Function at 0x1400e7e50
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp - 9], 0xfffffffffffffffe
mov r15, r9
mov rsi, r8
mov rbx, rdx
test rdx, rdx
jne 0x1400e7e94
xor eax, eax
jmp 0x1400e821c
call fcn.14004fa70
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400e7eb7
mov ecx, 0x80004005
call fcn.1400e76f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
call fcn.14004fa70
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400e7ee8
mov ecx, 0x80004005
call fcn.1400e76f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x6f], rax
test rsi, rsi
jne 0x1400e8100
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
call fcn.14004fa70
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400e7f2e
mov ecx, 0x80004005
call fcn.1400e76f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rax, [0x14028ef20]
test rax, 0xffffffffffff0000
jne 0x1400e7f6e
movzx edi, ax
mov ecx, edi
call fcn.1400e7820
test rax, rax
je 0x1400e7f81
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400e9990
jmp 0x1400e7f81
mov r8d, 1
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400e97e0
nop
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400e94e0
nop
lea r8, [rbp - 1]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call fcn.1400e83d0
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e7fc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e7fdf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r13, qword [rbp + 7]
mov r15, r13
mov rbx, qword [rbp - 1]
sub r15, rbx
sar r15, 3
cmp r15, 2
jae 0x1400e8009
lea rcx, [rbp - 1]
call fcn.1400e8f70
mov rbx, qword [rbp + 0x6f]
jmp 0x1400e81e3
mov rdx, qword [r13 - 8]
lea rcx, [rdx - 0x18]
mov rsi, qword [rbp - 0x21]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x1400e806c
cmp dword [rsi + 0x10], 0
jl 0x1400e805f
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1400e805f
call fcn.1400e96f0
mov rbx, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1400e804d
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x21], rax
mov r13, qword [rbp + 7]
mov rbx, qword [rbp - 1]
jmp 0x1400e806c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x21]
call fcn.1400e97e0
mov r12d, r14d
lea eax, [r15 - 1]
test eax, eax
jle 0x1400e80b7
mov rsi, r14
dec r15d
nop dword [rax]
test rsi, rsi
jle 0x1400e809b
mov r8d, 1
lea rdx, [0x14028ef20]
lea rcx, [rbp + 0x6f]
call fcn.1400e9bf0
mov rdx, qword [rbx + rsi*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x6f]
call fcn.1400e9bf0
inc r12d
inc rsi
cmp r12d, r15d
jl 0x1400e8080
test rbx, rbx
je 0x1400e812b
cmp rbx, r13
je 0x1400e80eb
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e80dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rbx, 8
cmp rbx, qword [rbp + 7]
jne 0x1400e80c1
mov rbx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
sub r8, rbx
sar r8, 3
mov rdx, rbx
call fcn.140036af0
jmp 0x1400e812b
or rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400e8110
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x6f]
call fcn.1400e97e0
jmp 0x1400e8133
mov r15, qword [rbp + 0x7f]
mov rsi, qword [rbp + 0x77]
mov qword [rbp - 0x29], r14
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rbp + 0x6f]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e81e3
test rsi, rsi
jne 0x1400e818e
mov rdx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400e81d1
test r15, r15
jne 0x1400e81a2
mov rdx, rsi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400e81d1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete r14b
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e81fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e8219
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r14d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret