Function at 0x100038754
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x430
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x420], rax
xor r12d, r12d
mov rsi, rcx
mov r9, rcx
lea ebx, [r12 + 1]
lea r8, [0x10001eb38]
lea rcx, [r11 - 0x1b8]
mov edx, 0xc7
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x30], ebx
mov ebp, ebx
call fcn.10002e570
lea rdx, [rsp + 0x38]
mov r13, 0xffffffff80000000
mov r9d, 0x2001f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x290]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x10003893a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x10003890d
cmp dword [rsp + 0x30], ebx
je 0x100038836
cmp dword [rsp + 0x30], 2
jne 0x10003890d
lea rax, [rsp + 0x40]
cmp rax, r12
je 0x10003890d
cmp r12w, word [rsp + 0x40]
je 0x10003890d
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x40]
call fcn.100037734
mov rcx, qword [rsp + 0x38]
cmp eax, r12d
jne 0x10003887a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100038a53
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea rdx, [0x1000206c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x244
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x10003890a
mov r9d, dword [rsp + 0x30]
cmp r9d, ebx
je 0x1000388c0
cmp r9d, 2
jne 0x10003890a
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
xor r8d, r8d
xor edx, edx
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1000206c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10003890d
mov ebp, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, r12d
jne 0x10003893a
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r12d
je 0x100038a53
mov rdx, rsi
jmp 0x100038a4b
lea r8, [0x1000206e8]
lea rcx, [rsp + 0x290]
mov r9, rsi
mov edx, 0xc7
call fcn.10002e570
lea rdx, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x290]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x100038a53
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x1000206c8]
xor r8d, r8d
mov dword [rsp + 0x34], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100038a1a
cmp dword [rsp + 0x30], ebx
je 0x1000389cb
cmp dword [rsp + 0x30], 2
jne 0x100038a1a
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1000206c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rsp + 0x30]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
xor r8d, r8d
repne scasw ax, word [rdi]
xor edx, edx
not rcx
sub rcx, rbx
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100038a1d
mov ebx, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
jne 0x100038a53
lea rdx, [rsp + 0x290]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r12d
je 0x100038a53
lea rdx, [rsp + 0x290]
mov rcx, r13
call fcn.1000426b0
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret