Function at 0x10003814c
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x740
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x730], rax
xor esi, esi
lea rax, [rsp + 0x68]
mov rdx, rcx
mov r14d, 0x20019
mov rbp, 0xffffffff80000000
xor r8d, r8d
mov r9d, r14d
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x54], esi
mov ebx, esi
mov dword [rsp + 0x50], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100038723
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4e0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100038718
cmp dword [rsp + 0x50], 1
jne 0x100038718
lea rax, [rsp + 0x4e0]
cmp rax, rsi
je 0x100038718
cmp si, word [rsp + 0x4e0]
je 0x100038718
mov edi, 0x103
lea r9, [rsp + 0x4e0]
lea r8, [0x10001eb38]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
mov qword [rsp + 0x58], rsi
call fcn.10002e570
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003831a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003830f
cmp dword [rsp + 0x50], 1
je 0x1000382b7
cmp dword [rsp + 0x50], 2
jne 0x10003830f
lea rax, [rsp + 0x80]
cmp rax, rsi
je 0x10003830f
cmp si, word [rsp + 0x80]
je 0x10003830f
lea rcx, [rsp + 0x80]
mov ebx, 1
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x80]
call fcn.100037734
cmp eax, esi
jne 0x10003830f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100038725
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x4e0]
lea r8, [0x100020548]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.10002e570
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003842a
lea r9, [rsp + 0x4e0]
lea r8, [0x100020578]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
mov qword [rsp + 0x60], rsi
call fcn.10002e570
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x2d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1000383db
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.100041f20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x4e0]
lea r8, [0x100020548]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.10002e570
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
je 0x10003842a
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call fcn.1000426b0
lea r9, [rsp + 0x4e0]
lea r8, [0x1000205b0]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.10002e570
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100038718
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003870d
cmp dword [rsp + 0x50], 1
jne 0x10003870d
lea rax, [rsp + 0x80]
cmp rax, rsi
je 0x10003870d
cmp si, word [rsp + 0x80]
je 0x10003870d
mov edi, 0x104
lea r8, [0x10001f980]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
mov qword [rsp + 0x60], rsi
call fcn.10002e3d4
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.10002e3d4
mov edi, 0x121
lea r9, [rsp + 0x2d0]
lea r8, [0x1000205c8]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.10002e570
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1000385fd
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1000385f2
cmp dword [rsp + 0x50], 1
je 0x1000385a4
cmp dword [rsp + 0x50], 2
jne 0x1000385f2
cmp si, word [rsp + 0x80]
je 0x1000385f2
lea rcx, [rsp + 0x80]
mov ebx, 1
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x80]
call fcn.100037734
cmp eax, esi
jne 0x1000385f2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
jmp 0x100038302
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x2d0]
lea r8, [0x1000205e0]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.10002e570
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003870d
lea r9, [rsp + 0x2d0]
lea r8, [0x1000205f8]
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x70], rsi
call fcn.10002e570
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x2d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1000386be
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.100041f20
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x2d0]
lea r8, [0x1000205e0]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.10002e570
lea rdx, [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
je 0x10003870d
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.1000426b0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret