Function at 0x10000e998
Capabilities:
Create directory
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.1000157c4
mov edi, eax
test eax, eax
jns 0x10000e9d1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10000e9ca
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x10000ec0a
mov rsi, qword [rsp + 0x50]
and qword [rsp + 0x58], 0
lea r8, [0x100007c28]
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.100015ab0
mov edi, eax
test eax, eax
jns 0x10000ea10
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10000ea06
call qword [sym.imp.msvcrt.dll_free]
test rsi, rsi
je 0x10000e9ca
mov rcx, rsi
jmp 0x10000e9c4
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10000ea3c
mov rcx, rbx
call fcn.100024400
mov edi, eax
test eax, eax
jns 0x10000ea3c
test rbx, rbx
je 0x10000ea06
mov rcx, rbx
jmp 0x10000ea00
mov rcx, rbx
call fcn.100015548
test al, al
jne 0x10000ea60
mov edi, 0x80070005
lea rdx, [0x100007bc0]
mov r8, rbx
mov ecx, edi
call fcn.1000128bc
jmp 0x10000ea32
and dword [rsp + 0x28], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
lea r8, [0x100007b60]
lea rcx, [rsp + 0x50]
mov r9d, 2
mov rdx, 0xffffffff80000002
call fcn.100022b78
mov edi, eax
test eax, eax
jns 0x10000eaa7
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10000ea32
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000ea32
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x50]
lea rdx, [0x100007ba0]
not rcx
lea r8d, [rax + 1]
mov qword [rsp + 0x20], rbx
lea r9, [rcx + rcx]
mov rcx, rdi
call fcn.1000231f0
mov ebp, eax
test eax, eax
jns 0x10000eb0e
test rdi, rdi
je 0x10000eaeb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10000eaf9
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rsi, rsi
je 0x10000eb07
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebp
jmp 0x10000ec0a
lea rdx, [0x100007c38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
cmp ebp, 0x80070002
je 0x10000eb8f
test ebp, ebp
jns 0x10000eb73
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x10000eb75
test byte [rcx + 0x1c], 1
je 0x10000eb75
mov rcx, qword [rcx + 0x10]
lea r9, [0x100007c38]
lea r8, [0x100006170]
mov edx, 0x16
mov dword [rsp + 0x20], ebp
call fcn.10001f0d4
jmp 0x10000eb75
xor ebp, ebp
test ebp, ebp
jns 0x10000eb8f
cmp ebp, 0x80070002
je 0x10000eb8f
lea rdx, [0x100007c80]
mov ecx, ebp
call fcn.1000128bc
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rdx, [0x100007c00]
lea rcx, [0x100007cf0]
call fcn.10001288c
lea r9, [0x100007ba0]
lea r8, [0x100007b60]
lea rdx, [0x100007c00]
lea rcx, [0x100007d38]
call fcn.10001288c
lea rcx, [0x100007d60]
mov rdx, rbx
call fcn.10001288c
test rdi, rdi
je 0x10000ebec
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10000ebfa
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rsi, rsi
je 0x10000ec08
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret