Function at 0x140015580
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x60
mov rbp, r8
mov rsi, rdx
mov r12, rcx
test rdx, rdx
jne 0x1400155a3
or eax, 0xffffffff
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x88], r13d
mov edi, r13d
test rbx, rbx
je 0x1400157f7
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400157f7
cmp word [rbx], di
je 0x1400157f7
movzx eax, word [rbx]
lea r14d, [r13 + 1]
cmp eax, 0x2b
je 0x14001561e
cmp eax, 0x2d
je 0x140015619
cmp eax, 0x3a
jne 0x1400156cd
add rbx, 2
jmp 0x1400156cd
or edi, 0xffffffff
jmp 0x140015621
mov edi, r14d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rbx, 2
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r13
call fcn.14000bbd0
test eax, eax
jne 0x140015834
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400156c2
test edi, edi
jle 0x140015676
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x38]
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140002260
mov ebx, eax
jmp 0x140015696
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x38]
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.1400022c0
mov ebx, eax
cmp dword [rsp + 0x30], r13d
je 0x1400156b3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x140015834
mov rbx, qword [rsp + 0x38]
jmp 0x1400156cd
test edi, edi
js 0x140015839
mov edi, r13d
test rbx, rbx
je 0x1400157f7
cmp word [rbx], r13w
je 0x1400157f7
test edi, edi
jne 0x140015714
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x38]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.14000c2b0
test eax, eax
jne 0x140015834
mov rcx, qword [rsp + 0x38]
call fcn.140002100
test eax, eax
je 0x140015753
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.140017f4c
mov edx, 0x40000238
lea rcx, [rax + 0x60]
call fcn.1400026b0
or eax, 0xffffffff
jmp 0x14001583b
mov eax, dword [rsp + 0x88]
mov r9d, 7
xor r8d, r8d
add eax, eax
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400157d2
cmp dword [rsp + 0x88], r13d
je 0x1400157a3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
lea r8, str.AppEnvironment
mov edx, 0xc00003fb
movzx ecx, r14w
mov r9, rax
mov qword [rsp + 0x20], r13
call fcn.1400025f0
or eax, 0xffffffff
jmp 0x14001583b
cmp dword [rsp + 0x88], r13d
je 0x1400157f2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r14d
jmp 0x14001583b
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140015839
cmp eax, 2
je 0x140015839
mov ecx, eax
call fcn.140002430
mov rdi, rax
call fcn.140017f4c
mov r9, r12
lea rcx, [rax + 0x60]
mov r8, rbp
mov edx, 0x4000020d
mov qword [rsp + 0x20], rdi
call fcn.1400026b0
or eax, 0xffffffff
jmp 0x14001583b
xor eax, eax
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x50]
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret