Function at 0x140030bac
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
xor r12d, r12d
mov qword [rbp - 0x21], r8
mov ebx, r9d
mov qword [rbp - 1], r12
lea rax, [rbp - 0x19]
mov dword [rbp - 0x29], ebx
mov qword [rsp + 0x40], rax
lea r9, [rbp - 9]
lea rax, [rbp + 7]
mov qword [rbp - 0x11], r12
mov qword [rsp + 0x38], rax
mov r14, r8
lea rax, [rbp - 0x25]
mov qword [rbp - 9], r12
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
lea rax, [rbp + 0x17]
mov qword [rbp + 0xf], r12
mov qword [rsp + 0x28], rax
mov rcx, rdx
lea rax, [rbp + 0xf]
mov qword [rbp + 0x17], r12
mov qword [rsp + 0x20], rax
mov esi, r12d
mov dword [rbp - 0x25], r12d
mov dword [rbp - 0x19], r12d
mov qword [rbp + 7], r12
call fcn.140030a10
mov r13, qword [rbp + 0xf]
mov rdi, qword [rbp + 0x17]
cmp qword [rbp - 1], r12
je 0x140031011
cmp qword [rbp - 9], r12
je 0x140031011
mov rdx, qword [rbp - 9]
lea rax, [rbp - 0x11]
mov rcx, qword [rbp - 1]
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x140031011
test ebx, ebx
je 0x14003105c
mov r12, qword [rbp + 7]
xor ecx, ecx
test rdi, rdi
jne 0x140030cd9
test r12, r12
jne 0x140030cd9
mov rcx, qword [rbp - 0x11]
lea rax, [0x14003f4a0]
mov dword [rsp + 0x28], 2
lea r9d, [rdi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x140031007
mov r15d, dword [rbp - 0x25]
mov r14d, 1
mov ebx, r15d
shr ebx, 1
not ebx
and ebx, r14d
jne 0x140030d12
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmovne ebx, r14d
test ebx, ebx
je 0x140030ffd
mov eax, r15d
sub eax, r14d
je 0x140030fd4
sub eax, 2
je 0x140030fd4
sub eax, 5
je 0x140030df4
sub eax, 0xfff9
je 0x140030dc5
sub eax, 2
je 0x140030dc5
sub eax, 0xfffd
je 0x140030da3
sub eax, 2
je 0x140030da3
cmp eax, 0x20006
je 0x140030df4
xor r12d, r12d
test rdi, rdi
je 0x140031000
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x140030d6f
mov r9d, r14d
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x140031000
xor r12d, r12d
test rdi, rdi
je 0x140031000
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x140030db3
mov r9d, 2
jmp 0x140030d7c
xor r12d, r12d
test rdi, rdi
je 0x140031000
mov rcx, rdi
call fcn.1400171c0
mov dword [rbp - 0x25], eax
lea r9d, [r12 + 4]
lea rax, [rbp - 0x25]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
jmp 0x140030d8c
xor r12d, r12d
test rdi, rdi
je 0x140031000
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x19], r12d
mov dword [rbp - 0x25], 7
bt r15d, 0x12
jae 0x140030f54
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x25]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030f54
cmp dword [rbp - 0x25], 7
jne 0x140030f54
mov rcx, rbx
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140030e51
mov r15d, dword [rbp - 0x19]
mov eax, 2
shr r15, 1
add r15, 3
add r15, rcx
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.14003c310
mov r14, rax
test rax, rax
jne 0x140030e8d
lea esi, [rax + 0xe]
jmp 0x140030f54
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x25]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030f44
xor eax, eax
mov r12, r14
cmp ax, word [r14]
je 0x140030ef0
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor ecx, ecx
test eax, eax
je 0x140030f1c
mov rax, rbx
inc rax
cmp word [r12 + rax*2], cx
jne 0x140030ed7
lea r12, [r12 + rax*2]
add r12, 2
cmp cx, word [r12]
jne 0x140030ec2
lea rdx, [r15 - 1]
mov r8, rdi
mov rcx, r12
call fcn.140001470
xor ecx, ecx
test eax, eax
js 0x140030f37
mov rax, rbx
inc rax
cmp word [rdi + rax*2], cx
jne 0x140030f08
mov word [r12 + rax*2 + 2], cx
xor r12d, r12d
jmp 0x140030f4f
mov rcx, rbx
xor r12d, r12d
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140030f22
mov rax, rbx
sub rax, rcx
add r15, rax
jmp 0x140030f4f
mov rcx, r14
call fcn.14003c2b8
xor r12d, r12d
jmp 0x140030f4c
mov rcx, r14
call fcn.14003c2b8
mov r14, r12
test r14, r14
jne 0x140030fa0
mov r15, rbx
inc r15
cmp word [rdi + r15*2], r12w
jne 0x140030f57
add r15, 2
mov eax, 2
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.14003c310
mov r14, rax
test rax, rax
je 0x140031000
lea rdx, [r15 - 1]
mov r8, rdi
mov rcx, rax
call fcn.140001470
inc rbx
cmp word [r14 + rbx*2], r12w
jne 0x140030f90
mov word [r14 + rbx*2 + 2], r12w
mov rcx, qword [rbp - 0x11]
lea eax, [r15 + r15]
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test r14, r14
je 0x140031000
mov rcx, r14
call fcn.14003c2b8
jmp 0x140031000
test r12, r12
je 0x140030ffd
mov eax, dword [rbp - 0x19]
mov r9d, 3
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor r12d, r12d
mov ebx, dword [rbp - 0x29]
mov r14, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14003104a
test r13, r13
jne 0x14003104a
test rdi, rdi
jne 0x14003104a
cmp qword [rbp - 9], r12
je 0x14003104a
cmp qword [rbp - 1], r12
je 0x14003104a
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003104a
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 1]
call fcn.14001a76c
test esi, esi
je 0x14003109a
test ebx, ebx
jne 0x140031072
cmp esi, 2
jne 0x140031072
mov esi, r12d
jmp 0x14003109a
test r13, r13
je 0x140031007
mov rcx, qword [rbp - 0x11]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
jmp 0x140031007
mov r8d, esi
lea rdx, str.ERROR:_Registry_key_change_failed:_lRes__0x_x._r_n
mov ecx, 2
call fcn.140016868
mov r8, r14
lea rdx, str.ERROR:_Registry_transaction_failure_for:__S._r_n
mov ecx, 2
call fcn.140016868
lea rax, str.ADDREG
mov dword [rsp + 0x20], esi
test ebx, ebx
lea r8, str.DELREG
mov r9, r14
lea rdx, str._Processed__S_line:__S__result_0x_x._r_n
cmovne r8, rax
mov ecx, 4
call fcn.140016868
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400310d4
call fcn.14003c304
cmp qword [rbp - 9], r12
je 0x1400310e3
mov rcx, qword [rbp - 9]
call fcn.14003c2b8
test r13, r13
je 0x1400310f0
mov rcx, r13
call fcn.14003c2b8
test rdi, rdi
je 0x1400310fd
mov rcx, rdi
call fcn.14003c2b8
mov rbx, qword [rsp + 0xe0]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret