Function at 0x100030418
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x480
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor esi, esi
mov ebx, ecx
lea ebp, [rsi + 1]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], ebp
call fcn.100037138
cmp eax, esi
jne 0x1000309d1
mov eax, esi
cmp ebx, esi
mov ecx, ebx
setne al
mov dword [rsp + 0x58], eax
call fcn.1000300fc
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea r13d, [rsi + 3]
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, [0x10001d310]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea r12d, [rsi + 4]
cmp eax, esi
jne 0x1000304f1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [0x10001d380]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [0x10001d3a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x100030567
cmp dword [rsp + 0x58], esi
mov rcx, qword [rsp + 0x50]
mov eax, esi
sete al
lea rdx, [0x10001d418]
mov r9d, r12d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [0x10001d430]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1000305d0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [0x10001d4c8]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [0x10001d4e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1000309d1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [0x10001d5a0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x70]
mov edi, 0xff
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], esi
lea r15d, [rdi + 1]
cmp rax, rsi
je 0x100030842
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.100040a80
cmp eax, esi
je 0x100030842
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.100040be4
cmp eax, esi
jl 0x100030842
mov edx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x60]
lea r8, [0x100023100]
movzx ecx, dx
shr edx, 0x10
movzx eax, r9w
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rcx, [rsp + 0x70]
shr r9d, 0x10
mov rdx, rdi
mov dword [rsp + 0x20], eax
call fcn.10002e570
mov qword [rsp + 0x60], rsi
jmp 0x1000306d0
mov ecx, 0x2c
mov word [rax], cx
lea rdx, [0x10001c9d0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rsi
jne 0x1000306c8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x10001d5b0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x10001d4e0]
mov rcx, 0xffffffff80000001
cmp ebx, esi
jne 0x10003083c
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x100030853
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x10001d5b0]
mov r9d, ebp
not rcx
xor r8d, r8d
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r13, [0x10001d5c0]
lea rax, [rsp + 0x70]
mov rdi, r13
mov rdx, r15
sub rdi, rax
lea rcx, [rsp + 0x70]
lea rax, [rdx + 0x7ffffefe]
cmp rax, rsi
je 0x1000307e5
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x1000307e5
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x1000307c4
cmp rdx, rsi
jne 0x1000307ee
sub rcx, 2
mov word [rcx], si
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea rdx, [0x10001d5c8]
mov r9d, ebp
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10003085a
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r13, [0x10001d5c0]
cmp ebx, esi
je 0x10003085a
mov dword [rsp + 0x58], esi
jmp 0x10003085e
lea r13, [0x10001d5c0]
mov dword [rsp + 0x58], ebp
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [0x10001d5d8]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x70]
cmp rcx, rsi
je 0x1000308a0
lea rcx, [rsp + 0x70]
mov edx, 0xff
call fcn.10003fbdc
jmp 0x1000308a2
mov eax, esi
cmp eax, esi
je 0x10003094a
mov rdx, r15
lea rcx, [rsp + 0x70]
lea r8, [0x10001d5f0]
cmp ebx, esi
jne 0x1000308c4
lea r8, [0x10001d608]
call fcn.10002e3d4
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
or rcx, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x10001d620]
cmp eax, esi
je 0x10003091a
xor eax, eax
lea rdi, [rsp + 0x270]
lea r9d, [r8 + 2]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x270]
jmp 0x10003093a
xor eax, eax
lea rdi, [rsp + 0x70]
mov r9d, ebp
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x30], r12d
lea r8, [0x10001d5c8]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebp
call fcn.1000427b0
mov rdx, qword [rsp + 0x50]
lea rax, [0x10001d638]
mov dword [rsp + 0x30], 0x14
lea r8, [0x10001d650]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call fcn.1000427b0
mov rdx, qword [rsp + 0x50]
lea rax, [0x10001d668]
mov dword [rsp + 0x30], 0x2a
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call fcn.1000427b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret