Function at 0x7ff2ada6450
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ff2adb3100]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r13d, r9d
mov r14d, edx
mov rdx, rcx
mov qword [rsp + 0x88], rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rbx
mov r12, rbx
mov qword [r11 - 0x78], rbx
mov r15, rbx
mov qword [r11 - 0x68], rbx
mov byte [r11 - 0x40], bl
mov byte [r11 - 0x3f], bl
mov byte [r11 - 0x3e], bl
mov byte [r11 - 0x3d], bl
mov byte [r11 - 0x3c], bl
mov byte [r11 - 0x3b], bl
mov byte [r11 - 0x3a], bl
mov byte [r11 - 0x39], bl
mov byte [r11 - 0x38], bl
mov esi, ebx
mov dword [rsp + 0x58], ebx
cmp r14d, ebx
je 0x7ff2ada68bd
cmp r14d, 0x3e7
ja 0x7ff2ada68bd
cmp rcx, rbx
je 0x7ff2ada68bd
cmp r8, rbx
jne 0x7ff2ada68bd
test r9d, 0xfffffff8
jne 0x7ff2ada68b0
mov eax, r9d
and eax, 1
mov dword [rsp + 0x7c], eax
je 0x7ff2ada651d
test r9b, 2
jne 0x7ff2ada68b0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [rsp + 0x98], rcx
lea eax, [rcx + 0x33]
mov edi, eax
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
mov r15, rax
mov qword [rsp + 0x80], rax
cmp rax, rbx
jne 0x7ff2ada6568
mov ecx, 8
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
lea r8, str.SOFTWAREMicrosoftCryptographyDefaultsProvider
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy_s
mov byte [r15 + 0x31], 0x5c
lea rdx, [rdi - 0x32]
lea rcx, [r15 + 0x32]
mov rdi, qword [rsp + 0x88]
mov r8, rdi
call sub.ntdll.dll_strcpy_s
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA
cmp eax, ebx
je 0x7ff2ada65cd
mov ecx, 0x57
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, [0x7ff2ada1844]
mov rcx, qword [rsp + 0x50]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA
cmp eax, ebx
je 0x7ff2ada6616
mov ecx, eax
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
cmp r14d, dword [rsp + 0x68]
je 0x7ff2ada662d
mov ecx, 0x57
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov rcx, qword [rsp + 0x50]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey
cmp eax, ebx
je 0x7ff2ada664d
mov ecx, eax
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov qword [rsp + 0x50], rbx
jmp 0x7ff2ada68e8
mov rcx, rbx
mov qword [rsp + 0x50], rbx
cmp dword [rsp + 0x7c], ebx
je 0x7ff2ada676c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.SOFTWAREMicrosoftCryptographyDefaultsProvider_TypesType
repne scasb al, byte [rdi]
not rcx
add ecx, 5
mov edi, ecx
mov edx, ecx
lea ecx, [rax + 0x40]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
mov r12, rax
mov qword [rsp + 0x70], rax
cmp rax, rbx
jne 0x7ff2ada669e
mov ecx, 8
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
lea r8, str.SOFTWAREMicrosoftCryptographyDefaultsProvider_TypesType
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy_s
lea rdx, [rsp + 0xa8]
mov ecx, r14d
call fcn.7ff2ada8548
lea r8, [rsp + 0xad]
mov rdx, rdi
mov rcx, r12
call sub.ntdll.dll_strcat_s
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExA
cmp eax, ebx
je 0x7ff2ada6724
mov ecx, 0x57
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
test r13b, 4
je 0x7ff2ada675a
lea rdx, [0x7ff2ada183c]
mov rcx, qword [rsp + 0x50]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueA
cmp eax, ebx
je 0x7ff2ada674c
mov ecx, eax
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov esi, 1
mov dword [rsp + 0x58], esi
jmp 0x7ff2ada68e8
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
jmp 0x7ff2ada6875
test r13b, 2
je 0x7ff2ada6875
test r13b, 4
je 0x7ff2ada6862
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.SOFTWAREMicrosoftCryptographyProvidersType
repne scasb al, byte [rdi]
not rcx
add ecx, 5
mov edi, ecx
mov edx, ecx
lea ecx, [rax + 0x40]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
mov r12, rax
mov qword [rsp + 0x70], rax
cmp rax, rbx
jne 0x7ff2ada67bf
mov ecx, 8
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
lea r8, str.SOFTWAREMicrosoftCryptographyProvidersType
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy_s
lea rdx, [rsp + 0xa8]
mov ecx, r14d
call fcn.7ff2ada8548
lea r8, [rsp + 0xad]
mov rdx, rdi
mov rcx, r12
call sub.ntdll.dll_strcat_s
lea rdx, [rsp + 0x60]
mov ecx, 0x2001f
call qword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
cmp eax, ebx
jge 0x7ff2ada6818
mov ecx, 0x57
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x60]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExA
mov edi, eax
cmp eax, ebx
je 0x7ff2ada6849
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov ecx, edi
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov esi, 1
mov dword [rsp + 0x58], esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x7ff2ada68e8
mov edx, r14d
mov rcx, rdi
call sym.CRYPTSP.dll_CryptSetProviderA
mov esi, eax
mov dword [rsp + 0x58], eax
jmp 0x7ff2ada68e8
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x7ff2ada183c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExA
cmp eax, ebx
je 0x7ff2ada68a9
mov ecx, eax
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov esi, 1
jmp 0x7ff2ada68e8
mov ecx, 0x80090009
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
mov ecx, 0x57
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x7ff2ada68e8
cmp r15, rbx
je 0x7ff2ada68f6
mov rcx, r15
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
cmp r12, rbx
je 0x7ff2ada6904
mov rcx, r12
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x7ff2ada6913
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey
mov eax, esi
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.7ff2adaaa90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret