Function at 0x1000355ec
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov r15, rcx
xor edi, edi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], rdi
mov rax, qword [rdx]
cmp dword [rax - 0x10], edi
je 0x1000358c3
mov rax, qword [r8]
cmp dword [rax - 0x10], edi
je 0x1000358c3
mov rax, qword [r9]
cmp dword [rax - 0x10], edi
je 0x1000358c3
lea rax, [r11 - 0x20]
mov qword [r11 - 0x58], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x10000ba80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xe0]
cmp eax, edi
je 0x100035691
mov ebx, edi
jmp 0x100035857
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1000356d0
mov ebx, edi
jmp 0x100035857
mov rax, qword [rsi]
mov edi, dword [rax - 0x10]
mov ebx, 1
cmp dword [rax - 8], ebx
jle 0x1000356ea
mov edx, edi
mov rcx, rsi
call fcn.10001fbd0
mov rcx, qword [rsi]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000bae8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x10003571f
mov ebx, edi
jmp 0x100035857
mov rax, qword [rbp]
mov edi, dword [rax - 0x10]
cmp dword [rax - 8], ebx
jle 0x100035735
mov edx, edi
mov rcx, rbp
call fcn.10001fbd0
mov rcx, qword [rbp]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000bb08]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x10003576b
mov ebx, edi
jmp 0x100035857
xor eax, eax
lea rcx, [rax - 1]
lea rdx, [0x10000bb20]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8d, ecx
mov rcx, r12
call fcn.10001fa30
mov rdx, qword [r12]
mov edi, dword [rdx - 0x10]
cmp dword [rdx - 8], ebx
jle 0x1000357a5
mov edx, edi
mov rcx, r12
call fcn.10001fbd0
mov rcx, qword [r12]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
lea rdx, [0x10000bb28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [r14]
mov edi, dword [rdx - 0x10]
test edi, edi
je 0x100035812
cmp dword [rdx - 8], ebx
jle 0x1000357ea
mov edx, edi
mov rcx, r14
call fcn.10001fbd0
mov rcx, qword [r14]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000bb40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [r13]
mov edi, dword [rax - 0x10]
test edi, edi
je 0x100035855
cmp dword [rax - 8], ebx
jle 0x10003582c
mov edx, edi
mov rcx, r13
call fcn.10001fbd0
mov rcx, qword [r13]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000bb60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x10003586c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rdi
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x100035893
cmp ebx, edi
jne 0x100035888
mov rdx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rdi
mov rcx, rbp
call fcn.10001fba0
nop
mov rcx, rsi
call fcn.10001fba0
nop
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, r14
call fcn.10001fba0
nop
mov rcx, r13
call fcn.10001fba0
mov eax, ebx
jmp 0x1000358fb
mov rcx, rdx
call fcn.10001fba0
nop
mov rcx, rsi
call fcn.10001fba0
nop
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, qword [rsp + 0xe0]
call fcn.10001fba0
nop
mov rcx, qword [rsp + 0xe8]
call fcn.10001fba0
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret