Function at 0x1000240e8
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, 0xc105
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x10002412a
lea rdx, [0x10000c4e0]
movzx ecx, di
call fcn.1000297dc
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea rsi, [0x1000038a0]
mov rdx, rsi
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100024184
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x1000243e9
lea rdx, [0x10000c560]
mov r8, rsi
movzx ecx, di
call fcn.1000297dc
jmp 0x1000243e9
lea rbx, [0x1000055b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea rbx, [0x100003920]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
test eax, eax
je 0x1000241ec
call fcn.100029738
test eax, eax
je 0x1000243de
lea rdx, [0x10000c650]
mov r9, rbx
mov r8, rsi
movzx ecx, di
call fcn.1000297dc
jmp 0x1000243de
call fcn.100029738
test eax, eax
je 0x10002420a
lea rdx, [0x10000c700]
mov r9, rbx
mov r8, rsi
movzx ecx, di
call fcn.1000297dc
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rbx, [0x1000033f8]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x40], 0x84020004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
test eax, eax
jne 0x1000241c5
call fcn.100029738
test eax, eax
je 0x10002426a
mov r8d, dword [rsp + 0x40]
lea rdx, [0x10000c7b0]
mov r9, rsi
movzx ecx, di
mov qword [rsp + 0x20], rbx
call fcn.1000297dc
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rbp, [0x100003830]
mov rdx, rbp
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000242c4
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x1000243de
lea rdx, [0x10000c560]
mov r8, rbp
movzx ecx, di
call fcn.1000297dc
jmp 0x1000243de
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
lea rbx, [0x100003930]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x44], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10002431a
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x1000243d3
lea rdx, [0x10000c860]
jmp 0x1000243c5
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x30]
inc byte [rsp + 0x57]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x48]
lea rdx, [0x100003950]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
test eax, eax
je 0x10002436d
call fcn.100029738
test eax, eax
je 0x1000243d3
lea r9, [0x100003950]
mov r8, rsi
lea rdx, [0x10000c980]
jmp 0x1000243cb
call fcn.100029738
test eax, eax
je 0x10002438f
lea r9, [0x100003950]
lea rdx, [0x10000ca40]
mov r8, rsi
movzx ecx, di
call fcn.1000297dc
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, edi
test eax, eax
je 0x1000243b5
call fcn.100029738
test eax, eax
je 0x1000243d3
lea rdx, [0x10000cae0]
jmp 0x1000243c5
call fcn.100029738
test eax, eax
je 0x1000243d3
lea rdx, [0x10000cc00]
mov r8, rbp
mov r9, rbx
movzx ecx, di
call fcn.1000297dc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.10002e2d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret