Function at 0x180079650
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rdi, rdx
mov qword [rsp + 0x78], rdx
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov word [r11 - 0x438], r12w
xor edx, edx
mov r8d, 0x3fe
lea rcx, [r11 - 0x436]
call fcn.1800c31a0
cmp qword [r15 + 0x30], r12
jne 0x1800796c5
xor al, al
jmp 0x180079ab0
or r14d, 0xffffffff
mov r8, rdi
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.18006f020
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x1800796fa
mov dword [rsp + 0x60], r14d
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x60]
call fcn.1800c3e40
call fcn.18006cd90
test al, al
jne 0x180079a51
lea rdi, vtable.CCriticalSectionSync.0
mov qword [rsp + 0x80], rdi
mov rax, qword [rsp + 0x70]
add rax, 0x48
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x80]
call fcn.18004f2e0
nop
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx + 0x38]
mov rsi, qword [rax]
mov r13, qword [rcx + 8]
nop word [rax + rax]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rax + 0x38]
test r13, r13
je 0x180079764
cmp r13, qword [rax + 8]
je 0x180079769
call fcn.1800c1088
cmp rsi, rbx
je 0x180079a30
test r13, r13
jne 0x180079781
call fcn.1800c1088
mov r11, r12
jmp 0x180079785
mov r11, qword [r13]
cmp rsi, qword [r11 + 0x30]
jne 0x180079790
call fcn.1800c1088
cmp qword [rsi + 0x78], 0
je 0x1800799bc
test r13, r13
jne 0x1800797aa
call fcn.1800c1088
mov r11, r12
jmp 0x1800797ae
mov r11, qword [r13]
cmp rsi, qword [r11 + 0x30]
jne 0x1800797b9
call fcn.1800c1088
mov rcx, r15
call fcn.18006ad10
mov r8, rax
mov edx, 0x200
lea rcx, [rsp + 0xa0]
call fcn.1800c0e4c
cmp qword [rsi + 0x38], 8
jb 0x1800797e3
mov r8, qword [rsi + 0x20]
jmp 0x1800797e7
lea r8, [rsi + 0x20]
mov edx, 0x200
lea rcx, [rsp + 0xa0]
call fcn.1800c29a4
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18007984f
mov dword [rsp + 0x64], r14d
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x64]
call fcn.1800c3e40
mov rax, qword [rsi + 0x70]
mov rbx, qword [rax]
mov r12, qword [rsi + 0x40]
nop word [rax + rax]
mov rdi, qword [rsi + 0x70]
test r12, r12
je 0x18007986f
cmp r12, qword [rsi + 0x40]
je 0x180079874
call fcn.1800c1088
cmp rbx, rdi
je 0x18007999f
test r12, r12
jne 0x18007988e
call fcn.1800c1088
xor edi, edi
mov r11, rdi
jmp 0x180079894
mov r11, qword [r12]
xor edi, edi
cmp rbx, qword [r11 + 0x30]
jne 0x18007989f
call fcn.1800c1088
test r12, r12
jne 0x1800798ae
call fcn.1800c1088
mov r11, rdi
jmp 0x1800798b2
mov r11, qword [r12]
cmp rbx, qword [r11 + 0x30]
jne 0x1800798bd
call fcn.1800c1088
test r12, r12
jne 0x1800798cc
call fcn.1800c1088
mov r11, rdi
jmp 0x1800798d0
mov r11, qword [r12]
cmp rbx, qword [r11 + 0x30]
jne 0x1800798db
call fcn.1800c1088
cmp byte [rbx + 0x40], 0
je 0x1800798ff
cmp qword [rbx + 0x38], 8
jb 0x1800798ee
mov rdx, qword [rbx + 0x20]
jmp 0x1800798f2
lea rdx, [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x180079946
mov rax, qword [rbx + 0x60]
cmp qword [rbx + 0x68], 8
jb 0x180079910
mov rcx, qword [rbx + 0x50]
jmp 0x180079914
lea rcx, [rbx + 0x50]
cmp qword [rbx + 0x38], 8
jb 0x180079921
mov rdx, qword [rbx + 0x20]
jmp 0x180079925
lea rdx, [rbx + 0x20]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r12, r12
jne 0x180079950
call fcn.1800c1088
cmp byte [rbx + 0x71], 0
je 0x180079960
call fcn.1800c1088
jmp 0x180079860
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x71], 0
jne 0x180079982
mov rbx, rax
nop dword [rax]
mov rax, qword [rbx]
cmp byte [rax + 0x71], 0
jne 0x180079860
mov rbx, rax
jmp 0x180079970
mov rax, qword [rbx + 8]
cmp byte [rax + 0x71], 0
jne 0x180079997
cmp rbx, qword [rax + 0x10]
jne 0x180079997
mov rbx, rax
jmp 0x180079982
mov rbx, rax
jmp 0x180079860
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800799b9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r12d, r12d
mov qword [rsp + 0x58], r12
jmp 0x1800799bc
xor r12d, r12d
test r13, r13
jne 0x1800799c6
call fcn.1800c1088
cmp byte [rsi + 0x81], 0
je 0x1800799d9
call fcn.1800c1088
jmp 0x180079750
mov rax, qword [rsi + 0x10]
cmp byte [rax + 0x81], 0
jne 0x180079a10
mov rsi, rax
nop dword [rax]
mov rax, qword [rsi]
cmp byte [rax + 0x81], 0
jne 0x180079750
mov rsi, rax
jmp 0x1800799f0
mov rax, qword [rsi + 8]
cmp byte [rax + 0x81], 0
jne 0x180079a28
cmp rsi, qword [rax + 0x10]
jne 0x180079a28
mov rsi, rax
jmp 0x180079a10
mov rsi, rax
jmp 0x180079750
lea rax, vtable.CCriticalSectionSync.0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.18004f310
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, qword [r15 + 8]
call fcn.18006cc30
mov bl, 1
lea rax, vtable.CIntrusivePtr_class_CCacheProfile::CSectionMap_.0
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x180079a97
mov rax, qword [r8]
movsxd rcx, dword [rax + 4]
add rcx, r8
je 0x180079a97
lock xadd dword [rcx + 8], r14d
add r14d, 0xffffffff
jne 0x180079a97
mov rax, qword [rcx]
lea edx, [r14 + 1]
call qword [rax]
nop
jmp 0x180079a9e
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180079aae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1800bf8d0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret