Function at 0x140005e2c
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov edi, edx
lea r15, [0x1400357c0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400060e1
test al, 0x10
je 0x1400060e1
xor esi, esi
mov qword [rbp - 0x11], rsi
mov dword [rbp - 9], esi
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x11]
call fcn.140006610
nop
mov rcx, qword [rax]
mov eax, dword [0x1400357b4]
neg eax
sbb r9d, r9d
and r9d, 0x100
add r9d, 0x20006
mov qword [rsp + 0x20], rcx
call fcn.140006b78
movzx ebx, ax
mov r12d, 0x80070000
or ebx, r12d
test eax, eax
cmovle ebx, eax
lea r14d, [rsi + 1]
mov rax, qword [rbp + 0x67]
cmp qword [rax], rsi
je 0x140005ed8
mov dword [rax + 8], r14d
test ebx, ebx
js 0x1400060cb
test r15, r15
jne 0x140005eef
mov ebx, 0x80070057
jmp 0x1400060cb
mov qword [rbp + 0x67], rsi
mov qword [rbp - 0x31], rsi
mov dword [rbp - 0x29], esi
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x31]
call fcn.1400066cc
nop
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, r14d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
nop
mov rcx, qword [rbp + 0x77]
cmp qword [rcx], rsi
je 0x140005f44
mov dword [rcx + 8], r14d
test eax, eax
je 0x140005f6e
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
cmp dword [rbp - 0x29], esi
je 0x14000606c
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rbp - 0x29], esi
jmp 0x14000606c
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rbp - 1]
call fcn.140015590
mov dword [rbp - 1], 0x12019f
mov dword [rbp + 3], edi
mov dword [rbp + 7], 3
mov dword [rbp + 0x1b], r14d
lea rax, str.ALL_APPLICATION_PACKAGES
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x19], esi
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x21]
call fcn.1400066cc
nop
mov r9, qword [rax]
mov r8, qword [rbp + 0x67]
lea rdx, [rbp - 1]
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
nop
mov rcx, qword [rbp + 0x77]
cmp qword [rcx], rsi
je 0x140005fd4
mov dword [rcx + 8], r14d
test eax, eax
je 0x140005ffa
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
cmp dword [rbp - 0x19], esi
je 0x140005ff5
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rbp - 0x19], esi
jmp 0x140005f53
mov qword [rsp + 0x30], rsi
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, r14d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
je 0x140006046
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
cmp dword [rbp - 0x19], esi
je 0x140006041
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rbp - 0x19], esi
jmp 0x140005f53
cmp dword [rbp - 0x19], esi
je 0x140006058
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rbp - 0x19], esi
cmp dword [rbp - 0x29], esi
je 0x14000606a
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rbp - 0x29], esi
mov ebx, esi
test ebx, ebx
js 0x1400060cb
lea rdx, str.LogImmersive
mov rcx, qword [rbp - 0x11]
cmp edi, r14d
jne 0x1400060bb
mov dword [0x1400357a8], r14d
mov dword [rsp + 0x28], 4
lea rax, [0x1400359dc]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, ax
or ebx, r12d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1400060c9
jmp 0x1400060cb
mov dword [0x1400357a8], esi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400060aa
mov ebx, esi
cmp dword [rbp - 9], esi
je 0x1400060dd
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 9], esi
mov eax, ebx
jmp 0x1400060e6
mov eax, 0x80070003
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret