Function at 0x1000423ec
Capabilities:
Connect to wmi namespace via wbemlocator
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov qword [rsp + 0xb0], 0xfffffffffffffffe
lea r15, [0x100153eb8]
mov ebx, 1
lea r14, [0x10001e5a0]
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042441
test byte [rcx + 0x1c], bl
je 0x100042441
mov edx, 0x8a
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034784
xor r13d, r13d
mov r12d, r13d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1000203a0]
mov r8d, ebx
xor edx, edx
lea rcx, [0x100020340]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
lea ebp, [r13 + 5]
lea ebx, [rbp - 3]
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000424c4
test byte [rcx + 0x1c], bl
je 0x1000424c4
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x1000424c4
mov edx, 0x8b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be94
cmp edi, r13d
jl 0x100042aba
lea rcx, [0x10001f170]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
cmp rax, r13
jne 0x10004251a
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042aba
test byte [rcx + 0x1c], bl
je 0x100042aba
cmp byte [rcx + 0x19], bl
jb 0x100042aba
mov edx, 0x8c
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034784
jmp 0x100042aba
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x118]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042593
test byte [rcx + 0x1c], bl
je 0x100042593
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp esi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x100042593
mov edx, 0x8d
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be94
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, r13d
jl 0x100042aba
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
or r9, 0xffffffffffffffff
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042618
test byte [rcx + 0x1c], bl
je 0x100042618
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, ebp
cmp edx, eax
jl 0x100042618
mov edx, 0x8e
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be94
cmp edi, r13d
jl 0x100042aba
lea rcx, [0x10001f188]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
lea rcx, [0x10001f190]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
cmp rbp, r13
je 0x1000426d3
cmp rax, r13
je 0x1000426d3
mov rcx, qword [rsp + 0x118]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x20
mov r8, rdi
mov rdx, rbp
call qword [rax + 0xa0]
mov esi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000426ff
test byte [rcx + 0x1c], bl
je 0x1000426ff
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp esi, r13d
mov r8d, 5
cmovge eax, r8d
cmp edx, eax
jl 0x1000426ff
mov edx, 0x90
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
mov r9d, esi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003bb10
jmp 0x1000426ff
mov esi, 0x8007000e
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000426ff
test byte [rcx + 0x1c], bl
je 0x1000426ff
cmp byte [rcx + 0x19], bl
jb 0x1000426ff
mov edx, 0x8f
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, r13d
jl 0x100042aae
mov ebp, 0xd
cmp r12d, r13d
jne 0x100042aa7
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x110], r13d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x110], r13d
je 0x100042a90
cmp eax, r13d
jl 0x100042a90
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x10001f1d8]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x1000427f2
test byte [rcx + 0x1c], bl
je 0x1000427f9
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
mov esi, 5
cmovge eax, esi
cmp edx, eax
jl 0x1000427fe
movzx eax, word [rsp + 0x80]
mov edx, 0x91
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be4c
jmp 0x1000427fe
mov esi, 5
jmp 0x1000427fe
mov esi, 5
cmp edi, r13d
jl 0x100042a68
cmp bp, word [rsp + 0x80]
jne 0x100042a68
mov qword [rsp + 0x128], r13
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea r8, [rsp + 0x128]
lea rdx, [0x100020350]
call qword [rax]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x10004287d
test byte [rcx + 0x1c], bl
je 0x10004287d
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x10004287d
mov edx, 0x92
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be94
cmp edi, r13d
jl 0x100042a54
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, [0x10001f200]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042902
test byte [rcx + 0x1c], bl
je 0x100042902
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x100042902
movzx eax, word [rsp + 0x98]
mov edx, 0x93
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be4c
cmp edi, r13d
jl 0x100042a45
cmp bp, word [rsp + 0x98]
jne 0x100042a45
mov qword [rsp + 0x120], r13
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
lea r8, [rsp + 0x120]
lea rdx, [0x100020350]
call qword [rax]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042981
test byte [rcx + 0x1c], bl
je 0x100042981
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x100042981
mov edx, 0x94
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.10003be94
cmp edi, r13d
jl 0x100042a31
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [0x10001f228]
call qword [rax + 0x20]
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042a07
test byte [rcx + 0x1c], bl
je 0x100042a07
movzx edx, byte [rcx + 0x19]
mov eax, ebx
cmp edi, r13d
cmovge eax, esi
cmp edx, eax
jl 0x100042a07
movzx r8d, word [rsp + 0x68]
mov edx, 0x95
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100036318
cmp edi, r13d
jl 0x100042a25
mov eax, 3
cmp ax, word [rsp + 0x68]
jne 0x100042a25
cmp dword [rsp + 0x70], ebx
mov eax, 1
cmove r12d, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x120]
cmp rcx, r13
je 0x100042a45
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x128]
cmp rcx, r13
je 0x100042a68
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x10004271f
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10004271f
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x100042ab5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebp, 5
jmp 0x100042aba
mov ebp, 5
jmp 0x100042aba
mov ebp, 5
jmp 0x100042aba
mov ebp, 5
mov rsi, r13
mov qword [rsp + 0x120], r13
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, [0x10001e7f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r13d
jne 0x100042b01
mov edi, r13d
mov rsi, qword [rsp + 0x120]
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042b3b
test byte [rcx + 0x1c], bl
je 0x100042b3b
cmp edi, r13d
cmove ebx, ebp
movzx eax, byte [rcx + 0x19]
cmp eax, ebx
jl 0x100042b3b
mov edx, 0x96
mov r9d, edi
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, qword [0x100153eb8]
cmp edi, r13d
jne 0x100042b7a
mov dword [rsp + 0x110], r12d
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x10001f258]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x100153eb8]
cmp rcx, r15
je 0x100042ba3
mov eax, 1
test byte [rcx + 0x1c], al
je 0x100042ba3
cmp byte [rcx + 0x19], bpl
jb 0x100042ba3
mov edx, 0x97
mov r9d, r12d
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp rsi, r13
je 0x100042bb2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x100042bc3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, r13
je 0x100042bd7
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100042be7
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, r12d
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret