Function at 0x10003c734
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15d, r9d
mov r12, r8
mov r10, qword [0x100153eb8]
mov r14d, dword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
lea rbx, [0x100153eb8]
mov eax, 5
lea r8, [0x10001e7f0]
mov r11, 0xffffffff80000002
cmp r10, rbx
je 0x10003c7e4
test byte [r10 + 0x1c], 1
je 0x10003c7e4
cmp byte [r10 + 0x19], al
jb 0x10003c7e4
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x40], r14d
lea edx, [rax + 0x17]
mov eax, dword [r13]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r8
lea r8, [0x10001e5a0]
mov r9, r11
call fcn.10003c17c
mov r10, qword [0x100153eb8]
mov r11, 0xffffffff80000002
lea r8, [0x10001e7f0]
xor edx, edx
mov rbp, r11
mov edi, edx
mov ecx, edx
mov rsi, rdx
cmp r12, rdx
je 0x10003c95c
cmp dx, word [r12]
je 0x10003c95c
mov dword [r13], r15d
cmp r8, rdx
je 0x10003c846
mov qword [rsp + 0x58], rdx
lea rax, [rsp + 0x58]
lea rdx, [0x10001e7f0]
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov ecx, eax
cmp eax, edx
jne 0x10003c84c
mov rsi, qword [rsp + 0x58]
mov ecx, edx
jmp 0x10003c84c
mov rbp, rdx
mov rsi, r11
cmp ecx, edx
jne 0x10003c8c5
lea rax, [rsp + 0x50]
mov dword [rsp + 0x90], edx
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
mov ecx, eax
cmp eax, edx
jne 0x10003c8a0
mov eax, dword [rsp + 0x54]
sub eax, 4
neg eax
sbb ecx, ecx
and ecx, 0xd
cmp ecx, edx
jne 0x10003c8af
mov eax, dword [rsp + 0x90]
mov dword [r13], eax
cmp r14d, 1
jne 0x10003c8c5
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edx, edx
mov ecx, eax
mov ebx, 2
cmp ecx, 0x490
je 0x10003c8d6
cmp ecx, ebx
jne 0x10003c8d8
mov ecx, edx
cmp ecx, edx
je 0x10003c9b4
movzx edi, cx
or edi, 0x80070000
cmp ecx, edx
cmovle edi, ecx
mov r10, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp r10, rax
je 0x10003c9fb
mov r8d, 5
test byte [r10 + 0x1c], bl
je 0x10003c9c1
movzx ecx, byte [r10 + 0x19]
cmp edi, edx
mov eax, ebx
cmovge eax, r8d
cmp ecx, eax
jl 0x10003c9c1
mov eax, dword [r13]
mov dword [rsp + 0x48], r14d
lea edx, [r8 + 0x19]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r12
lea rax, [0x10001e7f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
jmp 0x10003c99f
mov edi, 0x80070057
cmp r10, rbx
je 0x10003ca00
mov ebx, 2
test byte [r10 + 0x1c], bl
je 0x10003c9bb
cmp byte [r10 + 0x19], bl
jb 0x10003c9bb
mov eax, dword [r13]
mov dword [rsp + 0x48], r14d
lea edx, [rbx + 0x1b]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r11
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e5a0]
mov r9d, edi
call fcn.10003bee0
xor edx, edx
mov r10, qword [0x100153eb8]
mov r8d, 5
lea r12, [0x100153eb8]
cmp r10, r12
je 0x10003c9fb
test byte [r10 + 0x1c], 1
je 0x10003c9fb
movzx eax, byte [r10 + 0x19]
cmp edi, edx
cmovge ebx, r8d
cmp eax, ebx
jl 0x10003c9fb
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e5a0]
mov edx, 0x1f
mov r9d, edi
call fcn.100036510
test rbp, rbp
je 0x10003ca09
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x10003ca17
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret