Function at 0x100011ee0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x270
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r8, qword [rcx + 8]
xor r13d, r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov r12, rcx
mov qword [rsp + 0x28], rax
lea r9d, [r13 + 2]
lea rdx, [0x100002f20]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x104
mov word [rsp + 0x50], r13w
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, r13d
jne 0x10001217e
cmp dword [rsp + 0x40], 2
jb 0x10001217e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rsi, rcx
cmp ecx, 0xb
jb 0x100012031
mov edi, r13d
lea ebp, [rcx - 0xb]
lea rbx, [rsp + 0x66]
mov eax, edi
lea rdx, [0x100002f00]
mov r8d, 0xb
lea rcx, [rsp + rax*2 + 0x50]
call sub.msvcrt.dll__wcsnicmp
cmp eax, r13d
jne 0x100011fde
cmp edi, r13d
je 0x100011fcb
movzx ecx, word [rbx - 0x18]
call sub.msvcrt.dll_isspace
cmp eax, r13d
je 0x100011fde
movzx ecx, word [rbx]
call sub.msvcrt.dll_isspace
cmp eax, r13d
jne 0x100011fea
cmp word [rbx], r13w
je 0x100011fea
inc edi
add rbx, 2
cmp edi, ebp
ja 0x100012031
jmp 0x100011f9a
cmp edi, r13d
lea ecx, [rdi - 1]
lea eax, [rdi + 0xb]
cmove ecx, edi
cmp eax, esi
jb 0x100012002
mov word [rsp + rcx*2 + 0x50], r13w
jmp 0x100012031
sub esi, edi
mov eax, edi
cmp ecx, r13d
je 0x10001201b
lea r8d, [rsi - 0xa]
lea rdx, [rsp + rax*2 + 0x66]
lea rcx, [rsp + rcx*2 + 0x50]
jmp 0x100012029
lea r8d, [rsi - 0xb]
lea rdx, [rsp + rax*2 + 0x68]
lea rcx, [rsp + 0x50]
add r8, r8
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x48]
lea rdx, [0x100002f20]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x100012149
mov r10, qword [rsp + 0x48]
cmp r10, r13
je 0x100012149
cmp word [rsp + 0x50], r13w
jne 0x1000120c5
mov rdx, qword [r12 + 8]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r13d
cmovle edi, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x1000121c4
test byte [rcx + 0x1c], 1
je 0x1000121c4
mov edx, 0x37
jmp 0x1000121b1
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x50]
lea rdx, [0x100002f20]
not rcx
mov r9d, 1
xor r8d, r8d
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x100012144
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r13d
cmovle edi, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x1000121c4
test byte [rcx + 0x1c], 1
je 0x1000121c4
mov edx, 0x38
jmp 0x1000121b1
mov edi, r13d
jmp 0x1000121c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r13d
cmovle edi, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x1000121c4
test byte [rcx + 0x1c], 1
je 0x1000121c4
mov edx, 0x36
jmp 0x1000121b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r13d
cmovle edi, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x1000121c4
test byte [rcx + 0x1c], 1
je 0x1000121c4
mov edx, 0x35
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001910]
mov r9d, edi
call fcn.1000048bc
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x1000121d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10001e7a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret