Function at 0x100047120
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x100083218]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rcx
mov rbp, r8
mov r14, rdx
xor r15d, r15d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x40], r15
mov word [rsp + 0x80], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x58]
mov edi, 0x208
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], edi
mov r12, r15
call fcn.1000028f4
cmp r14, r15
je 0x10004747e
cmp rsi, r15
je 0x10004747e
cmp rbp, r15
je 0x10004720a
cmp word [rbp], r15w
je 0x10004720a
mov rcx, rdi
mov rax, rbp
mov ebx, r15d
cmp word [rax], r15w
je 0x1000471eb
add rax, 2
sub rcx, 1
jne 0x1000471db
cmp rcx, r15
jne 0x1000471f7
mov ebx, 0x80070057
jmp 0x100047201
mov rax, rdi
sub rax, rcx
lea r12, [rax + rax]
cmp ebx, r15d
jl 0x100047483
lea rax, [rsp + 0x40]
cmp r12, r15
mov edi, r15d
sete dil
lea rdx, [0x10007d670]
mov r9d, 0xf003f
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100047483
movsxd r13, edi
mov esi, r15d
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000473fe
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x1000473fe
lea rdx, [rsp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r15d
jne 0x1000473fe
cmp r13, r15
jne 0x100047393
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x100047381
mov rcx, qword [rsp + 0x50]
lea eax, [r12 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, edi
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x1000473fe
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1000473fe
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r15
je 0x1000473b7
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.10001c0a4
mov rdi, rax
jmp 0x1000473ba
mov rdi, r15
cmp rdi, r15
je 0x1000473cb
mov rcx, rdi
call fcn.10001c130
mov ebx, eax
jmp 0x1000473d0
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x1000473e7
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.100004fb4
mov rdi, r15
mov ebx, eax
cmp rdi, r15
je 0x1000473f9
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov edi, 0x80070000
inc esi
cmp ebx, r15d
jge 0x10004725a
lea rcx, [rsp + 0x58]
cmp ebx, 0x80070103
cmove ebx, r15d
call fcn.100013450
cmp eax, r15d
jne 0x100047471
lea rcx, [rsp + 0x60]
call fcn.100001114
mov rdi, rax
mov eax, r15d
lea rcx, [rsp + 0x60]
cmp rdi, rcx
sete al
cmp eax, r15d
jne 0x100047471
lea rcx, [rdi + 0x20]
mov rax, rdi
neg rax
sbb rdx, rdx
xor r9d, r9d
xor r8d, r8d
and rdx, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
cmp rdi, r15
je 0x10004742f
mov rcx, rdi
jmp 0x100047427
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100047483
mov ebx, 0x80070057
lea rcx, [rsp + 0x58]
call fcn.1000029e0
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000010c0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret