Function at 0x140024e30
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov r13, r9
mov r12, r8
mov rbx, rdx
test rdx, rdx
jne 0x140024e71
xor eax, eax
jmp 0x1400251cf
call fcn.14002d140
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140024e94
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x21], rdi
call fcn.14002d140
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140024ec5
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x6f], rax
test r12, r12
jne 0x1400250c2
lea rcx, [rbp - 1]
call fcn.14003ff10
nop
call fcn.14002d140
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140024f09
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rax, [0x14024a7b0]
test rax, 0xffffffffffff0000
jne 0x140024f49
movzx edi, ax
mov ecx, edi
call fcn.14003e9c8
test rax, rax
je 0x140024f5c
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140005050
jmp 0x140024f5c
mov r8d, 1
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400016b0
nop
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400051d0
nop
lea r8, [rbp - 1]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call fcn.140023d90
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
lock add dword [rdx + 0x10], esi
jg 0x140024f97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140024faf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0xf]
cmp rdx, 2
jge 0x140024fcb
lea rcx, [rbp - 1]
call fcn.14003ff30
mov rbx, qword [rbp + 0x6f]
jmp 0x140025198
lea rcx, [rdx - 1]
test rcx, rcx
js 0x1400250bc
cmp rcx, rdx
jge 0x1400250bc
mov rax, qword [rbp + 7]
mov r9, qword [rax + rcx*8]
lea rcx, [r9 - 0x18]
mov rdi, qword [rbp - 0x21]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x140025046
cmp dword [rbx + 0x10], 0
jl 0x14002502e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002502e
call fcn.140001860
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140025024
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rdi, 0x18
mov qword [rbp - 0x21], rdi
jmp 0x140025042
mov r8d, dword [r9 - 0x10]
mov rdx, r9
lea rcx, [rbp - 0x21]
call fcn.1400016b0
mov rdi, qword [rbp - 0x21]
mov rdx, qword [rbp + 0xf]
mov r15d, r14d
mov rbx, r14
lea rax, [rdx - 1]
test rax, rax
jle 0x1400250b1
test r15d, r15d
jle 0x140025074
mov r8d, 1
lea rdx, [0x14024a7b0]
lea rcx, [rbp + 0x6f]
call fcn.140004e90
mov rdx, qword [rbp + 0xf]
test rbx, rbx
js 0x1400250ab
cmp rbx, rdx
jge 0x1400250ab
mov rax, qword [rbp + 7]
mov rdx, qword [rax + rbx*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x6f]
call fcn.140004e90
inc r15d
inc rbx
mov rdx, qword [rbp + 0xf]
lea rcx, [rdx - 1]
movsxd rax, r15d
cmp rax, rcx
jl 0x140025055
jmp 0x1400250b1
call fcn.14002dec4
nop
lea rcx, [rbp - 1]
call fcn.14003ff30
jmp 0x1400250e9
call fcn.14002dec4
nop
or rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400250d0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x6f]
call fcn.1400016b0
mov qword [rbp - 0x29], r14
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rbp + 0x6f]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140025198
test r12, r12
jne 0x140025143
mov rdx, rdi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140025186
test r13, r13
jne 0x140025157
mov rdx, r12
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140025186
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete r14b
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400251b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
jg 0x1400251cc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret