Function at 0x7ffbf1d00da0
Capabilities:
Create directory
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
xor r14d, r14d
mov r13d, edx
mov rbx, rcx
mov r12d, r14d
mov qword [rax + 0x20], r14
mov dword [rax + 0x18], r14d
call fcn.7ffbf1d00828
cmp eax, r14d
jl 0x7ffbf1d00add
mov esi, r14d
jmp 0x7ffbf1d00bfa
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x98]
lea rdx, [0x7ffbf1caf7e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2021f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x7ffbf1d00c3a
cmp qword [rsp + 0x98], r14
je 0x7ffbf1d00c3a
mov edx, 0x105
mov rcx, rbx
call fcn.7ffbf1cc7ea8
cmp eax, r14d
mov esi, eax
jl 0x7ffbf1d00c49
cmp dword [rbx + 4], r14d
jl 0x7ffbf1d00d6b
mov ebp, 0x104
mov rcx, rbx
mov edx, ebp
call fcn.7ffbf1cc7ea8
cmp eax, r14d
jl 0x7ffbf1d00d6b
mov rdi, qword [rbx + 0x10]
cmp rdi, r14
je 0x7ffbf1d00d6b
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
cmp dword [rbx + 4], r14d
mov dword [rsp + 0x90], 0x208
jl 0x7ffbf1d00ba9
mov edx, ebp
mov rcx, rbx
call fcn.7ffbf1cc7ea8
cmp eax, r14d
mov rax, r14
jl 0x7ffbf1d00ba9
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x90]
lea rdx, [0x7ffbf1caf908]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
cmp eax, r14d
je 0x7ffbf1d00bf2
mov r12d, 1
call fcn.7ffbf1d00374
cmp eax, r14d
mov esi, eax
jl 0x7ffbf1d00c49
jmp 0x7ffbf1d00bfa
or edx, 0xffffffff
call fcn.7ffbf1cc768c
mov rcx, rbx
call fcn.7ffbf1cffea4
lea rbp, [0x7ffbf1cafb98]
cmp eax, r14d
jne 0x7ffbf1d00cf7
cmp dword [rbx + 4], r14d
jl 0x7ffbf1d00c24
cmp dword [rbx + 8], r14d
je 0x7ffbf1d00c24
mov rcx, qword [rbx + 0x10]
jmp 0x7ffbf1d00c27
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r14d
jne 0x7ffbf1d00c9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
cmp eax, r14d
cmovle esi, eax
mov rcx, qword [rsp + 0x98]
cmp rcx, r14
je 0x7ffbf1d00c5c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, r14d
jl 0x7ffbf1d00c83
cmp dword [0x7ffbf1d68fec], r14d
jne 0x7ffbf1d00c83
cmp r13d, r14d
je 0x7ffbf1d00c83
mov rcx, rbx
mov dword [0x7ffbf1d68fec], 1
call fcn.7ffbf1cfff18
mov esi, eax
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
call fcn.7ffbf1cff8b8
cmp eax, r14d
je 0x7ffbf1d00cf7
mov rdi, qword [rsp + 0x98]
cmp rdi, r14
je 0x7ffbf1d00c5c
mov eax, dword [rbx + 4]
mov edx, r14d
cmp eax, r14d
jl 0x7ffbf1d00cce
mov edx, dword [rbx + 8]
cmp edx, r14d
je 0x7ffbf1d00cce
mov rcx, qword [rbx + 0x10]
jmp 0x7ffbf1d00cd1
mov rcx, rbp
lea eax, [rdx + rdx + 2]
lea rdx, [0x7ffbf1caf8e0]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x98]
cmp rcx, r14
je 0x7ffbf1d00c5c
cmp r12d, r14d
je 0x7ffbf1d00d58
mov eax, dword [rbx + 4]
mov edx, r14d
cmp eax, r14d
jl 0x7ffbf1d00d24
mov edx, dword [rbx + 8]
cmp edx, r14d
je 0x7ffbf1d00d24
mov rbp, qword [rbx + 0x10]
lea eax, [rdx + rdx + 2]
lea rdx, [0x7ffbf1caf908]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r14d
jne 0x7ffbf1d00c3a
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x98], r14
jmp 0x7ffbf1d00c5c
mov esi, 0x8007000e
jmp 0x7ffbf1d00c49
jmp 0x7ffbf1d00aa0