Function at 0x1000444d4
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rcx
mov rbp, r8
mov r14, rdx
xor r15d, r15d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x40], r15
mov word [rsp + 0x80], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x58]
mov edi, 0x208
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], edi
mov r12, r15
call fcn.100002924
cmp r14, r15
je 0x100044832
cmp rsi, r15
je 0x100044832
cmp rbp, r15
je 0x1000445be
cmp word [rbp], r15w
je 0x1000445be
mov rcx, rdi
mov rax, rbp
mov ebx, r15d
cmp word [rax], r15w
je 0x10004459f
add rax, 2
sub rcx, 1
jne 0x10004458f
cmp rcx, r15
jne 0x1000445ab
mov ebx, 0x80070057
jmp 0x1000445b5
mov rax, rdi
sub rax, rcx
lea r12, [rax + rax]
cmp ebx, r15d
jl 0x100044837
lea rax, [rsp + 0x40]
cmp r12, r15
mov edi, r15d
sete dil
lea rdx, [0x10007a0c0]
mov r9d, 0xf003f
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100044837
movsxd r13, edi
mov esi, r15d
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000447b2
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000447b2
lea rdx, [rsp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r15d
jne 0x1000447b2
cmp r13, r15
jne 0x100044747
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100044735
mov rcx, qword [rsp + 0x50]
lea eax, [r12 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x1000447b2
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1000447b2
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r15
je 0x10004476b
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.10001bcc0
mov rdi, rax
jmp 0x10004476e
mov rdi, r15
cmp rdi, r15
je 0x10004477f
mov rcx, rdi
call fcn.10001bd4c
mov ebx, eax
jmp 0x100044784
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x10004479b
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.100005088
mov rdi, r15
mov ebx, eax
cmp rdi, r15
je 0x1000447ad
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov edi, 0x80070000
inc esi
cmp ebx, r15d
jge 0x10004460e
lea rcx, [rsp + 0x58]
cmp ebx, 0x80070103
cmove ebx, r15d
call fcn.100013630
cmp eax, r15d
jne 0x100044825
lea rcx, [rsp + 0x60]
call fcn.100001110
mov rdi, rax
mov eax, r15d
lea rcx, [rsp + 0x60]
cmp rdi, rcx
sete al
cmp eax, r15d
jne 0x100044825
lea rcx, [rdi + 0x20]
mov rax, rdi
neg rax
sbb rdx, rdx
xor r9d, r9d
xor r8d, r8d
and rdx, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
cmp rdi, r15
je 0x1000447e3
mov rcx, rdi
jmp 0x1000447db
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100044837
mov ebx, 0x80070057
lea rcx, [rsp + 0x58]
call fcn.100002a0c
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000010b0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret