Function at 0x140006104
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor r14d, r14d
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
cmp dword [0x140035bec], r14d
je 0x1400063d7
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call fcn.140006610
nop
mov rcx, qword [rax]
mov eax, dword [0x1400357b4]
neg eax
sbb r9d, r9d
and r9d, 0x100
add r9d, 0x20006
mov qword [rsp + 0x20], rcx
call fcn.140006b78
nop
mov rcx, qword [rbp + 0x20]
cmp qword [rcx], r14
je 0x140006184
mov dword [rcx + 8], 1
test eax, eax
jne 0x1400063d7
lea r15d, [rax + 4]
lea rdx, str.EnableLog
mov rcx, qword [rbp - 0x18]
cmp dword [0x1400359d0], r14d
je 0x1400061c3
mov dword [rsp + 0x28], r15d
lea rax, [0x1400359d0]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400061c9
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.ForceLog
mov rcx, qword [rbp - 0x18]
cmp dword [0x1400359d4], r14d
je 0x1400061fc
mov dword [rsp + 0x28], r15d
lea rax, [0x1400359d4]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140006202
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.LogFailures
mov rcx, qword [rbp - 0x18]
cmp dword [0x1400359d8], r14d
je 0x140006235
mov dword [rsp + 0x28], r15d
lea rax, [0x1400359d8]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14000623b
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [0x1400359e0], r14d
je 0x140006389
cmp word [0x1400359e4], r14w
jne 0x14000627c
mov eax, dword [0x140035bfc]
test eax, eax
jne 0x140006267
call fcn.1400071f8
mov eax, dword [0x140035bfc]
cmp eax, 2
jne 0x1400063be
cmp dword [0x1400357a8], r14d
jmp 0x1400063b4
lea rdi, [0x1400357c0]
mov rdx, rdi
lea rsi, [0x1400359e4]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov ebx, eax
cmp dword [0x140035bfc], r14d
jne 0x1400062a6
call fcn.1400071f8
cmp dword [0x140035bfc], 2
jne 0x1400062d2
cmp dword [0x1400357a8], r14d
je 0x1400062d2
test ebx, ebx
jne 0x1400062ca
mov eax, dword [0x1400359dc]
test eax, eax
jne 0x140006370
mov edx, r15d
call fcn.140005e2c
test ebx, ebx
je 0x140006353
mov rbx, qword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.LogPath
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0x104
mov edx, r14d
sub rsi, rdi
lea rax, [rcx + 0x7ffffefa]
test rax, rax
je 0x140006338
movzx eax, word [rsi + rdi]
test ax, ax
je 0x140006338
mov word [rdi], ax
add rdi, 2
dec rcx
jne 0x140006317
test rcx, rcx
jne 0x140006346
sub rdi, 2
mov edx, 0x8007007a
mov word [rdi], r14w
test edx, edx
jns 0x140006353
jmp 0x1400063d7
cmp dword [0x140035bfc], r14d
jne 0x140006361
call fcn.1400071f8
cmp dword [0x140035bfc], 2
jne 0x1400063d7
mov eax, dword [0x1400359dc]
cmp dword [0x1400357a8], r14d
jne 0x1400063d7
test eax, eax
je 0x1400063d7
mov edx, 1
call fcn.140005e2c
jmp 0x1400063d7
mov eax, dword [0x140035bfc]
test eax, eax
jne 0x14000639e
call fcn.1400071f8
mov eax, dword [0x140035bfc]
cmp eax, 2
jne 0x1400063be
cmp dword [0x1400357a8], r14d
je 0x1400063be
cmp word [0x1400357c0], r14w
je 0x1400063be
mov edx, r15d
call fcn.140005e2c
lea rdx, str.LogPath
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov word [0x1400357c0], r14w
cmp dword [rbp - 0x10], r14d
je 0x1400063eb
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x10], r14d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret