Function at 0x100043a3c
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rcx
mov rbp, r8
mov r14, rdx
xor r15d, r15d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x40], r15
mov word [rsp + 0x80], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x58]
mov edi, 0x208
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], edi
mov r12, r15
call fcn.100004534
cmp r14, r15
je 0x100043d9a
cmp rsi, r15
je 0x100043d9a
cmp rbp, r15
je 0x100043b26
cmp word [rbp], r15w
je 0x100043b26
mov rcx, rdi
mov rax, rbp
mov ebx, r15d
cmp word [rax], r15w
je 0x100043b07
add rax, 2
sub rcx, 1
jne 0x100043af7
cmp rcx, r15
jne 0x100043b13
mov ebx, 0x80070057
jmp 0x100043b1d
mov rax, rdi
sub rax, rcx
lea r12, [rax + rax]
cmp ebx, r15d
jl 0x100043d9f
lea rax, [rsp + 0x40]
cmp r12, r15
mov edi, r15d
sete dil
lea rdx, [0x1000790d0]
mov r9d, 0xf003f
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100043d9f
movsxd r13, edi
mov esi, r15d
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100043d1a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100043d1a
lea rdx, [rsp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r15d
jne 0x100043d1a
cmp r13, r15
jne 0x100043caf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100043c9d
mov rcx, qword [rsp + 0x50]
lea eax, [r12 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x100043d1a
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100043d1a
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r15
je 0x100043cd3
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.10001b67c
mov rdi, rax
jmp 0x100043cd6
mov rdi, r15
cmp rdi, r15
je 0x100043ce7
mov rcx, rdi
call fcn.10001b708
mov ebx, eax
jmp 0x100043cec
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x100043d03
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.100009284
mov rdi, r15
mov ebx, eax
cmp rdi, r15
je 0x100043d15
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov edi, 0x80070000
inc esi
cmp ebx, r15d
jge 0x100043b76
lea rcx, [rsp + 0x58]
cmp ebx, 0x80070103
cmove ebx, r15d
call fcn.100044758
cmp eax, r15d
jne 0x100043d8d
lea rcx, [rsp + 0x60]
call fcn.1000024a0
mov rdi, rax
mov eax, r15d
lea rcx, [rsp + 0x60]
cmp rdi, rcx
sete al
cmp eax, r15d
jne 0x100043d8d
lea rcx, [rdi + 0x20]
mov rax, rdi
neg rax
sbb rdx, rdx
xor r9d, r9d
xor r8d, r8d
and rdx, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
cmp rdi, r15
je 0x100043d4b
mov rcx, rdi
jmp 0x100043d43
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100043d9f
mov ebx, 0x80070057
lea rcx, [rsp + 0x58]
call fcn.100006c20
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000012f0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret