Function at 0x1000390fc
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebp, ebp
lea rax, [rsp + 0x40]
mov rdx, rcx
lea r12d, [rbp + 1]
mov r15d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov r9d, r15d
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x30], r12d
mov ebx, r12d
mov esi, r12d
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x100039709
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x1000207a0]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, 0x244
lea r13, [0x1000206c8]
cmp eax, ebp
jne 0x100039301
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000392c1
cmp dword [rsp + 0x30], r12d
je 0x1000391f9
cmp dword [rsp + 0x30], 2
jne 0x1000392c1
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x1000392c1
cmp bp, word [rsp + 0x50]
je 0x1000392c1
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x50]
call fcn.100037734
mov rcx, qword [rsp + 0x38]
cmp eax, ebp
jne 0x10003923b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000396fe
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdx, r13
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000392bf
mov r9d, dword [rsp + 0x30]
cmp r9d, r12d
je 0x100039279
cmp r9d, 2
jne 0x1000392bf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor r8d, r8d
xor edx, edx
not rcx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1000392c1
mov ebx, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
jne 0x100039301
mov rdi, qword [rsp + 0x40]
lea rdx, [0x1000207c8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebp
je 0x10003945c
lea rdx, [0x1000207c8]
mov rcx, rdi
call fcn.1000426b0
jmp 0x10003945c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x1000207c8]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003945c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x10001efb0]
xor r8d, r8d
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000393b5
cmp dword [rsp + 0x30], r12d
je 0x100039370
cmp dword [rsp + 0x30], 2
jne 0x1000393b5
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x1000393b5
cmp bp, word [rsp + 0x50]
je 0x1000393b5
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [0x10001ccb0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbp
je 0x1000393b5
mov rcx, qword [rsp + 0x38]
lea rdx, [0x10001efb0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100039444
mov r9d, dword [rsp + 0x30]
cmp r9d, r12d
je 0x1000393f8
cmp r9d, 2
jne 0x100039444
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x100039444
cmp bp, word [rsp + 0x50]
je 0x100039444
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor r8d, r8d
xor edx, edx
not rcx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, r13
jmp 0x100039446
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x100020650]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003959f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000394f2
cmp dword [rsp + 0x30], r12d
jne 0x1000394f2
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x1000394f2
cmp bp, word [rsp + 0x50]
je 0x1000394f2
lea rdx, [0x100020660]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov esi, ebp
cmp eax, ebp
sete sil
cmp esi, ebp
je 0x10003958c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10003957b
cmp dword [rsp + 0x30], r12d
jne 0x10003957b
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x10003957b
cmp bp, word [rsp + 0x50]
je 0x10003957b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, r13
jmp 0x100039581
cmp ebx, ebp
jne 0x10003958c
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x1000396fe
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x1000207e0]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10003966c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100039661
mov r9d, dword [rsp + 0x30]
cmp r9d, r12d
je 0x10003960c
cmp r9d, 2
jne 0x100039661
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x100039661
cmp bp, word [rsp + 0x50]
je 0x100039661
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor r8d, r8d
xor edx, edx
not rcx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000396fe
cmp dword [rsp + 0x30], r12d
jne 0x1000396fe
lea rax, [rsp + 0x50]
cmp rax, rbp
je 0x1000396fe
cmp bp, word [rsp + 0x50]
je 0x1000396fe
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov r9d, r12d
xor r8d, r8d
not rcx
xor edx, edx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret