Function at 0x1000321e0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov r15, rcx
xor edi, edi
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x58], rdi
mov rax, qword [rdx]
cmp dword [rax - 0x10], edi
je 0x1000324b8
mov rax, qword [r8]
cmp dword [rax - 0x10], edi
je 0x1000324b8
mov rax, qword [r9]
cmp dword [rax - 0x10], edi
je 0x1000324b8
lea rax, [r11 - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x10000b620]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xd0]
cmp eax, edi
je 0x100032286
mov ebx, edi
jmp 0x10003244c
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1000322c5
mov ebx, edi
jmp 0x10003244c
mov rax, qword [rsi]
mov edi, dword [rax - 0x10]
mov ebx, 1
cmp dword [rax - 8], ebx
jle 0x1000322df
mov edx, edi
mov rcx, rsi
call fcn.10001e9a0
mov rcx, qword [rsi]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000b688]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x100032314
mov ebx, edi
jmp 0x10003244c
mov rax, qword [rbp]
mov edi, dword [rax - 0x10]
cmp dword [rax - 8], ebx
jle 0x10003232a
mov edx, edi
mov rcx, rbp
call fcn.10001e9a0
mov rcx, qword [rbp]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000b6a8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x100032360
mov ebx, edi
jmp 0x10003244c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [0x10000b6c0]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8d, ecx
mov rcx, r12
call fcn.10001ed3c
mov rdx, qword [r12]
mov edi, dword [rdx - 0x10]
cmp dword [rdx - 8], ebx
jle 0x10003239a
mov edx, edi
mov rcx, r12
call fcn.10001e9a0
mov rcx, qword [r12]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
lea rdx, [0x10000b6c8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [r14]
mov edi, dword [rdx - 0x10]
test edi, edi
je 0x100032407
cmp dword [rdx - 8], ebx
jle 0x1000323df
mov edx, edi
mov rcx, r14
call fcn.10001e9a0
mov rcx, qword [r14]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000b6e0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [r13]
mov edi, dword [rax - 0x10]
test edi, edi
je 0x10003244a
cmp dword [rax - 8], ebx
jle 0x100032421
mov edx, edi
mov rcx, r13
call fcn.10001e9a0
mov rcx, qword [r13]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000b700]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x100032461
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rdi
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x100032488
cmp ebx, edi
jne 0x10003247d
mov rdx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rdi
mov rcx, rbp
call fcn.10001f3ec
nop
mov rcx, rsi
call fcn.10001f3ec
nop
mov rcx, r12
call fcn.10001f3ec
nop
mov rcx, r14
call fcn.10001f3ec
nop
mov rcx, r13
call fcn.10001f3ec
mov eax, ebx
jmp 0x1000324f0
mov rcx, rdx
call fcn.10001f3ec
nop
mov rcx, rsi
call fcn.10001f3ec
nop
mov rcx, r12
call fcn.10001f3ec
nop
mov rcx, qword [rsp + 0xd0]
call fcn.10001f3ec
nop
mov rcx, qword [rsp + 0xd8]
call fcn.10001f3ec
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret