Function at 0x1400148b0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r12, qword [rbp + 0x67]
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
mov rdi, rax
xor r13d, r13d
mov ebx, r13d
cmp dword [rax + 0x18], 4
je 0x140014e70
lea r14d, [r13 + 0xd]
mov r15d, dword [rbp + 0x6f]
mov eax, 0x2001f
movsxd rsi, dword [rdi + 0x1c]
add rsi, r12
cmp r15d, 2
jne 0x1400149bf
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x14001499a
cmp qword [rdi + 0x10], 0
je 0x140014982
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x11], r13d
mov qword [rbp - 9], r13
mov r9d, eax
mov r8, rdx
mov rdx, qword [rdi]
lea rcx, [rbp - 0x19]
call fcn.14001a910
test eax, eax
jne 0x140014dea
mov rdx, qword [rdi + 0x10]
mov rsi, qword [rbp - 0x19]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
jne 0x140014dcc
test rsi, rsi
je 0x140014db9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140014db9
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x140014e06
jmp 0x140014db9
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x140014db9
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
jne 0x140014e06
jmp 0x140014db9
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x11], r13d
mov qword [rbp - 9], r13
mov r9d, 0x20019
cmp r15d, 1
cmove r9d, eax
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
lea rcx, [rbp - 0x19]
call fcn.14001a910
mov ebx, eax
test eax, eax
je 0x140014a93
test r15d, r15d
je 0x140014e1d
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x21], r13
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140014a2a
lea r8, [rbp + 7]
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x21]
mov r8, rdx
mov rdx, rax
call fcn.140016f10
jmp 0x140014a5d
lea rcx, [rbp + 7]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140014a85
mov ebx, r13d
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140014a77
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [rbp - 0x11], r13d
mov r12, qword [rbp - 0x21]
mov qword [rbp - 0x19], r12
jmp 0x140014a89
mov r12, qword [rbp - 0x19]
test ebx, ebx
jne 0x140014e0a
jmp 0x140014a97
mov r12, qword [rbp - 0x19]
mov edx, dword [rdi + 0x20]
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140014cf2
dec ecx
je 0x140014b8d
dec ecx
je 0x140014b1a
dec ecx
jne 0x140014da7
mov rcx, r12
test r15d, r15d
jne 0x140014af7
mov dword [rbp - 0x21], 3
mov dword [rbp - 0x29], edx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014e28
jmp 0x140014da7
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x140014da7
mov rdx, qword [rdi + 0x10]
mov rcx, r12
cmp r15d, 1
jne 0x140014b51
mov eax, dword [rsi]
mov dword [rbp - 0x21], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 3]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x140014da7
mov dword [rbp - 0x21], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xb]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140014da7
mov ebx, r13d
cmp dword [rbp + 0xb], 4
cmovne ebx, r14d
jmp 0x140014da7
cmp r15d, 1
jne 0x140014be1
mov rbx, qword [rsi]
mov rsi, qword [rdi + 0x10]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140014baf
mov ebx, r14d
jmp 0x140014da7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x140014da7
lea eax, [rdx + rdx]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 1]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014e59
mov eax, dword [rbp - 1]
cmp eax, 1
je 0x140014c22
cmp eax, 2
jne 0x140014e5c
mov ebx, dword [rbp - 0x29]
shr ebx, 1
mov edx, ebx
mov rcx, rsi
call fcn.14001e660
mov r13, rax
lea ecx, [rbx + rbx]
mov dword [rbp - 0x29], ecx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xf]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140014c67
xor r13d, r13d
jmp 0x140014cad
mov eax, dword [rbp + 0xf]
cmp eax, 1
je 0x140014c7c
cmp eax, 2
je 0x140014c7c
mov ebx, r14d
xor r13d, r13d
jmp 0x140014cad
test r13, r13
je 0x140014ca7
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x140014ca0
test al, 1
jne 0x140014c98
shr rax, 1
cmp word [r13 + rax*2 - 2], 0
je 0x140014ca7
mov ebx, r14d
xor r13d, r13d
jmp 0x140014cad
xor eax, eax
mov word [r13], ax
xor r13d, r13d
mov ebx, r13d
mov rcx, qword [rsi]
test rcx, rcx
jne 0x140014cba
mov eax, r13d
jmp 0x140014ccb
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
test eax, eax
js 0x140014e4e
mov rcx, qword [rsi]
cmp eax, dword [rcx - 0xc]
jg 0x140014e4e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], r13w
test ebx, ebx
jne 0x140014e3b
jmp 0x140014da7
cmp r15d, 1
jne 0x140014d40
mov rbx, qword [rdi + 0x10]
mov eax, r13d
test rsi, rsi
setne al
test eax, eax
jne 0x140014d11
mov ebx, r14d
jmp 0x140014da7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x140014da7
lea eax, [rdx + rdx]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 3]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140014da7
mov eax, dword [rbp + 3]
cmp eax, 1
je 0x140014d80
cmp eax, 2
je 0x140014d80
mov ebx, r14d
jmp 0x140014da7
test rsi, rsi
je 0x140014da4
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x140014da0
test al, 1
jne 0x140014d9b
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x140014da4
mov ebx, r14d
jmp 0x140014da7
mov word [rsi], r13w
mov ebx, r13d
test r12, r12
je 0x140014db5
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rbp + 0x67]
add rdi, 0x28
cmp dword [rdi + 0x18], 4
je 0x140014e70
jmp 0x140014904
mov ecx, eax
call fcn.14001aa50
mov ebx, eax
test rsi, rsi
je 0x140014de3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140014e77
mov ecx, eax
call fcn.14001aa50
mov ebx, eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140014e02
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140014e77
mov ecx, eax
jmp 0x140014e72
mov ecx, ebx
call fcn.14001aa50
mov ebx, eax
test r12, r12
je 0x140014e02
mov rcx, r12
jmp 0x140014dfc
mov ecx, eax
call fcn.14001aa50
mov ebx, eax
jmp 0x140014df3
mov ecx, eax
call fcn.14001aa50
mov ebx, eax
test r12, r12
je 0x140014e02
mov rcx, r12
jmp 0x140014dfc
mov ecx, ebx
call fcn.14001aa50
mov ebx, eax
test r12, r12
je 0x140014e02
mov rcx, r12
jmp 0x140014dfc
mov ecx, 0x80070057
call fcn.14001e940
int3
mov r14d, eax
mov ecx, r14d
call fcn.14001aa50
mov ebx, eax
test r12, r12
je 0x140014e02
mov rcx, r12
jmp 0x140014dfc
mov ecx, ebx
call fcn.14001aa50
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret