Function at 0x7d2781d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rbp, r8
mov rbx, rdx
mov r8d, 4
call fcn.7d27bee0
mov rdi, rax
test rax, rax
je 0x7d278249
cmp rax, 0x12340001
je 0x7d27821d
mov rcx, rax
call fcn.7d279670
test rax, rax
je 0x7d278242
mov rcx, rdi
call fcn.7d27b880
mov rcx, rdi
call fcn.7d221938
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x431
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, 6
jmp 0x7d27821f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x7d278230
mov dl, 1
mov qword [rsp + 0x50], rsi
mov rcx, rbx
call fcn.7d2213f2
mov rsi, rax
test rax, rax
je 0x7d2784e3
lea rdx, str.Type
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
lea rdx, str.Start
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
lea rdx, str.ErrorControl
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
or rdi, 0xffffffffffffffff
test rbp, rbp
je 0x7d27839b
lea rdx, str.DisplayName
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, rdi
nop dword [rax + rax]
cmp word [rbp + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d278360
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
mov rbp, qword [rsp + 0x88]
test rbp, rbp
je 0x7d2783fb
lea rdx, str.ImagePath
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, rdi
nop dword [rax]
cmp word [rbp + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d2783c0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
mov rbp, qword [rsp + 0xa8]
test rbp, rbp
je 0x7d278457
lea rdx, str.ObjectName
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, rdi
nop dword [rax]
cmp word [rbp + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d278420
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d2784c6
mov rcx, rbx
call fcn.7d277190
test eax, eax
js 0x7d2784c6
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
cmp word [rbx + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x7d278470
lea ecx, [rdi*2 + 6]
call fcn.7d221988
mov ecx, dword [str.sbox5.40]
mov rdx, rax
mov rdi, rax
sub rdx, rbx
mov dword [rax], ecx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rdx + rbx + 4], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x7d2784a0
mov rcx, rdi
call sub.ntdll.dll__wcslwr
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x7d2784e5
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret