Function at 0x4412c0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
xor r8d, r8d
mov r9d, 0x20119
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [rsp + 0x50]
mov rdi, rcx
mov r12, rdx
mov qword [rsp + 0x20], rbx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x441600
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov esi, 0xffffffff
mov dword [rsp + 0x40], 4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, str.SystemRestorePointCreationFrequency
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove esi, dword [rsp + 0x34]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r9d, 0x20106
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x441582
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], 0
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea rdx, str.SystemRestorePointCreationFrequency
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.SrClient.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rdi], rax
je 0x441565
lea rdx, str.SRSetRestorePointW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov rax, qword [rdi]
test r14, r14
setne cl
test rax, rax
setne dl
and cl, dl
mov r13d, ecx
je 0x441565
xor edx, edx
mov r8d, 0x210
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rdx, qword [r12]
lea rcx, [rbx + 0x10]
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0xa
call fcn.0068bb48
mov rax, qword [0x00826960]
test byte [rax + 0x1c000], 0x40
je 0x441520
mov ecx, 0x7d0
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xfffffffe
je 0x441560
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x4415c0
cmp esi, 0xffffffff
mov dword [rsp + 0x34], esi
je 0x4415a0
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, str.SystemRestorePointCreationFrequency
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x441560
cmp dword [rsp + 0x40], 0x422
je 0x4415e0
mov rcx, qword [0x00826910]
lea rdx, str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._n
call fcn.0041db00
mov rcx, qword [rdi]
test rcx, rcx
je 0x441509
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [rsp + 0x40]
mov rcx, rbx
call r14
mov r9d, dword [rsp + 0x40]
lea rdx, str.Restore_Point:__d___d__n
test eax, eax
mov rcx, qword [0x00826910]
setne bl
mov r8d, ebx
and r8d, 1
call fcn.0041e210
cmp esi, 0xfffffffe
jne 0x441462
test bl, bl
je 0x4414da
mov ebx, r13d
jmp 0x4414fb
mov rcx, qword [0x00826910]
lea rdx, str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point__d_n
mov r8, rax
xor ebx, ebx
call fcn.0041db00
jmp 0x4414fb
mov rcx, qword [0x00826910]
mov r8d, eax
lea rdx, str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
jmp 0x4413c4
lea rdx, str.SystemRestorePointCreationFrequency
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4414c7
mov rcx, qword [0x00826910]
mov r8d, eax
lea rdx, str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
jmp 0x4414d2
mov rcx, qword [0x00826910]
lea rdx, str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._Restore_points_disabled._n
call fcn.0041db00
jmp 0x4414fb
mov rcx, qword [0x00826910]
mov r8d, eax
mov esi, 0xfffffffe
lea rdx, str.ERROR_in_GetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
jmp 0x44135e