Function at 0x14001f7bc
Capabilities:
Delete file
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov r12, r9
mov ebx, r8d
mov rdi, rdx
mov r13, rcx
xor r14d, r14d
mov rbp, r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rsi, r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov word [rsp + 0x2a0], r14w
mov r15d, 0x206
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
lea r8d, [r14 + 0x10]
lea rdx, [rsp + 0x2a0]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__itow]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14002c074
mov edi, eax
mov rbx, qword [rsp + 0x50]
cmp eax, r14d
jl 0x14001facc
mov qword [rsp + 0x48], r14
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x740]
cvttsd2si rcx, xmm0
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x409
call qword [sym.imp.OLEAUT32.dll_VarBstrFromUI8]
mov edi, eax
cmp eax, r14d
jl 0x14001facc
mov r8d, 0x20106
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.140023468
mov edi, eax
cmp eax, r14d
jl 0x14001fac7
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov rbp, qword [rsp + 0x58]
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140008158
mov r13d, 0x80004005
cmp eax, r14d
cmovne edi, r13d
cmp edi, r14d
jl 0x14001fac0
mov word [rsp + 0x90], r14w
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x14001f9ad
cmp dword [rsp + 0x40], 1
je 0x14001f984
cmp dword [rsp + 0x40], 2
jne 0x14001f9fc
mov eax, dword [rsp + 0x44]
cmp eax, r14d
je 0x14001f9a1
test al, 1
jne 0x14001f9fc
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r14w
je 0x14001f9aa
jmp 0x14001f9fc
mov word [rsp + 0x90], r14w
mov eax, r14d
cmp eax, r14d
jne 0x14001f9fc
mov word [rsp + 0x4b0], r14w
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x4b2]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r14d
je 0x14001f9fc
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r12
call fcn.14002c00c
cmp rax, r14
jbe 0x14001fa4d
mov eax, r14d
cmp r12, r14
setne al
cmp eax, r14d
jne 0x14001fa20
mov ecx, r13d
call fcn.140007c44
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001fa60
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
cmove eax, r14d
cmp eax, r14d
cmovne edi, r13d
cmp edi, r14d
jl 0x14001facc
mov r12, qword [rsp + 0x48]
mov eax, r14d
cmp r12, r14
setne al
cmp eax, r14d
jne 0x14001fa88
mov ecx, r13d
call fcn.140007c44
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140004178]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r14d
cmovne edi, r13d
jmp 0x14001facc
mov rsi, qword [rsp + 0x70]
jmp 0x14001facc
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rsi, r14
je 0x14001faf1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbp, r14
je 0x14001faff
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.14003a6d0
add rsp, 0x6d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret