Function at 0x100032e94
Capabilities:
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x290], rax
call fcn.100030d34
call fcn.10002ee94
and qword [rsp + 0x58], 0
mov esi, 1
lea rax, [rsp + 0x58]
mov r14, 0xffffffff80000001
lea edi, [rsi + 2]
lea rdx, [0x10001c950]
xor r8d, r8d
mov rcx, r14
mov r9d, edi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ebp, [rsi + 3]
test eax, eax
jne 0x100032f3d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x10001c1e0]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x10001ca60]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10003305f
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, [0x10001cac0]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100032fe4
cmp dword [rsp + 0x50], esi
jne 0x100032fe4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
cmp rcx, 0x14
jae 0x100033054
lea rcx, [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x100033054
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
mov r8d, 0x103
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x100033054
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x10001cac0]
mov r9d, esi
not rcx
xor r8d, r8d
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x50], 0x208
mov edi, 0x104
test rax, rax
je 0x1000330c9
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1000367c4
test eax, eax
je 0x1000330c9
lea r8, [0x10001e1b8]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.10002e3d4
test eax, eax
js 0x1000330c9
lea rcx, [rsp + 0x80]
call fcn.1000400f0
test eax, eax
je 0x1000330c9
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x50], 0x208
test rax, rax
je 0x100033130
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call fcn.100036b48
test eax, eax
je 0x100033130
lea r8, [0x10001e1b8]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.10002e3d4
test eax, eax
js 0x100033130
lea rcx, [rsp + 0x80]
call fcn.1000400f0
test eax, eax
je 0x100033130
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x10001e838]
mov ecx, ebp
call fcn.100045708
and qword [rsp + 0x58], 0
xor edi, edi
and qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
lea rdx, [0x10001c750]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x28], esi
and dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000331dc
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, [0x10001e770]
xor r8d, r8d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000331c4
cmp dword [rsp + 0x50], esi
cmove edi, esi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1000331dc
lea rdx, [0x10001e900]
jmp 0x100033201
lea rdx, [0x10001e860]
mov ecx, ebp
call fcn.100045708
call fcn.100031ce8
lea rdx, [0x10001e8a0]
test eax, eax
je 0x100033201
lea rdx, [0x10001e8d0]
mov ecx, ebp
call fcn.100045708
call fcn.100032084
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x2a0]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret