Function at 0x10006c8d0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r13d, r13d
lea rcx, [r11 - 0x74]
mov rbp, r8
mov qword [rsp + 0x40], rcx
lea rcx, [r11 - 0x50]
mov rax, rdx
mov qword [rsp + 0x38], rcx
lea rcx, [r11 - 0x78]
mov edi, r9d
mov qword [rsp + 0x30], rcx
lea rcx, [r11 - 0x48]
mov dword [rsp + 0x50], r9d
mov qword [rsp + 0x28], rcx
lea rcx, [r11 - 0x58]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x20], rcx
lea r9, [r11 - 0x68]
lea r8, [r11 - 0x60]
mov rcx, rax
mov rdx, rbp
mov ebx, r13d
mov qword [r11 - 0x60], r13
mov qword [r11 - 0x70], r13
mov qword [r11 - 0x68], r13
mov qword [r11 - 0x58], r13
mov qword [r11 - 0x48], r13
mov dword [r11 - 0x78], r13d
mov dword [r11 - 0x74], r13d
mov qword [r11 - 0x50], r13
call fcn.10006c730
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
cmp qword [rsp + 0x78], r13
je 0x10006cae9
cmp qword [rsp + 0x70], r13
je 0x10006cae9
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x68]
lea r14d, [r13 + 3]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, r13d
jne 0x10006cae9
cmp edi, r13d
je 0x10006cda8
mov rbp, qword [rsp + 0x88]
cmp rsi, r13
jne 0x10006ca16
cmp rbp, r13
jne 0x10006ca16
mov rcx, qword [rsp + 0x68]
lea rax, [0x1000062c0]
lea r9d, [r13 + 1]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x10006cad9
mov edi, dword [rsp + 0x60]
mov eax, edi
shr eax, 1
not eax
and eax, 1
jne 0x10006ca4c
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
je 0x10006cad5
mov eax, edi
sub eax, 1
je 0x10006cd8a
sub eax, 2
je 0x10006cd8a
sub eax, 5
je 0x10006cb95
sub eax, 0xfff9
je 0x10006cb5d
sub eax, 2
je 0x10006cb5d
sub eax, 0xfffd
je 0x10006cb4d
sub eax, 2
je 0x10006cb4d
cmp eax, 0x20006
je 0x10006cb95
cmp rsi, r13
je 0x10006cad5
mov r9d, 1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov edi, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, r13d
jne 0x10006cb2a
cmp r12, r13
jne 0x10006cb2a
cmp rsi, r13
jne 0x10006cb2a
cmp qword [rsp + 0x70], r13
je 0x10006cb2a
cmp qword [rsp + 0x78], r13
je 0x10006cb2a
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r13d
je 0x10006cb2a
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.100057734
cmp ebx, r13d
je 0x10006cdee
cmp edi, r13d
jne 0x10006cdc6
cmp ebx, 2
jne 0x10006cdc6
mov ebx, r13d
jmp 0x10006cdee
cmp rsi, r13
je 0x10006cad5
mov r9d, 2
jmp 0x10006caa7
cmp rsi, r13
je 0x10006cad5
mov rcx, rsi
call fcn.100053148
mov dword [rsp + 0x28], 4
mov r9d, 4
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
jmp 0x10006cac2
cmp rsi, r13
je 0x10006cad5
or r14, 0xffffffffffffffff
bt edi, 0x12
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x60], 7
jae 0x10006ccf9
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x10006ccf9
cmp dword [rsp + 0x60], 7
jne 0x10006ccf9
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x64]
shr rax, 1
not rcx
lea r15, [rcx + rax + 2]
lea eax, [r14 + 3]
mul r15
cmovo rax, r14
mov rcx, rax
call fcn.10007fa96
mov rbp, rax
cmp rax, r13
jne 0x10006cc30
lea ebx, [r14 + 0xf]
jmp 0x10006ccf4
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x10006cce9
xor eax, eax
mov r13, rbp
cmp ax, word [rbp]
je 0x10006cc95
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor edx, edx
mov rcx, r14
cmp eax, edx
je 0x10006ccc3
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r13, [r13 + rcx*2]
cmp dx, word [r13]
jne 0x10006cc69
lea rdx, [r15 - 1]
mov r8, rsi
mov rcx, r13
call fcn.100039df8
xor edx, edx
cmp eax, edx
jl 0x10006ccdc
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
mov word [r13 + rcx*2], dx
xor r13d, r13d
jmp 0x10006ccf4
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rax, r14
not rcx
dec rcx
sub rax, rcx
add r15, rax
jmp 0x10006ccbe
mov rcx, rbp
call fcn.10007faa2
xor r13d, r13d
jmp 0x10006ccf1
mov rcx, rbp
call fcn.10007faa2
mov rbp, r13
cmp rbp, r13
jne 0x10006cd4e
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, 2
not rcx
lea r15, [rcx + 1]
mul r15
cmovo rax, r14
mov rcx, rax
call fcn.10007fa96
mov rbp, rax
cmp rax, r13
je 0x10006cad5
lea rdx, [r15 - 1]
mov r8, rsi
mov rcx, rax
call fcn.100039df8
xor eax, eax
mov rcx, r14
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
mov word [rbp + rcx*2], r13w
mov rcx, qword [rsp + 0x68]
lea eax, [r15 + r15]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp rbp, r13
je 0x10006cad5
mov rcx, rbp
call fcn.10007faa2
jmp 0x10006cad5
cmp rbp, r13
je 0x10006cad5
mov eax, dword [rsp + 0x64]
mov r9d, r14d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
jmp 0x10006cac2
cmp r12, r13
je 0x10006cade
mov rcx, qword [rsp + 0x68]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
jmp 0x10006cade
lea rdx, [0x10002f340]
mov r8d, ebx
mov ecx, 2
call fcn.1000527f4
lea rdx, [0x10002f308]
mov r8, rbp
mov ecx, 2
call fcn.1000527f4
lea rax, [0x100024488]
lea r8, [0x100024498]
cmp edi, r13d
lea rdx, [0x10002f378]
mov r9, rbp
mov ecx, 4
cmovne r8, rax
mov dword [rsp + 0x20], ebx
call fcn.1000527f4
mov rcx, qword [rsp + 0x88]
cmp rcx, r13
je 0x10006ce2d
call fcn.10007faae
cmp qword [rsp + 0x70], r13
je 0x10006ce3e
mov rcx, qword [rsp + 0x70]
call fcn.10007faa2
cmp r12, r13
je 0x10006ce4b
mov rcx, r12
call fcn.10007faa2
cmp rsi, r13
je 0x10006ce58
mov rcx, rsi
call fcn.10007faa2
movzx eax, bx
or eax, 0x80070000
cmp ebx, r13d
cmovle eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret