Function at 0x7ffbf1d00828
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
and dword [rax - 0x38], 0xfffffff8
xor esi, esi
mov edx, 0x105
mov rbx, rcx
mov dword [rax + 0x10], 1
mov qword [rax + 0x18], rsi
mov dword [rax - 0x34], esi
mov qword [rax - 0x28], rsi
mov dword [rax - 0x2c], esi
mov dword [rax - 0x30], esi
mov dword [rcx + 8], esi
mov dword [rcx + 4], esi
call fcn.7ffbf1cc7ea8
cmp eax, esi
mov edi, eax
jl 0x7ffbf1d00a6f
cmp dword [rbx + 4], esi
jl 0x7ffbf1d00a6a
mov edx, 0x104
mov rcx, rbx
call fcn.7ffbf1cc7ea8
cmp eax, esi
jl 0x7ffbf1d00a6a
mov rdi, qword [rbx + 0x10]
cmp rdi, rsi
je 0x7ffbf1d00a6a
xor eax, eax
mov ecx, 0x20a
lea rdx, [0x7ffbf1caf7c8]
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
mov edi, 0x208
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x7ffbf1d008eb
movzx edi, ax
or edi, 0x80070000
cmp eax, esi
cmovle edi, eax
jmp 0x7ffbf1d00a6f
cmp dword [rbx + 4], esi
jge 0x7ffbf1d008f5
mov rax, rsi
jmp 0x7ffbf1d0090d
mov edx, 0x104
mov rcx, rbx
call fcn.7ffbf1cc7ea8
cmp eax, esi
mov rax, rsi
jl 0x7ffbf1d0090d
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
lea r9, [rsp + 0x78]
lea rdx, [0x7ffbf1caf8f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x7ffbf1d008d8
or edx, 0xffffffff
mov rcx, rbx
call fcn.7ffbf1cc768c
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x34], esi
call fcn.7ffbf1cc7ea8
cmp eax, esi
mov edi, eax
jl 0x7ffbf1d00a6f
cmp dword [rsp + 0x34], esi
jge 0x7ffbf1d00978
mov rcx, rsi
jmp 0x7ffbf1d00992
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.7ffbf1cc7ea8
mov rcx, qword [rsp + 0x40]
cmp eax, esi
cmovl rcx, rsi
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
lea rdx, [0x7ffbf1caf8e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x7ffbf1d00a6f
lea rcx, [rsp + 0x30]
or edx, 0xffffffff
call fcn.7ffbf1cc768c
call fcn.7ffbf1cff8b8
cmp eax, esi
jne 0x7ffbf1d00a6f
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.7ffbf1d00254
cmp eax, esi
jne 0x7ffbf1d00a0f
lea rcx, [rsp + 0x30]
call fcn.7ffbf1d00628
cmp eax, esi
jl 0x7ffbf1d00a6f
mov rcx, rbx
call fcn.7ffbf1cfff18
mov edi, eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x80]
lea rdx, [0x7ffbf1caf7e0]
mov r9d, 0x202
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x80], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x7ffbf1d00a6f
mov rcx, qword [rsp + 0x80]
lea rdx, [0x7ffbf1caf8e0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x7ffbf1d00a6f
mov edi, 0x80000002
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x7ffbf1d00a82
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x40], rsi
je 0x7ffbf1d00a93
lea rcx, [rsp + 0x30]
call fcn.7ffbf1cfd524
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret