Function at 0x14000a9a0
Capabilities:
Delete registry key
Delete registry value
Get common file path
Read .ini file
Set registry value

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x208
call fcn.14001d250
xor r9d, r9d
lea rdx, [rbp + 0x180]
xor ecx, ecx
lea r8d, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x14000b037
lea r8, str.AtherosAtherosServiceConfig.ini
mov edx, 0x104
lea rcx, [rbp + 0x180]
call fcn.140021a0c
xor r15d, r15d
lea rcx, [rsp + 0x70]
xor edx, edx
mov dword [rsp + 0x60], r15d
mov r8d, 0x208
call fcn.14001d250
lea rax, [rbp + 0x180]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rdx, str.regOpType
mov dword [rsp + 0x20], 2
lea rcx, str.AthService
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov ebx, eax
lea rdx, str.regPath
lea rax, [rbp + 0x180]
mov qword [rsp + 0x28], rax
lea rcx, str.AthService
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000b037
test ebx, ebx
je 0x14000b037
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x8e8], rdi
call fcn.1400295d8
lea r8d, [r15 + 0x11]
mov dword [rsp + 0x60], eax
lea rdx, str.HKEY_CLASSES_ROOT
lea rcx, [rsp + 0x70]
call fcn.1400299dc
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000aae6
mov rdi, 0xffffffff80000000
lea r8, [rbp - 0x6c]
mov r9d, 0xf2
jmp 0x14000ab72
mov r8d, 0x11
lea rdx, str.HKEY_CURRENT_USER
call fcn.1400299dc
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000ab14
mov rdi, 0xffffffff80000001
lea r8, [rbp - 0x6c]
mov r9d, 0xf2
jmp 0x14000ab72
mov r8d, 0x12
lea rdx, str.HKEY_LOCAL_MACHINE
call fcn.1400299dc
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000ab42
mov rdi, 0xffffffff80000002
lea r8, [rbp - 0x6a]
mov r9d, 0xf1
jmp 0x14000ab72
mov r8d, 0xa
lea rdx, str.HKEY_USERS
call fcn.1400299dc
test eax, eax
jne 0x14000b01a
mov rdi, 0xffffffff80000003
lea r8, [rbp - 0x7a]
mov r9d, 0xf9
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.140029988
mov r8d, dword [rsp + 0x60]
mov eax, r8d
mov qword [rsp + 0x8f0], r14
test r8d, r8d
je 0x14000af17
sub eax, 1
je 0x14000ae69
sub eax, 1
je 0x14000adf7
cmp eax, 1
je 0x14000abc4
lea rdx, str.Unknown_operation_type__0x_x
mov ecx, 2
call fcn.1400197e0
xor eax, eax
jmp 0x14000ae3e
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x208
call fcn.14001d250
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x208
call fcn.14001d250
lea rax, [rbp + 0x180]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x390]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
lea rdx, str.regValue
lea rcx, str.AthService
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x14000ac3d
lea rdx, str.Unknown_registry_value
lea ecx, [rax + 2]
call fcn.1400197e0
xor eax, eax
jmp 0x14000ae3e
lea rax, [rbp + 0x180]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rdx, str.regType
mov dword [rsp + 0x20], 2
lea rcx, str.AthService
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x14000ac87
lea rdx, str.Unknown_registry_type
lea ecx, [rax + 2]
call fcn.1400197e0
xor eax, eax
jmp 0x14000ae3e
lea rcx, [rsp + 0x50]
call fcn.1400295d8
mov dword [rsp + 0x50], eax
lea r9, [rbp + 0x5a0]
lea rax, [rbp + 0x180]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.regData
lea rcx, str.AthService
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r14d, eax
test eax, eax
je 0x14000ae39
lea rax, [rsp + 0x64]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000ae39
mov eax, dword [rsp + 0x50]
sub eax, 1
je 0x14000adb9
sub eax, 2
je 0x14000ad49
cmp eax, 1
jne 0x14000adbf
lea rcx, [rbp + 0x5a0]
call fcn.1400295d8
mov dword [rbp + 0x5a0], eax
mov r14d, 4
jmp 0x14000adbf
test r14d, r14d
je 0x14000adbf
mov qword [rsp + 0x8e0], rsi
lea rbx, [rbp + 0x5a0]
mov rsi, r14
lea rdi, [rbp + 0x5a0]
nop word [rax + rax]
xor eax, eax
mov dword [rsp + 0x6c], r15d
mov word [rsp + 0x6a], ax
lea r8, [rsp + 0x6c]
movzx eax, word [rdi]
lea rdx, [0x140045cf8]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], ax
call fcn.140009160
movzx eax, byte [rsp + 0x6c]
lea rdi, [rdi + 2]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14000ad70
mov rsi, qword [rsp + 0x8e0]
jmp 0x14000adbf
mov r14d, 0x104
mov r9d, dword [rsp + 0x50]
lea rax, [rbp + 0x5a0]
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x390]
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ae39
lea rax, [rsp + 0x64]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000b00a
mov eax, 1
mov r14, qword [rsp + 0x8f0]
mov rdi, qword [rsp + 0x8e8]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x8c0
pop r15
pop rbx
pop rbp
ret
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x208
call fcn.14001d250
lea rax, [rbp + 0x180]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x390]
lea rdx, str.regValue
mov dword [rsp + 0x20], 0x104
lea rcx, str.AthService
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000ae39
lea rax, [rsp + 0x64]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000ae39
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x390]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ae39
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x208
call fcn.14001d250
mov edx, 0x5c
lea rcx, [rsp + 0x70]
call fcn.14001c998
mov rbx, rax
test rax, rax
jne 0x14000af5e
xor r9d, r9d
lea rdx, [rsp + 0x70]
mov r8d, 0x300
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x14000ae39
mov edx, 0x5c
mov rcx, rax
call fcn.14001c998
test rax, rax
je 0x14000af86
lea rbx, [rax + 2]
mov edx, 0x5c
mov rcx, rbx
call fcn.14001c998
test rax, rax
jne 0x14000af70
mov r8, rbx
lea rcx, [rbp + 0x390]
mov edx, 0x104
call fcn.1400219a4
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14000ae39
lea rax, [rsp + 0x64]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000ae39
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x390]
xor r9d, r9d
mov r8d, 0x300
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ae39
lea r8, [rsp + 0x70]
mov ecx, 2
lea rdx, str.Unknown_registry_path___s
call fcn.1400197e0
xor eax, eax
jmp 0x14000ae46
xor eax, eax
jmp 0x14000ae4e