Function at 0x10004bf94
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov rbx, r8
mov r14d, edx
mov r15, rcx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.10003df74
nop
lea rcx, [rsp + 0x40]
call fcn.10001e06c
nop
lea rcx, [rsp + 0xc8]
call fcn.100018ee8
nop
lea esi, [rbp + 1]
mov dword [rsp + 0x38], esi
and dword [rdi], ebp
mov r13, qword [rbx]
test r13, r13
je 0x10004c216
mov r12d, dword [rsp + 0x158]
xor esi, esi
cmp ebp, esi
jne 0x10004c2a5
lea rcx, [rsp + 0x30]
call fcn.10001e06c
nop
mov eax, esi
cmp r13, rsi
setne al
cmp eax, esi
je 0x10004c20b
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001e1c8
xor r11d, r11d
lea rdi, [0x100010648]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10004c070
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
jne 0x10004c091
lea rdx, [0x1000119e0]
lea ecx, [rsi + 3]
call fcn.100037e18
mov ebp, esi
mov dword [rsp + 0x38], esi
jmp 0x10004c14e
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.10001e09c
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.10003e014
cmp eax, 0xb7
je 0x10004c0cc
mov ebp, esi
jmp 0x10004c14e
lea rax, [rsp + 0x40]
cmp rax, rsi
jne 0x10004c0e3
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10004c0fb
lea r8, [rsp + 0x40]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.10003e3c8
cmp eax, esi
jne 0x10004c0ff
mov ebp, esi
jmp 0x10004c14e
mov r12d, 0x57
mov dword [rsp + 0x50], esi
cmp r14d, 1
je 0x10004c132
cmp r14d, 1
jle 0x10004c14c
cmp r14d, 4
jg 0x10004c14c
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.10004a7bc
mov r12d, eax
jmp 0x10004c147
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.10004a574
mov r12d, eax
cmp r12d, esi
je 0x10004c1ad
mov ebp, esi
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8d, r12d
lea rdx, [0x100011b50]
mov ecx, 3
call fcn.100037e18
xor r11d, r11d
lea rdi, [0x100010648]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10004c18c
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
je 0x10004c1c4
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.10001ee9c
mov rdi, qword [rsp + 0x158]
jmp 0x10004c1d6
mov ebp, 1
cmp dword [rsp + 0x50], esi
je 0x10004c1ce
mov rdi, qword [rsp + 0x158]
mov dword [rdi], ebp
jmp 0x10004c1d6
mov rdi, qword [rsp + 0x158]
jmp 0x10004c1d6
mov rdi, qword [rsp + 0x158]
cmp dword [rsp + 0x80], esi
je 0x10004c1ea
lea rcx, [rsp + 0x58]
call fcn.10003e29c
nop
lea rcx, [rsp + 0x30]
call fcn.10001f3ec
cmp r13, rsi
jne 0x10004c016
cmp ebp, esi
jne 0x10004c2ad
mov esi, dword [rsp + 0x38]
jmp 0x10004c216
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov r8, qword [r15]
lea rdx, [0x100011be0]
mov r13d, 3
mov ecx, r13d
call fcn.100037e18
test esi, esi
je 0x10004c609
lea rdx, [0x100011c60]
mov ecx, r13d
call fcn.100037e18
xor esi, esi
mov dword [rsp + 0x158], esi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.10001e09c
nop
lea r8, [rsp + 0x158]
mov edx, r14d
mov rcx, rax
call fcn.10004a34c
cmp eax, esi
jne 0x10004c293
lea rdx, [0x100011cb0]
mov ecx, r13d
call fcn.100037e18
mov ebp, esi
jmp 0x10004c60e
mov ebp, 1
cmp dword [rsp + 0x158], esi
je 0x10004c2b3
mov dword [rdi], ebp
jmp 0x10004c2b3
mov r13d, 3
jmp 0x10004c2b3
mov r13d, 3
cmp qword [rsp + 0xd8], rsi
je 0x10004c60e
lea rcx, [rsp + 0x38]
call fcn.10001e06c
nop
mov rbx, qword [rsp + 0xc8]
cmp rbx, rsi
je 0x10004c48b
mov r12, qword [rsp + 0x150]
lea rcx, [rsp + 0x158]
call fcn.10001e06c
nop
mov eax, esi
cmp rbx, rsi
setne al
cmp eax, esi
je 0x10004c480
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x158]
call fcn.10001e1c8
lea rdx, [rsp + 0x158]
mov rcx, r12
call fcn.10003de90
lea rcx, [rsp + 0x98]
call fcn.100018ee8
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x48]
call fcn.10001e09c
nop
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.10003e014
lea rdx, [rsp + 0x98]
cmp rdx, rsi
jne 0x10004c37f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10004c396
lea r8, [rsp + 0x98]
mov edx, 0xa
lea rcx, [rsp + 0x58]
call fcn.10003e708
cmp dword [rsp + 0x80], esi
je 0x10004c3a9
lea rcx, [rsp + 0x58]
call fcn.10003e29c
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x10004c44e
lea rcx, [rsp + 0x150]
call fcn.10001e06c
nop
xor eax, eax
test rsi, rsi
setne al
test eax, eax
je 0x10004c475
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x150]
call fcn.10001e1c8
mov rdx, qword [rsp + 0x150]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.10001ed3c
test rsi, rsi
jne 0x10004c40f
test rbx, rbx
je 0x10004c438
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x100011d3c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x100011d3c]
lea rcx, [rsp + 0x38]
call fcn.10001ed3c
nop
lea rcx, [rsp + 0x150]
call fcn.10001f3ec
test rsi, rsi
jne 0x10004c3ba
lea rcx, [rsp + 0x98]
call fcn.10001a784
nop
lea rcx, [rsp + 0x158]
call fcn.10001f3ec
xor esi, esi
cmp rbx, rsi
je 0x10004c493
jmp 0x10004c2e5
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov r12, qword [rsp + 0x150]
mov r8, qword [rsp + 0x38]
cmp dword [r8 - 0x10], esi
jle 0x10004c4ad
lea rdx, [0x100011d50]
mov ecx, r13d
call fcn.100037e18
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x150]
call fcn.10001e06c
nop
lea rdx, [0x100010690]
lea rcx, [rsp + 0x158]
call fcn.10001e134
nop
lea r8, [rsp + 0x150]
mov rdx, r15
lea rcx, [rsp + 0x158]
call fcn.10002f9d0
nop
lea rcx, [rsp + 0x158]
call fcn.10001f3ec
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10004c5dd
cmp qword [r12 + 0x10], rsi
je 0x10004c5a9
lea rdx, [rsp + 0x158]
mov rcx, r12
call fcn.100031ad4
mov rdi, rax
cmp rax, rsi
je 0x10004c596
mov eax, dword [rsp + 0x158]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x100010678]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x10004c58c
mov ebp, esi
lea rdx, [0x100011ed0]
mov ecx, r13d
call fcn.100037e18
mov rcx, rdi
call fcn.10005cbc0
jmp 0x10004c5d0
mov ebp, esi
lea rdx, [0x100011ed0]
mov ecx, r13d
call fcn.100037e18
jmp 0x10004c5d0
lea rdx, [0x100010678]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10004c5d0
mov ebp, esi
lea rdx, [0x100011ed0]
mov ecx, r13d
call fcn.100037e18
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004c5ef
mov ebp, esi
lea rdx, [0x100011ed0]
mov ecx, r13d
call fcn.100037e18
nop
lea rcx, [rsp + 0x150]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x38]
call fcn.10001f3ec
jmp 0x10004c60e
mov ebp, 1
lea rcx, [rsp + 0xc8]
call fcn.10001a784
nop
lea rcx, [rsp + 0x40]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x58]
call fcn.10003dfc8
nop
mov rcx, r15
call fcn.10001f3ec
mov eax, ebp
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret