Function at 0x140002fa4
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xf0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rbp, rdx
mov rdi, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], 0xa
lea rax, [fcn.1400104f8]
mov qword [rsp + 0x68], rax
lea rax, [fcn.140010ba4]
mov qword [rsp + 0x70], rax
lea rax, [fcn.1400102e4]
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x88], r12
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.Keyboard_LayoutPreload
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x1400032f3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140002d7c
cmp al, r12b
je 0x1400032f3
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
cmp rbx, r12
je 0x140003096
cmp rbx, rsi
je 0x140003096
mov rax, qword [rbx + 0x10]
cmp rax, rsi
je 0x140003099
mov rbx, rax
jmp 0x140003088
mov rbx, r12
cmp rbx, r12
je 0x1400032e7
cmp dword [rbx + 4], edi
je 0x1400030c1
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400035ac
mov rbx, rax
cmp rax, r12
jne 0x1400030a2
jmp 0x1400032e7
cmp qword [rbx + 0x10], rsi
je 0x1400030df
cmp qword [rbx + 0x18], rsi
je 0x1400030df
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400035ac
mov rdi, rax
jmp 0x1400030e2
mov rdi, rbx
mov rdx, qword [rdi + 0x10]
cmp rdx, rsi
jne 0x1400030ef
mov rdx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
mov qword [rdx + 0x20], rax
mov rax, qword [rdi + 0x20]
cmp rax, qword [rsp + 0x80]
jne 0x14000310c
mov qword [rsp + 0x40], rdx
jmp 0x14000311c
cmp rdi, qword [rax + 0x10]
jne 0x140003118
mov qword [rax + 0x10], rdx
jmp 0x14000311c
mov qword [rax + 0x18], rdx
mov esi, 1
cmp dword [rdi + 8], esi
jne 0x140003130
lea rcx, [rsp + 0x40]
call fcn.140003a04
cmp rdi, rbx
je 0x140003184
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x20]
cmp qword [rax + 0x10], rbx
jne 0x14000314d
mov qword [rax + 0x10], rdi
jmp 0x140003151
mov qword [rax + 0x18], rdi
mov rcx, qword [rbx + 0x18]
mov qword [rdi + 0x18], rcx
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
mov eax, dword [rbx + 8]
mov dword [rdi + 8], eax
mov qword [rcx + 0x20], rdi
mov rax, qword [rdi + 0x10]
mov qword [rax + 0x20], rdi
mov rax, qword [rsp + 0x40]
cmp rax, rbx
cmove rax, rdi
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, r12
je 0x14000319a
mov rax, qword [rsp + 0x80]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x50], rbx
sub dword [rsp + 0x48], esi
lea rdx, str.Keyboard_LayoutPreload
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r12d
jne 0x1400032e7
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x30]
lea rdx, str.Keyboard_LayoutPreload
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, r12d
jne 0x1400032e7
mov edi, esi
mov rbx, qword [rsp + 0x40]
cmp rbx, r12
je 0x140003211
cmp rbx, qword [rsp + 0x80]
je 0x140003211
mov rax, qword [rbx + 0x10]
cmp rax, qword [rsp + 0x80]
je 0x140003214
mov rbx, rax
jmp 0x1400031fe
mov rbx, r12
cmp rbx, r12
je 0x1400032db
mov ebp, 0x26
mov word [rsp + 0xc0], r12w
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0xc2]
call fcn.140010930
mov r8d, edi
lea rdx, [0x14004a664]
lea rcx, [rsp + 0xc0]
call fcn.140003608
add edi, esi
mov word [rsp + 0x98], r12w
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x9a]
call fcn.140010930
mov r8d, dword [rbx + 4]
lea rdx, str._08x
lea rcx, [rsp + 0x98]
call fcn.140003608
lea rcx, [rsp + 0x98]
call fcn.1400108d4
add eax, eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400035ac
mov rbx, rax
cmp rax, r12
jne 0x140003222
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x40]
call fcn.1400038d4
jmp 0x1400032fd
lea rcx, [rsp + 0x40]
call fcn.1400038d4
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.14000fd20
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret