Function at 0x1400e636c
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp - 9], rax
mov r10, qword [rbp + 0x7f]
lea r11, str.SOFTWAREMicrosoftTelemetryClientThrottleStore
mov r13, qword [rbp + 0x6f]
xor r14d, r14d
mov eax, dword [rbp + 0x77]
mov esi, r14d
mov qword [rbp - 0x39], r10
mov r15d, r14d
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r14
mov dword [rbp - 0x5d], r14d
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x61], 8
mov qword [rbp - 0x31], r11
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rdx
mov qword [rbp - 0x19], r8
mov qword [rbp - 0x11], r9
test r10, r10
jne 0x1400e63f0
mov esi, 0x80070057
jmp 0x1400e65b1
neg eax
mov dword [r10], r14d
lea r12, [rbp - 0x31]
sbb rdi, rdi
neg rdi
add rdi, 0xffffffff80000001
mov rbx, rdi
mov rdx, qword [r12]
test rdx, rdx
je 0x1400e647a
lea rax, [rbp - 0x51]
mov r9d, 0x103
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e6463
cmp rdi, rbx
je 0x1400e643f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp - 0x51]
mov eax, 1
and qword [rbp - 0x51], rsi
cmp r14d, 4
cmove r15d, eax
add r14d, eax
add r12, 8
cmp r14d, 5
jb 0x1400e6409
jmp 0x1400e647a
and qword [rbp - 0x51], rsi
cmp eax, 2
je 0x1400e647a
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp rdi, rbx
je 0x1400e658f
lea rcx, [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp - 0x41]
mov r14d, reloc.WSOCK32.dll_inet_ntoa
mov qword [rbp - 0x59], rax
test r15d, r15d
je 0x1400e64fb
test r13, r13
je 0x1400e64fb
lea rax, [rbp - 0x61]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x5d]
lea rax, [rbp - 0x49]
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e64fb
cmp dword [rbp - 0x5d], r14d
jne 0x1400e64fb
cmp dword [rbp - 0x61], 8
jne 0x1400e64fb
mov rax, qword [rbp - 0x49]
cmp rax, 0xffffffffffffffff
je 0x1400e655d
cmp qword [rbp - 0x59], rax
jb 0x1400e655d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400e658f
lea rax, [rbp - 0x61]
mov dword [rbp - 0x61], 8
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x5d]
lea rax, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.ThrottleExpiryTime
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e658f
cmp dword [rbp - 0x5d], r14d
jne 0x1400e658f
cmp dword [rbp - 0x61], 8
jne 0x1400e658f
mov rax, qword [rbp - 0x49]
cmp rax, 0xffffffffffffffff
je 0x1400e655d
cmp qword [rbp - 0x59], rax
jb 0x1400e655d
lea rdx, [0x14011a1b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RegDeleteTreeW]
jmp 0x1400e658f
mov rax, qword [rbp - 0x39]
lea rdx, str.AccessTime
mov ecx, 1
mov dword [rsp + 0x28], 8
mov r9d, r14d
xor r8d, r8d
mov dword [rax], ecx
lea rax, [rbp - 0x59]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400e65a2
cmp rdi, rbx
je 0x1400e65a2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400e65b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140106ed0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret