Function at 0x10002ee94
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
mov eax, 0x12a0
call fcn.100047c10
sub rsp, rax
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x1290], rax
lea rax, [rsp + 0x30]
xor ebp, ebp
lea rdx, [0x10001c7b0]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10002f163
mov esi, ebp
lea r13d, [rbp + 0x7f]
mov rdx, r13
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x40]
cmp esi, ebp
je 0x10002efa6
lea rdi, [0x10001c858]
sub rdi, rax
lea rax, [rdx + 0x7fffff7f]
cmp rax, rbp
je 0x10002ef51
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10002ef51
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10002ef2f
cmp rdx, rbp
jne 0x10002ef5a
sub rcx, 2
lea rdi, [0x10001c848]
lea rax, [rsp + 0x140]
mov word [rcx], bp
mov rdx, r13
lea rcx, [rsp + 0x140]
sub rdi, rax
lea rax, [rdx + 0x7fffff7f]
cmp rax, rbp
je 0x10002f01d
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10002f01d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10002ef7a
jmp 0x10002f01d
lea rdi, [0x10001c828]
sub rdi, rax
lea rax, [rdx + 0x7fffff7f]
cmp rax, rbp
je 0x10002efd2
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10002efd2
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10002efb0
cmp rdx, rbp
jne 0x10002efdb
sub rcx, 2
lea rdi, [0x10001c848]
lea rax, [rsp + 0x140]
mov word [rcx], bp
mov rdx, r13
lea rcx, [rsp + 0x140]
sub rdi, rax
lea rax, [rdx + 0x7fffff7f]
cmp rax, rbp
je 0x10002f01d
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10002f01d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10002effb
cmp rdx, rbp
jne 0x10002f026
sub rcx, 2
lea rax, [rsp + 0x3c]
mov word [rcx], bp
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x240]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x3c], 0x1048
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10002f14d
cmp dword [rsp + 0x38], 1
jne 0x10002f14d
lea rcx, [rsp + 0x240]
mov edx, 0x2f
mov word [rsp + 0x1286], bp
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
je 0x10002f13d
lea rbx, [rax + 2]
mov edx, 0x2f
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
je 0x10002f0c8
lea rbx, [rax + 2]
mov edx, 0x2f
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
je 0x10002f0c8
mov word [rax], bp
cmp rbx, rbp
je 0x10002f13d
mov edx, 0x3f
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
je 0x10002f0e3
mov word [rax], bp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [0x10001c878]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbp
je 0x10002f13d
mov word [rax], bp
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
lea rdx, [rsp + 0x140]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10002f14d
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc esi
cmp esi, 2
jl 0x10002ef10
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x1290]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x12a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret