Function at 0x1000567a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x108
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov r14d, edx
mov r15, rcx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.100044f88
nop
lea rcx, [rsp + 0x40]
call fcn.10001fee0
nop
lea rcx, [rsp + 0xc8]
call fcn.100019218
nop
lea esi, [rbp + 1]
mov dword [rsp + 0x38], esi
mov dword [rdi], ebp
mov r13, qword [rbx]
test r13, r13
je 0x100056a1f
mov r12d, dword [rsp + 0x168]
xor esi, esi
cmp ebp, esi
jne 0x100056aae
lea rcx, [rsp + 0x30]
call fcn.10001fee0
nop
mov eax, esi
cmp r13, rsi
setne al
cmp eax, esi
je 0x100056a14
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001ecdc
xor r11d, r11d
lea rdi, [0x100010770]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x100056879
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
jne 0x10005689a
lea rdx, [0x100011d40]
lea ecx, [rsi + 3]
call fcn.10003c3c0
mov ebp, esi
mov dword [rsp + 0x38], esi
jmp 0x100056957
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.10001ff10
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.100045100
cmp eax, 0xb7
je 0x1000568d5
mov ebp, esi
jmp 0x100056957
lea rax, [rsp + 0x40]
cmp rax, rsi
jne 0x1000568ec
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100056904
lea r8, [rsp + 0x40]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.1000454bc
cmp eax, esi
jne 0x100056908
mov ebp, esi
jmp 0x100056957
mov r12d, 0x57
mov dword [rsp + 0x50], esi
cmp r14d, 1
je 0x10005693b
cmp r14d, 1
jle 0x100056955
cmp r14d, 4
jg 0x100056955
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.100054894
mov r12d, eax
jmp 0x100056950
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.100054210
mov r12d, eax
cmp r12d, esi
je 0x1000569b6
mov ebp, esi
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8d, r12d
lea rdx, [0x100011eb0]
mov ecx, 3
call fcn.10003c3c0
xor r11d, r11d
lea rdi, [0x100010770]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x100056995
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
je 0x1000569cd
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.10001f488
mov rdi, qword [rsp + 0x168]
jmp 0x1000569df
mov ebp, 1
cmp dword [rsp + 0x50], esi
je 0x1000569d7
mov rdi, qword [rsp + 0x168]
mov dword [rdi], ebp
jmp 0x1000569df
mov rdi, qword [rsp + 0x168]
jmp 0x1000569df
mov rdi, qword [rsp + 0x168]
cmp dword [rsp + 0x80], esi
je 0x1000569f3
lea rcx, [rsp + 0x58]
call fcn.100045390
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
cmp r13, rsi
jne 0x10005681f
cmp ebp, esi
jne 0x100056ab6
mov esi, dword [rsp + 0x38]
jmp 0x100056a1f
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov r8, qword [r15]
lea rdx, [0x100011f40]
mov r13d, 3
mov ecx, r13d
call fcn.10003c3c0
test esi, esi
je 0x100056e12
lea rdx, [0x100011fc0]
mov ecx, r13d
call fcn.10003c3c0
xor esi, esi
mov dword [rsp + 0x168], esi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.10001ff10
nop
lea r8, [rsp + 0x168]
mov edx, r14d
mov rcx, rax
call fcn.100053fcc
cmp eax, esi
jne 0x100056a9c
lea rdx, [0x100012010]
mov ecx, r13d
call fcn.10003c3c0
mov ebp, esi
jmp 0x100056e17
mov ebp, 1
cmp dword [rsp + 0x168], esi
je 0x100056abc
mov dword [rdi], ebp
jmp 0x100056abc
mov r13d, 3
jmp 0x100056abc
mov r13d, 3
cmp qword [rsp + 0xd8], rsi
je 0x100056e17
lea rcx, [rsp + 0x38]
call fcn.10001fee0
nop
mov rbx, qword [rsp + 0xc8]
cmp rbx, rsi
je 0x100056c94
mov r12, qword [rsp + 0x160]
lea rcx, [rsp + 0x168]
call fcn.10001fee0
nop
mov eax, esi
cmp rbx, rsi
setne al
cmp eax, esi
je 0x100056c89
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x168]
call fcn.10001ecdc
lea rdx, [rsp + 0x168]
mov rcx, r12
call fcn.100044e98
lea rcx, [rsp + 0x98]
call fcn.100019218
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x48]
call fcn.10001ff10
nop
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.100045100
lea rdx, [rsp + 0x98]
cmp rdx, rsi
jne 0x100056b88
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100056b9f
lea r8, [rsp + 0x98]
mov edx, 0xa
lea rcx, [rsp + 0x58]
call fcn.10004584c
cmp dword [rsp + 0x80], esi
je 0x100056bb2
lea rcx, [rsp + 0x58]
call fcn.100045390
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x100056c57
lea rcx, [rsp + 0x160]
call fcn.10001fee0
nop
xor eax, eax
test rsi, rsi
setne al
test eax, eax
je 0x100056c7e
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x160]
call fcn.10001ecdc
mov rdx, qword [rsp + 0x160]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.10001fa30
test rsi, rsi
jne 0x100056c18
test rbx, rbx
je 0x100056c41
xor eax, eax
lea rcx, [rax - 1]
lea rdi, [0x10001209c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x10001209c]
lea rcx, [rsp + 0x38]
call fcn.10001fa30
nop
lea rcx, [rsp + 0x160]
call fcn.10001fba0
test rsi, rsi
jne 0x100056bc3
lea rcx, [rsp + 0x98]
call fcn.10001f53c
nop
lea rcx, [rsp + 0x168]
call fcn.10001fba0
xor esi, esi
cmp rbx, rsi
je 0x100056c9c
jmp 0x100056aee
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov r12, qword [rsp + 0x160]
mov r8, qword [rsp + 0x38]
cmp dword [r8 - 0x10], esi
jle 0x100056cb6
lea rdx, [0x1000120b0]
mov ecx, r13d
call fcn.10003c3c0
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x160]
call fcn.10001fee0
nop
lea rdx, [0x1000107c0]
lea rcx, [rsp + 0x168]
call fcn.10001ff98
nop
lea r8, [rsp + 0x160]
mov rdx, r15
lea rcx, [rsp + 0x168]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x168]
call fcn.10001fba0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100056de6
cmp qword [r12 + 0x10], rsi
je 0x100056db2
lea rdx, [rsp + 0x168]
mov rcx, r12
call fcn.100034e1c
mov rdi, rax
cmp rax, rsi
je 0x100056d9f
mov eax, dword [rsp + 0x168]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x100056d95
mov ebp, esi
lea rdx, [0x100012230]
mov ecx, r13d
call fcn.10003c3c0
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x100056dd9
mov ebp, esi
lea rdx, [0x100012230]
mov ecx, r13d
call fcn.10003c3c0
jmp 0x100056dd9
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x100056dd9
mov ebp, esi
lea rdx, [0x100012230]
mov ecx, r13d
call fcn.10003c3c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100056df8
mov ebp, esi
lea rdx, [0x100012230]
mov ecx, r13d
call fcn.10003c3c0
nop
lea rcx, [rsp + 0x160]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x38]
call fcn.10001fba0
jmp 0x100056e17
mov ebp, 1
lea rcx, [rsp + 0xc8]
call fcn.10001f53c
nop
lea rcx, [rsp + 0x40]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x58]
call fcn.10004504c
nop
mov rcx, r15
call fcn.10001fba0
mov eax, ebp
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret