Function at 0x1800680e0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x8a0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x890], rax
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x90], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x92]
call fcn.1800c31a0
lea r11, [rsp + 0x58]
mov qword [rsp + 0x20], r11
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExt
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800683e0
cmp qword [rsp + 0x58], rbx
je 0x1800683e0
lea rax, vtable.CNTSecurityObject.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
call fcn.18007f450
lea rcx, [rsp + 0x68]
call fcn.18007f7a0
lea r8, str.Stats_
mov edx, 0x400
lea rcx, [rsp + 0x90]
call fcn.1800c0e4c
lea r8, [0x180103280]
mov edx, 0x400
lea rcx, [rsp + 0x90]
call fcn.1800c29a4
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea r8, str.Settings_
mov edx, 0x400
lea rcx, [rsp + 0x90]
call fcn.1800c0e4c
lea r8, [0x180103280]
mov edx, 0x400
lea rcx, [rsp + 0x90]
call fcn.1800c29a4
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp eax, 5
jne 0x180068289
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x1060000
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180068274
mov r8d, 0xf003f
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.180080010
test eax, eax
jne 0x180068274
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180068289
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x1060006
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180068314
mov dword [rsp + 0x60], 0x400
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x180068314
mov r8d, 0x10002
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.18007fa00
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180068329
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18006833e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExtCLSID
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800683ab
mov dword [rsp + 0x28], 4
lea rax, [0x180109b48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x180103280]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800683c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800683d0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800683e0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.1800bf8d0
add rsp, 0x8a0
pop rbx
ret