Function at 0x1000445f0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x100080218]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rcx
mov rbp, r8
mov r14, rdx
xor r15d, r15d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x40], r15
mov word [rsp + 0x80], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x58]
mov edi, 0x208
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], edi
mov r12, r15
call fcn.100002914
cmp r14, r15
je 0x10004494e
cmp rsi, r15
je 0x10004494e
cmp rbp, r15
je 0x1000446da
cmp word [rbp], r15w
je 0x1000446da
mov rcx, rdi
mov rax, rbp
mov ebx, r15d
cmp word [rax], r15w
je 0x1000446bb
add rax, 2
sub rcx, 1
jne 0x1000446ab
cmp rcx, r15
jne 0x1000446c7
mov ebx, 0x80070057
jmp 0x1000446d1
mov rax, rdi
sub rax, rcx
lea r12, [rax + rax]
cmp ebx, r15d
jl 0x100044953
lea rax, [rsp + 0x40]
cmp r12, r15
mov edi, r15d
sete dil
lea rdx, [0x10007a160]
mov r9d, 0xf003f
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100044953
movsxd r13, edi
mov esi, r15d
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000448ce
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000448ce
lea rdx, [rsp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r15d
jne 0x1000448ce
cmp r13, r15
jne 0x100044863
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100044851
mov rcx, qword [rsp + 0x50]
lea eax, [r12 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x1000448ce
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1000448ce
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r15
je 0x100044887
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.10001bc84
mov rdi, rax
jmp 0x10004488a
mov rdi, r15
cmp rdi, r15
je 0x10004489b
mov rcx, rdi
call fcn.10001bd10
mov ebx, eax
jmp 0x1000448a0
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x1000448b7
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.100005058
mov rdi, r15
mov ebx, eax
cmp rdi, r15
je 0x1000448c9
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov edi, 0x80070000
inc esi
cmp ebx, r15d
jge 0x10004472a
lea rcx, [rsp + 0x58]
cmp ebx, 0x80070103
cmove ebx, r15d
call fcn.1000134f4
cmp eax, r15d
jne 0x100044941
lea rcx, [rsp + 0x60]
call fcn.100001104
mov rdi, rax
mov eax, r15d
lea rcx, [rsp + 0x60]
cmp rdi, rcx
sete al
cmp eax, r15d
jne 0x100044941
lea rcx, [rdi + 0x20]
mov rax, rdi
neg rax
sbb rdx, rdx
xor r9d, r9d
xor r8d, r8d
and rdx, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
cmp rdi, r15
je 0x1000448ff
mov rcx, rdi
jmp 0x1000448f7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100044953
mov ebx, 0x80070057
lea rcx, [rsp + 0x58]
call fcn.1000029ec
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000010b0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret