Function at 0x1000434f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x8a0
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x890], rax
xor r12d, r12d
mov rdi, r8
mov rbp, rdx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov word [rsp + 0x60], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x616
mov word [rsp + 0x270], r12w
call sub.msvcrt.dll_memset
mov r11b, byte [0x100080fc0]
cmp r11b, r12b
jne 0x100043576
mov eax, 0x80070015
jmp 0x1000437d9
cmp rbp, r12
jne 0x100043585
mov eax, 0x80070057
jmp 0x1000437d9
mov rcx, rbp
call fcn.100042d80
cmp eax, r12d
jne 0x100043599
xor eax, eax
jmp 0x1000437d9
mov rcx, rbp
call fcn.100042fe4
cmp eax, r12d
mov ebx, eax
jl 0x1000437d7
cmp rdi, r12
je 0x1000437d7
lea rax, [rsp + 0x270]
mov esi, 0x30c
lea rcx, [rsp + 0x270]
sub rdi, rax
mov rdx, rsi
mov ebx, r12d
lea rax, [rdx + 0x7ffffcf2]
cmp rax, r12
je 0x1000435f6
movzx eax, word [rdi + rcx]
cmp ax, r12w
je 0x1000435f6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000435d3
cmp rdx, r12
jne 0x100043604
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x1000437b7
lea rcx, [rsp + 0x270]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r12
je 0x10004362d
mov word [rax], r12w
lea rcx, [0x100080fb8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lea rdx, [rsp + 0x58]
lea rcx, [0x10007f368]
call qword [sym.imp.ole32.dll_StringFromCLSID]
lea rcx, [0x100080fb8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp ebx, r12d
jl 0x1000437b7
lea r8, [0x1000790d0]
lea rax, [rsp + 0x60]
mov edi, 0x104
lea rcx, [rsp + 0x60]
mov ebx, r12d
sub r8, rax
mov rdx, rdi
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x1000436a7
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x1000436a7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100043683
cmp rdx, r12
jne 0x1000436b5
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rcx], r12w
jl 0x1000437b7
lea r8, [0x100075b3c]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.100004b94
cmp eax, r12d
mov ebx, eax
jl 0x1000437b7
mov r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.100004b94
cmp eax, r12d
mov ebx, eax
jl 0x1000437b7
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r12d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x1000437b7
mov rax, rsi
lea rcx, [rsp + 0x270]
mov ebx, r12d
cmp word [rcx], r12w
je 0x100043766
add rcx, 2
sub rax, 1
jne 0x100043756
cmp rax, r12
jne 0x100043775
mov ebx, 0x80070057
mov rax, r12
jmp 0x10004377c
sub rsi, rax
lea rax, [rsi + rsi]
cmp ebx, r12d
jl 0x1000437b7
mov rcx, qword [rsp + 0x50]
add rax, 2
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x270]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x1000437c7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000437d7
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.1000012f0
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret