Function at 0x180002260
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
sub rsp, 0x28
movzx eax, byte [rdx]
mov r10d, r8d
mov r9, rcx
cmp al, 0x96
je case.default.0x180002298
movzx eax, al
add eax, 0xfffffffc
cmp eax, 5
ja case.default.0x180002298
lea rcx, [0x180000000]
cdqe
mov r8d, dword [rcx + rax*4 + 0x2344]
add r8, rcx
jmp r8
mov rcx, r9
cmp r10d, 6
jb 0x1800022b5
lea r8, [rdx + 4]
movzx edx, byte [rdx + 2]
add rsp, 0x28
jmp 0x180002f40
xor r8d, r8d
mov dl, 2
add rsp, 0x28
jmp 0x180002f40
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180002bc0
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180002b30
inc rdx
mov rcx, r9
add rsp, 0x28
jmp 0x1800024c0
movsx ecx, byte [rdx + 1]
test ecx, ecx
je 0x180002323
dec ecx
je 0x180002313
cmp ecx, 2
jne case.default.0x180002298
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x1800027c0
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180002970
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180002610
inc rdx
mov rcx, r9
call fcn.180002360
add rsp, 0x28
ret
push rbp
push rdi
push r12
sub rsp, 0x40
movzx r8d, byte [rdx]
mov rbp, rcx
test r8d, r8d
je 0x180002511
dec r8d
je 0x180002507
dec r8d
je 0x1800024e9
dec r8d
je 0x1800024fd
dec r8d
je 0x1800024f3
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x180002519
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x180002519
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x180002519
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x180002519
mov qword [rcx + 0x20], 0xffffffff80000000
mov edi, dword [rdx + 9]
mov rax, qword [rdx + 1]
lea r12, [rdx + 0xd]
mov qword [rsp + 0x30], rax
test edi, edi
je 0x1800025ff
shr rax, 0x20
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
test eax, eax
je 0x18000259f
lea rcx, [rax + 2]
call fcn.1800034f8
mov esi, dword [rsp + 0x34]
xor edx, edx
lea r8, [rsi + 2]
mov rcx, rax
mov rbx, rax
call fcn.180008ed0
mov r8d, esi
mov rdx, r12
mov rcx, rbx
call fcn.180003540
mov rcx, qword [rbp + 0x20]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800025dd
mov rax, qword [rsp + 0x68]
add r12, rsi
mov qword [rbp + 0x20], rax
lea rcx, [rdi + 2]
call fcn.1800034f8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.180008ed0
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.180003540
mov rcx, qword [rbp + 0x20]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x1800025e2
mov byte [rsp + 0x68], 2
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rcx, rbp
call fcn.180002230
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rbp
ret
push rbp
push rsi
sub rsp, 0x48
movzx r8d, byte [rdx]
mov rsi, rcx
test r8d, r8d
je 0x18000265f
dec r8d
je 0x180002655
dec r8d
je 0x180002637
dec r8d
je 0x18000264b
dec r8d
je 0x180002641
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x180002667
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x180002667
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x180002667
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x180002667
mov qword [rcx + 0x20], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x18000279d
shr rax, 0x20
test eax, eax
je 0x18000279d
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x18000270a
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800034f8
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180008ed0
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180003540
mov rcx, qword [rsi + 0x20]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800027a4
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x20], rax
call fcn.180003b6c
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800034f8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.180008ed0
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180003540
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x20]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180002781
mov byte [rsp + 0x68], 2
call fcn.180002230
mov rcx, r12
call fcn.180003b6c
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rcx, rsi
mov byte [rsp + 0x68], 2
call fcn.180002230
jmp 0x18000278e
push rbp
push rsi
sub rsp, 0x48
movzx r8d, byte [rdx]
mov rsi, rcx
test r8d, r8d
je 0x18000280f
dec r8d
je 0x180002805
dec r8d
je 0x1800027e7
dec r8d
je 0x1800027fb
dec r8d
je 0x1800027f1
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x180002817
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x180002817
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x180002817
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x180002817
mov qword [rcx + 0x20], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x18000294d
shr rax, 0x20
test eax, eax
je 0x18000294d
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x1800028ba
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800034f8
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180008ed0
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180003540
mov rcx, qword [rsi + 0x20]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180002954
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x20], rax
call fcn.180003b6c
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800034f8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.180008ed0
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180003540
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x20]
mov r9d, 2
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180002931
mov byte [rsp + 0x68], 2
call fcn.180002230
mov rcx, r12
call fcn.180003b6c
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rcx, rsi
mov byte [rsp + 0x68], 2
call fcn.180002230
jmp 0x18000293e
push rbp
push rsi
sub rsp, 0x48
movzx r8d, byte [rdx]
mov rsi, rcx
test r8d, r8d
je 0x1800029bf
dec r8d
je 0x1800029b5
dec r8d
je 0x180002997
dec r8d
je 0x1800029ab
dec r8d
je 0x1800029a1
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x1800029c7
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x1800029c7
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x1800029c7
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x1800029c7
mov qword [rcx + 0x20], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x180002b08
shr rax, 0x20
test eax, eax
je 0x180002b08
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x180002a6a
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800034f8
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180008ed0
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180003540
mov rcx, qword [rsi + 0x20]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180002b0f
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x20], rax
call fcn.180003b6c
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800034f8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.180008ed0
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180003540
lea rcx, [rdi + rbp]
call fcn.180003dd0
lea rax, [rsp + 0x68]
mov r9d, 4
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], 4
cvttsd2si rcx, xmm0
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsi + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 1
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180002aec
mov byte [rsp + 0x68], 2
call fcn.180002230
mov rcx, r12
call fcn.180003b6c
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rcx, rsi
mov byte [rsp + 0x68], 2
call fcn.180002230
jmp 0x180002af9
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov rbx, rcx
test r8d, r8d
je 0x180002b7e
dec r8d
je 0x180002b74
dec r8d
je 0x180002b56
dec r8d
je 0x180002b6a
dec r8d
je 0x180002b60
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x180002b86
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x180002b86
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x180002b86
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x180002b86
mov qword [rcx + 0x20], 0xffffffff80000000
mov rcx, qword [rcx + 0x20]
add rdx, 2
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov byte [rsp + 0x30], 3
test eax, eax
je 0x180002bb0
mov byte [rsp + 0x30], 2
call fcn.180002230
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x50
movzx r8d, byte [rdx]
mov rbx, rcx
test r8d, r8d
je 0x180002c0e
dec r8d
je 0x180002c04
dec r8d
je 0x180002be6
dec r8d
je 0x180002bfa
dec r8d
je 0x180002bf0
mov qword [rcx + 0x20], 0xffffffff80000002
jmp 0x180002c16
mov qword [rcx + 0x20], 0xffffffff80000005
jmp 0x180002c16
mov qword [rcx + 0x20], 0xffffffff80000003
jmp 0x180002c16
mov qword [rcx + 0x20], 0xffffffff80000001
jmp 0x180002c16
mov qword [rcx + 0x20], 0xffffffff80000000
mov rcx, qword [rcx + 0x20]
lea rax, [rsp + 0x60]
add rdx, 2
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, rbx
test eax, eax
jne 0x180002c7c
mov rax, qword [rsp + 0x68]
mov byte [rsp + 0x60], 3
mov qword [rbx + 0x20], rax
call fcn.180002230
add rsp, 0x50
pop rbx
ret
mov byte [rsp + 0x60], 2
call fcn.180002230
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebx, dl
mov rdi, rcx
xor edx, edx
mov r8d, 0x104
add rcx, 0x38
call fcn.180008ed0
mov r11d, ebx
test bl, bl
je 0x180002fb1
dec r11d
je 0x180002fa7
dec r11d
je 0x180002f89
dec r11d
je 0x180002f9d
dec r11d
je 0x180002f93
mov qword [rdi + 0x30], 0xffffffff80000002
jmp 0x180002fb9
mov qword [rdi + 0x30], 0xffffffff80000005
jmp 0x180002fb9
mov qword [rdi + 0x30], 0xffffffff80000003
jmp 0x180002fb9
mov qword [rdi + 0x30], 0xffffffff80000001
jmp 0x180002fb9
mov qword [rdi + 0x30], 0xffffffff80000000
test rsi, rsi
je 0x180002fcb
lea rcx, [rdi + 0x38]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.180002c90
mov rbx, rax
test rax, rax
jne 0x180002ff3
lea r8d, [rax + 1]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov byte [rsp + 0x38], 2
call fcn.180002230
jmp 0x180003013
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
mov rdx, rbx
mov rcx, rdi
mov r8, rax
call fcn.180002230
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.180003080
mov rbx, rax
test rax, rax
je 0x180003045
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
mov rdx, rbx
mov rcx, rdi
mov r8, rax
call fcn.180002230
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000305d
lea rdx, [rsp + 0x38]
mov r8d, 1
mov rcx, rdi
mov byte [rsp + 0x38], 2
call fcn.180002230
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret