Function at 0x4059a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
sub rsp, 0x98
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov qword [rax - 0x20], r15
movzx r14d, cl
call fcn.00418c7c
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x4059f6
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
xor r12d, r12d
lea r13, [r12 - 1]
cmp dword [0x00476b78], r12d
jbe 0x405be4
lea rbp, [0x0047e008]
lea r15, [0x0047de80]
nop
nop
test r14b, r14b
je 0x405b78
mov edi, r12d
imul rdi, rdi, 0x218
lea rbx, [rdi + r15 + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405ab8
mov r9d, eax
mov r8, rbx
lea rdx, str._nInfo__:_Open_Key___s__error:__lx._n
lea rcx, [rsp + 0x58]
call fcn.004038f0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.00404a90
jmp 0x405bcc
lea rsi, [rdi + r15 + 0x148]
mov r9, rsi
mov r8, rbx
lea rdx, str._nInfo__:_Install_registry:___s_s__n
lea rcx, [rsp + 0x58]
call fcn.004038f0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.00404a90
mov r9d, dword [rbp]
cmp r9d, 4
jne 0x405b13
lea rax, [rdi + r15 + 0x190]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x405b46
lea rdx, [rdi + r15 + 0x194]
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405b6b
mov r8d, eax
lea rdx, str.Info__:_RegSetValueEx_error_status_:__lx_n
lea rcx, [rsp + 0x58]
call fcn.004038f0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.00404a90
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405bcc
cmp dword [rbp + 4], 0
je 0x405bcc
mov eax, r12d
imul rax, rax, 0x218
lea rsi, [rax + r15 + 0x148]
lea rdi, [rax + r15 + 0x48]
mov r9, rsi
mov r8, rdi
lea rdx, str._nInfo__:_Delete_registry:___s_s__n
lea rcx, [rsp + 0x58]
call fcn.004038f0
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.00404a90
mov r8, rsi
mov rdx, rdi
mov rcx, qword [rbp - 0x188]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
add r12d, 1
add rbp, 0x218
cmp r12d, dword [0x00476b78]
jb 0x405a30
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x405c00
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
add rsp, 0x98
ret