Function at 0x140030c9c
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
xor r12d, r12d
mov qword [rbp - 0x21], r8
mov ebx, r9d
mov qword [rbp - 1], r12
lea rax, [rbp - 0x19]
mov dword [rbp - 0x29], ebx
mov qword [rsp + 0x40], rax
lea r9, [rbp - 9]
lea rax, [rbp + 7]
mov qword [rbp - 0x11], r12
mov qword [rsp + 0x38], rax
mov r14, r8
lea rax, [rbp - 0x25]
mov qword [rbp - 9], r12
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
lea rax, [rbp + 0x17]
mov qword [rbp + 0xf], r12
mov qword [rsp + 0x28], rax
mov rcx, rdx
lea rax, [rbp + 0xf]
mov qword [rbp + 0x17], r12
mov qword [rsp + 0x20], rax
mov esi, r12d
mov dword [rbp - 0x25], r12d
mov dword [rbp - 0x19], r12d
mov qword [rbp + 7], r12
call fcn.140030b00
mov r13, qword [rbp + 0xf]
mov rdi, qword [rbp + 0x17]
cmp qword [rbp - 1], r12
je 0x140031101
cmp qword [rbp - 9], r12
je 0x140031101
mov rdx, qword [rbp - 9]
lea rax, [rbp - 0x11]
mov rcx, qword [rbp - 1]
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x140031101
test ebx, ebx
je 0x14003114c
mov r12, qword [rbp + 7]
xor ecx, ecx
test rdi, rdi
jne 0x140030dc9
test r12, r12
jne 0x140030dc9
mov rcx, qword [rbp - 0x11]
lea rax, [0x14003f4a0]
mov dword [rsp + 0x28], 2
lea r9d, [rdi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x1400310f7
mov r15d, dword [rbp - 0x25]
mov r14d, 1
mov ebx, r15d
shr ebx, 1
not ebx
and ebx, r14d
jne 0x140030e02
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmovne ebx, r14d
test ebx, ebx
je 0x1400310ed
mov eax, r15d
sub eax, r14d
je 0x1400310c4
sub eax, 2
je 0x1400310c4
sub eax, 5
je 0x140030ee4
sub eax, 0xfff9
je 0x140030eb5
sub eax, 2
je 0x140030eb5
sub eax, 0xfffd
je 0x140030e93
sub eax, 2
je 0x140030e93
cmp eax, 0x20006
je 0x140030ee4
xor r12d, r12d
test rdi, rdi
je 0x1400310f0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x140030e5f
mov r9d, r14d
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x1400310f0
xor r12d, r12d
test rdi, rdi
je 0x1400310f0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x140030ea3
mov r9d, 2
jmp 0x140030e6c
xor r12d, r12d
test rdi, rdi
je 0x1400310f0
mov rcx, rdi
call fcn.140017200
mov dword [rbp - 0x25], eax
lea r9d, [r12 + 4]
lea rax, [rbp - 0x25]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x140030e7c
xor r12d, r12d
test rdi, rdi
je 0x1400310f0
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x19], r12d
mov dword [rbp - 0x25], 7
bt r15d, 0x12
jae 0x140031044
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x25]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031044
cmp dword [rbp - 0x25], 7
jne 0x140031044
mov rcx, rbx
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140030f41
mov r15d, dword [rbp - 0x19]
mov eax, 2
shr r15, 1
add r15, 3
add r15, rcx
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.14003c460
mov r14, rax
test rax, rax
jne 0x140030f7d
lea esi, [rax + 0xe]
jmp 0x140031044
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x25]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031034
xor eax, eax
mov r12, r14
cmp ax, word [r14]
je 0x140030fe0
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor ecx, ecx
test eax, eax
je 0x14003100c
mov rax, rbx
inc rax
cmp word [r12 + rax*2], cx
jne 0x140030fc7
lea r12, [r12 + rax*2]
add r12, 2
cmp cx, word [r12]
jne 0x140030fb2
lea rdx, [r15 - 1]
mov r8, rdi
mov rcx, r12
call fcn.140001470
xor ecx, ecx
test eax, eax
js 0x140031027
mov rax, rbx
inc rax
cmp word [rdi + rax*2], cx
jne 0x140030ff8
mov word [r12 + rax*2 + 2], cx
xor r12d, r12d
jmp 0x14003103f
mov rcx, rbx
xor r12d, r12d
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140031012
mov rax, rbx
sub rax, rcx
add r15, rax
jmp 0x14003103f
mov rcx, r14
call fcn.14003c408
xor r12d, r12d
jmp 0x14003103c
mov rcx, r14
call fcn.14003c408
mov r14, r12
test r14, r14
jne 0x140031090
mov r15, rbx
inc r15
cmp word [rdi + r15*2], r12w
jne 0x140031047
add r15, 2
mov eax, 2
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.14003c460
mov r14, rax
test rax, rax
je 0x1400310f0
lea rdx, [r15 - 1]
mov r8, rdi
mov rcx, rax
call fcn.140001470
inc rbx
cmp word [r14 + rbx*2], r12w
jne 0x140031080
mov word [r14 + rbx*2 + 2], r12w
mov rcx, qword [rbp - 0x11]
lea eax, [r15 + r15]
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test r14, r14
je 0x1400310f0
mov rcx, r14
call fcn.14003c408
jmp 0x1400310f0
test r12, r12
je 0x1400310ed
mov eax, dword [rbp - 0x19]
mov r9d, 3
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor r12d, r12d
mov ebx, dword [rbp - 0x29]
mov r14, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14003113a
test r13, r13
jne 0x14003113a
test rdi, rdi
jne 0x14003113a
cmp qword [rbp - 9], r12
je 0x14003113a
cmp qword [rbp - 1], r12
je 0x14003113a
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003113a
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call fcn.14001a7c0
test esi, esi
je 0x14003118a
test ebx, ebx
jne 0x140031162
cmp esi, 2
jne 0x140031162
mov esi, r12d
jmp 0x14003118a
test r13, r13
je 0x1400310f7
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
jmp 0x1400310f7
mov r8d, esi
lea rdx, str.ERROR:_Registry_key_change_failed:_lRes__0x_x._r_n
mov ecx, 2
call fcn.1400168a8
mov r8, r14
lea rdx, str.ERROR:_Registry_transaction_failure_for:__S._r_n
mov ecx, 2
call fcn.1400168a8
lea rax, str.ADDREG
mov dword [rsp + 0x20], esi
test ebx, ebx
lea r8, str.DELREG
mov r9, r14
lea rdx, str._Processed__S_line:__S__result_0x_x._r_n
cmovne r8, rax
mov ecx, 4
call fcn.1400168a8
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400311c4
call fcn.14003c454
cmp qword [rbp - 9], r12
je 0x1400311d3
mov rcx, qword [rbp - 9]
call fcn.14003c408
test r13, r13
je 0x1400311e0
mov rcx, r13
call fcn.14003c408
test rdi, rdi
je 0x1400311ed
mov rcx, rdi
call fcn.14003c408
mov rbx, qword [rsp + 0xe0]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret