Function at 0x1000357fc
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov r15, rcx
xor edi, edi
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x58], rdi
mov rax, qword [rdx]
cmp dword [rax - 0x10], edi
je 0x100035ad4
mov rax, qword [r8]
cmp dword [rax - 0x10], edi
je 0x100035ad4
mov rax, qword [r9]
cmp dword [rax - 0x10], edi
je 0x100035ad4
lea rax, [r11 - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x10000bd90]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xd0]
cmp eax, edi
je 0x1000358a2
mov ebx, edi
jmp 0x100035a68
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1000358e1
mov ebx, edi
jmp 0x100035a68
mov rax, qword [rsi]
mov edi, dword [rax - 0x10]
mov ebx, 1
cmp dword [rax - 8], ebx
jle 0x1000358fb
mov edx, edi
mov rcx, rsi
call fcn.10002009c
mov rcx, qword [rsi]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000bdf8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x100035930
mov ebx, edi
jmp 0x100035a68
mov rax, qword [rbp]
mov edi, dword [rax - 0x10]
cmp dword [rax - 8], ebx
jle 0x100035946
mov edx, edi
mov rcx, rbp
call fcn.10002009c
mov rcx, qword [rbp]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000be18]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
cmp eax, edi
je 0x10003597c
mov ebx, edi
jmp 0x100035a68
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [0x10000be30]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8d, ecx
mov rcx, r12
call fcn.10001fec8
mov rdx, qword [r12]
mov edi, dword [rdx - 0x10]
cmp dword [rdx - 8], ebx
jle 0x1000359b6
mov edx, edi
mov rcx, r12
call fcn.10002009c
mov rcx, qword [r12]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
lea rdx, [0x10000be38]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [r14]
mov edi, dword [rdx - 0x10]
test edi, edi
je 0x100035a23
cmp dword [rdx - 8], ebx
jle 0x1000359fb
mov edx, edi
mov rcx, r14
call fcn.10002009c
mov rcx, qword [r14]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000be50]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [r13]
mov edi, dword [rax - 0x10]
test edi, edi
je 0x100035a66
cmp dword [rax - 8], ebx
jle 0x100035a3d
mov edx, edi
mov rcx, r13
call fcn.10002009c
mov rcx, qword [r13]
lea eax, [rdi + rdi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x10000be70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x100035a7d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rdi
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x100035aa4
cmp ebx, edi
jne 0x100035a99
mov rdx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rdi
mov rcx, rbp
call fcn.10002006c
nop
mov rcx, rsi
call fcn.10002006c
nop
mov rcx, r12
call fcn.10002006c
nop
mov rcx, r14
call fcn.10002006c
nop
mov rcx, r13
call fcn.10002006c
mov eax, ebx
jmp 0x100035b0c
mov rcx, rdx
call fcn.10002006c
nop
mov rcx, rsi
call fcn.10002006c
nop
mov rcx, r12
call fcn.10002006c
nop
mov rcx, qword [rsp + 0xd0]
call fcn.10002006c
nop
mov rcx, qword [rsp + 0xd8]
call fcn.10002006c
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret