Function at 0x1000080ac
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
xor r15d, r15d
mov rdi, rcx
mov dword [rax + 8], r15d
mov qword [rax + 0x20], r15
mov dword [rax + 0x10], r15d
mov dword [rax + 0x18], r15d
cmp rcx, r15
je 0x100008480
lea r12d, [r15 + 1]
mov edx, 0xce
xor ecx, ecx
mov r8d, r12d
call fcn.10000d950
mov rbp, rax
cmp dword [rdi + 0x1c], r12d
jne 0x100008108
mov rbx, qword [rdi + 0x50]
xor r8d, r8d
mov edx, 0xcc
jmp 0x100008143
mov rcx, qword [rdi + 0x58]
cmp rcx, r15
je 0x100008480
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r15d
jne 0x100008134
xor r8d, r8d
mov edx, 0x1f5
xor ecx, ecx
call fcn.10000d950
mov rbx, rax
jmp 0x100008138
mov rbx, qword [rdi + 0x58]
mov edx, 0xcd
mov r8d, 2
xor ecx, ecx
call fcn.10000d950
mov rsi, rax
mov r9d, dword [rdi + 0x18]
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.10000239c
cmp eax, 2
jg 0x10000814d
jne 0x100008181
mov edi, 0x4c7
mov ecx, edi
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
jmp 0x100008496
mov r9d, dword [rdi + 0x84]
mov rdx, qword [rdi + 0x48]
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0xd8]
or r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r15d
je 0x1000081b8
mov ecx, eax
jmp 0x1000081e7
call fcn.10000f834
mov r14, rax
cmp rax, r15
jne 0x100008207
mov rcx, qword [rsp + 0xd8]
cmp rcx, r15
je 0x1000081e0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xd8], r15
mov ebx, 0xe
mov ecx, ebx
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000d760
mov eax, ebx
jmp 0x1000084a2
mov rdx, qword [rdi + 0x58]
cmp rdx, r15
je 0x100008225
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
jmp 0x10000841d
cmp dword [rdi + 0x1c], r12d
jne 0x10000841d
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp eax, r15d
jne 0x10000841d
cmp dword [rsp + 0xc8], r15d
je 0x10000841d
mov ecx, dword [rsp + 0xd0]
add ecx, r12d
mov dword [rsp + 0xd0], ecx
lea ecx, [rcx + rcx + 4]
call fcn.10000ef18
mov ebx, 0xe
mov r13, rax
mov qword [rsp + 0x60], rax
cmp rax, r15
je 0x10000841d
mov r12d, r15d
mov ebp, r15d
mov esi, r15d
cmp dword [rsp + 0xc8], r15d
jbe 0x10000834a
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0xc0], eax
xor eax, eax
add rcx, rcx
mov rdi, r13
lea r9, [rsp + 0xc0]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xd8]
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, eax
cmp eax, r15d
jne 0x1000083cb
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call fcn.10000f950
cmp eax, 0xffffffff
jne 0x1000083d1
mov esi, ebx
mov ebp, ebx
lea rcx, [rsp + 0x60]
call fcn.10000ee3c
cmp dword [r14], 9
mov edi, r15d
jne 0x100008361
mov edi, dword [r14 + 4]
cmp ebp, ebx
je 0x10000841b
cmp edi, r15d
je 0x10000841b
mov dword [rsp + 0xc0], r15d
mov ebx, r15d
mov esi, r15d
jbe 0x10000841d
xor r8d, r8d
mov edx, esi
mov rcx, r14
call fcn.10000f5c4
mov rdx, r15
cmp rax, r15
je 0x1000083a8
cmp dword [rax + 4], 0x20000
jne 0x1000083a8
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r15d
je 0x1000083e7
cmp ebx, r15d
jne 0x1000083c2
mov ebx, eax
mov eax, dword [rsp + 0xc0]
jmp 0x1000083f7
cmp esi, r15d
cmove esi, eax
inc r12d
cmp r12d, dword [rsp + 0xc8]
jae 0x10000834a
jmp 0x1000082d9
mov eax, dword [rsp + 0xc0]
inc eax
mov dword [rsp + 0xc0], eax
inc esi
cmp esi, edi
jb 0x100008386
cmp eax, r15d
je 0x10000841d
cmp edi, dword [rsp + 0xc8]
jne 0x100008414
cmp eax, edi
jne 0x100008414
mov ebx, r15d
jmp 0x10000841d
mov ebx, 0x80030201
jmp 0x10000841d
mov ebx, esi
mov rcx, qword [rsp + 0xd8]
cmp rcx, r15
je 0x100008438
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xd8], r15
cmp ebx, r15d
je 0x100008465
cmp ebx, 0x80030201
jne 0x1000081e5
xor r8d, r8d
mov edx, 0x8d
xor ecx, ecx
call fcn.10000d950
mov rcx, rax
call fcn.10000d498
jmp 0x1000081ec
xor ecx, ecx
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x30]
jmp 0x1000081fb
mov edi, 0x57
mov ecx, edi
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
mov edx, 0x20000
call fcn.10000d760
mov eax, edi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret