax, [rbp + 0x1d8]
lea rdx, str.DefaultIcon
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400496fa
mov r13, qword [rsp + 0x68]
lea rax, [rbp + 0x1e0]
lea rdx, str.ShellOpenCommand
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x2a0], r12
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400496dd
mov r12, qword [rsp + 0x50]
lea rcx, [rbx + 0xe0]
mov qword [rsp + 0x290], r14
cmp qword [rcx + 0x18], 8
jb 0x140049303
mov rcx, qword [rcx]
or rdi, 0xffffffffffffffff
test rcx, rcx
je 0x14004933f
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140049310
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx + 0x100]
cmp qword [rcx + 0x18], 8
jb 0x140049350
mov rcx, qword [rcx]
test rcx, rcx
je 0x14004938f
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140049360
lea eax, [rax*2 + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x38], 8
lea r14, [rbx + 0x20]
jb 0x14004939f
mov rcx, qword [r14]
jmp 0x1400493a2
mov rcx, r14
test rcx, rcx
je 0x1400493df
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400493b0
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x1400493ed
mov rcx, qword [rcx]
test rcx, rcx
je 0x140049429
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400493f5
lea eax, [rax*2 + 2]
lea rdx, str.LocalizedString
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x70], rsi
je 0x140049479
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x14004943d
mov rcx, qword [rcx]
test rcx, rcx
je 0x140049479
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140049445
lea eax, [rax*2 + 2]
lea rdx, str.InfoTip
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x90], rsi
je 0x1400494d4
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x140049493
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400494d4
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400494a0
lea eax, [rax*2 + 2]
lea rdx, str.System.ApplicationName
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xb0], rsi
je 0x140049534
lea rcx, [rbx + 0xa0]
cmp qword [rcx + 0x18], 8
jb 0x1400494ee
mov rcx, qword [rcx]
test rcx, rcx
je 0x140049534
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140049500
lea eax, [rax*2 + 2]
lea rdx, str.System.ControlPanel.Category
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0xd0], rsi
je 0x140049594
lea rcx, [rbx + 0xc0]
cmp qword [rcx + 0x18], 8
jb 0x14004954e
mov rcx, qword [rcx]
test rcx, rcx
je 0x140049594
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140049560
lea eax, [rax*2 + 2]
lea rdx, str.System.Software.TasksFileUrl
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace]
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400495b0
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1400495d0
cmp qword [rbx + 0x18], 8
mov eax, dword [0x140167e60]
mov dword [rcx], eax
jb 0x1400495ec
mov rbx, qword [rbx]
lea rdx, [rsp + 0x70]
sub rdx, 2
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x1400495f5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x140049610
lea rax, [rbp + 0x1e8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400496c0
cmp qword [r14 + 0x18], 8
mov rbx, qword [rsp + 0x60]
jb 0x14004967b
mov r14, qword [r14]
test r14, r14
je 0x1400496b0
cmp word [r14 + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x140049680
lea eax, [rdi*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400496c5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400496c5
mov esi, 0xfffffffb
mov r14, qword [rsp + 0x290]
test r12, r12
je 0x1400496e2
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400496e2
mov esi, 0xfffffffc
mov r12, qword [rsp + 0x2a0]
test r13, r13
je 0x1400496ff
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400496ff
mov esi, 0xfffffffd
mov r13, qword [rsp + 0x298]
test r15, r15
je 0x14004971c
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004971c
mov esi, 0xfffffffe
mov r15, qword [rsp + 0x288]
mov eax, esi
mov rsi, qword [rsp + 0x2a8]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret
or rax, 0xffffffffffffffff
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret