Function at 0x10004462c
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x100080258]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rcx
mov rbp, r8
mov r14, rdx
xor r15d, r15d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x40], r15
mov word [rsp + 0x80], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x58]
mov edi, 0x208
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], edi
mov r12, r15
call fcn.100002914
cmp r14, r15
je 0x10004498a
cmp rsi, r15
je 0x10004498a
cmp rbp, r15
je 0x100044716
cmp word [rbp], r15w
je 0x100044716
mov rcx, rdi
mov rax, rbp
mov ebx, r15d
cmp word [rax], r15w
je 0x1000446f7
add rax, 2
sub rcx, 1
jne 0x1000446e7
cmp rcx, r15
jne 0x100044703
mov ebx, 0x80070057
jmp 0x10004470d
mov rax, rdi
sub rax, rcx
lea r12, [rax + rax]
cmp ebx, r15d
jl 0x10004498f
lea rax, [rsp + 0x40]
cmp r12, r15
mov edi, r15d
sete dil
lea rdx, [0x10007a0b0]
mov r9d, 0xf003f
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x10004498f
movsxd r13, edi
mov esi, r15d
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x10004490a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x10004490a
lea rdx, [rsp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r15d
jne 0x10004490a
cmp r13, r15
jne 0x10004489f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x10004488d
mov rcx, qword [rsp + 0x50]
lea eax, [r12 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x10004490a
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x10004490a
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r15
je 0x1000448c3
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.10001bd30
mov rdi, rax
jmp 0x1000448c6
mov rdi, r15
cmp rdi, r15
je 0x1000448d7
mov rcx, rdi
call fcn.10001bdbc
mov ebx, eax
jmp 0x1000448dc
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x1000448f3
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.1000050a0
mov rdi, r15
mov ebx, eax
cmp rdi, r15
je 0x100044905
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov edi, 0x80070000
inc esi
cmp ebx, r15d
jge 0x100044766
lea rcx, [rsp + 0x58]
cmp ebx, 0x80070103
cmove ebx, r15d
call fcn.1000136c4
cmp eax, r15d
jne 0x10004497d
lea rcx, [rsp + 0x60]
call fcn.100001110
mov rdi, rax
mov eax, r15d
lea rcx, [rsp + 0x60]
cmp rdi, rcx
sete al
cmp eax, r15d
jne 0x10004497d
lea rcx, [rdi + 0x20]
mov rax, rdi
neg rax
sbb rdx, rdx
xor r9d, r9d
xor r8d, r8d
and rdx, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
cmp rdi, r15
je 0x10004493b
mov rcx, rdi
jmp 0x100044933
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x10004498f
mov ebx, 0x80070057
lea rcx, [rsp + 0x58]
call fcn.1000029fc
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000010b0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret