Function at 0x14000bbec
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140013008]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor r15d, r15d
mov edi, 1
mov ebx, edi
mov dword [rsp + 0x40], r15d
mov esi, r15d
mov r13, rdx
mov r12, rcx
call fcn.14000c750
lea ecx, [rdi + 0x3c]
call fcn.14000b6d8
test eax, eax
je 0x14000bee9
call fcn.14000c750
mov edx, 0x100
lea ecx, [rdi + 0x3f]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000bc74
mov edx, 0x2c1
mov dword [0x1400539a0], edx
jmp 0x14000beee
mov ecx, 0x22
call fcn.14000b6d8
test eax, eax
je 0x14000bcb1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], 0x100
call fcn.14000bad8
test eax, eax
je 0x14000bcaa
call fcn.14000b720
test eax, eax
jne 0x14000be07
mov esi, edi
jmp 0x14000be04
mov ecx, 0x64
call fcn.14000b6d8
test eax, eax
je 0x14000bd21
lea rdi, [0x1400111e2]
mov eax, 0x77
movzx ecx, ax
call fcn.14000b6d8
lea rdi, [rdi + 2]
test eax, eax
jne 0x14000bce1
mov ebx, r15d
lea esi, [rax + 1]
movzx eax, word [rdi]
test ax, ax
jne 0x14000bccb
test ebx, ebx
je 0x14000bed6
call fcn.14000c750
mov rcx, r14
call fcn.14000b97c
test eax, eax
je 0x14000bd0b
call fcn.14000b720
test eax, eax
jne 0x14000bd13
mov ebx, r15d
mov esi, 1
mov r15d, 4
mov edi, r15d
jmp 0x14000be11
mov ecx, 0x2d
call fcn.14000b6d8
test eax, eax
je 0x14000bd56
call fcn.14000b720
test eax, eax
jne 0x14000bd3f
mov esi, edi
jmp 0x14000bed6
mov rdx, r13
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
jmp 0x14000bed6
lea rdi, [0x1400111c0]
mov eax, 0x68
movzx ecx, ax
call fcn.14000b6d8
lea rdi, [rdi + 2]
test eax, eax
jne 0x14000bd78
mov ebx, r15d
lea esi, [rax + 1]
movzx eax, word [rdi]
test ax, ax
jne 0x14000bd62
test ebx, ebx
je 0x14000bed6
mov ecx, 0x28
call fcn.14000b6d8
test eax, eax
je 0x14000bdc8
lea rcx, [rsp + 0x40]
call fcn.14000b97c
test eax, eax
je 0x14000bdb2
mov ecx, 0x29
call fcn.14000b6d8
test eax, eax
jne 0x14000bdba
mov ebx, r15d
mov esi, 1
test ebx, ebx
je 0x14000bed6
mov edi, dword [rsp + 0x40]
jmp 0x14000bdcd
mov edi, 3
mov ecx, 0x3a
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], 0x100
call fcn.14000b6d8
test eax, eax
je 0x14000bdff
lea rcx, [rsp + 0x48]
call fcn.14000b9e4
test eax, eax
je 0x14000bdff
call fcn.14000b720
test eax, eax
jne 0x14000be07
mov esi, 1
mov ebx, r15d
mov r15d, dword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
xor eax, eax
test ebx, ebx
je 0x14000bed6
cmp dword [0x140053780], 0x500
jae 0x14000be9e
cmp edi, 2
je 0x14000be31
cmp edi, 7
jne 0x14000be9e
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
or r9d, 0xffffffff
mov byte [rsp + 0x60], al
mov r8, r13
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x100
lea ecx, [rdx + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov r9d, edi
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
nop dword [rax + rax]
test eax, eax
je 0x14000bed6
mov edx, 0x2c1
mov dword [0x1400539a0], edx
jmp 0x14000bed6
mov dword [rsp + 0x28], r15d
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, r13
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, dword [0x1400539a0]
mov edx, 0x2c1
test eax, eax
cmovne ecx, edx
mov dword [0x1400539a0], ecx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test esi, esi
je 0x14000beee
call fcn.14000c6fc
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140001350
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret