Function at 0x14008c76c
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
lea rax, [rbp - 0x10]
mov qword [r11 - 0x48], rsi
lea rdx, [rcx + 0x438]
mov qword [r11 - 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x58], rsi
mov r14d, 0xf003f
mov dword [r11 - 0x60], r14d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp - 0x10], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14008c7ea
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008c9f1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rsi
lea rdx, [rdi + 0x28]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rsi
lea rdx, [rdi + 0x230]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rdi + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x14008c86d
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.ETag
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rbp + 0x30]
lea rax, [rdi + 0x18]
mov r9d, 4
lea rdx, str.RefreshInterval
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rbp + 0x30]
lea rdx, str.Settings
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x14008c7d7
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rsi
lea rdx, str.Settings
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rbp + 0x40]
lea rdx, [rdi + 0x648]
call fcn.14008b588
mov ebx, eax
test eax, eax
js 0x14008c9f1
mov rcx, qword [rbp + 0x30]
lea rdx, str.QueryParameters
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x14008c7d7
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rsi
lea rdx, str.QueryParameters
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008c7d7
mov rcx, qword [rbp + 0x38]
lea rdx, [rdi + 0x678]
call fcn.14008b588
mov ebx, eax
test eax, eax
js 0x14008c9f1
mov rcx, qword [rbp + 0x38]
lea rdx, [rdi + 0x6a8]
call fcn.14008b588
test eax, eax
mov ebx, eax
cmovns ebx, esi
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14008ca06
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14008ca1b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14008ca30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14008ca45
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14008ca5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret