Function at 0x100019a00
Capabilities:
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x10002c180]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov eax, dword [rcx + 0x128]
xor r13d, r13d
mov r12, rcx
and eax, 0xf
mov ebp, r13d
lea r15d, [r13 + 4]
lea r14d, [r13 + 1]
je 0x100019b68
cmp eax, 3
jne 0x100019a7d
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0xff
call fcn.100017a04
mov r11d, dword [rsp + 0x48]
mov ebp, r15d
neg r11d
sbb ebx, ebx
and ebx, 2
add ebx, 2
jmp 0x100019a83
mov ebp, r14d
mov ebx, r14d
xor edx, edx
mov ecx, ebp
call fcn.100016980
mov ecx, ebp
call fcn.100016f4c
mov ecx, ebp
call fcn.10001770c
lea r8, [rsp + 0x50]
lea rdx, [0x1000137a8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100019b68
lea rax, [rsp + 0x48]
lea rdi, [0x1000137e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100019b5d
mov eax, dword [rsp + 0x40]
test r15b, bl
je 0x100019b17
cmp eax, 2
je 0x100019b17
mov dword [rsp + 0x40], 2
jmp 0x100019b37
test r14b, bl
je 0x100019b28
cmp eax, r14d
je 0x100019b28
mov dword [rsp + 0x40], r14d
jmp 0x100019b37
test bl, 2
je 0x100019b5d
cmp eax, r13d
je 0x100019b5d
mov dword [rsp + 0x40], r13d
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [r12 + 0x128]
mov esi, r13d
and eax, 0xf0
je 0x100019b84
mov esi, r14d
cmp eax, 0x30
cmove esi, r15d
mov dword [rsp + 0x58], r13d
lea rbx, [0x100012640]
mov edi, 0x38
lea r9, [rbx + 0x44]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov edx, edi
call fcn.100016214
cmp eax, r13d
jne 0x100019bec
cmp dword [rbx], r13d
jne 0x100019bb8
mov dword [rsp + 0x58], ebp
jmp 0x100019bc6
mov eax, dword [rsp + 0x58]
cmp dword [rbx], r14d
cmove eax, esi
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [0x100013c00]
mov r9d, r15d
mov rcx, r12
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.100019894
lea rax, [0x1000129e8]
add rbx, 0x1d4
cmp rbx, rax
jne 0x100019b95
mov ebx, 0x80004005
cmp qword [r12 + 0x120], r13
je 0x100019ced
mov rcx, qword [r12 + 0x120]
mov qword [rsp + 0x48], r13
lea r9, [rsp + 0x48]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], r13
cmp rcx, r13
je 0x100019ced
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x28]
mov rdx, qword [rsp + 0x50]
cmp eax, r13d
jl 0x100019c9a
lea rax, [rsp + 0x60]
mov r8, rdx
lea rcx, [rsp + 0x60]
sub r8, rax
lea rax, [rdi + 0x7fffffc6]
cmp rax, r13
je 0x100019c8a
movzx eax, word [r8 + rcx]
cmp ax, r13w
je 0x100019c8a
mov word [rcx], ax
add rcx, 2
sub rdi, r14
jne 0x100019c67
cmp rdi, r13
jne 0x100019c93
sub rcx, 2
mov word [rcx], r13w
mov ebx, r13d
cmp rdx, r13
je 0x100019cad
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x50], r13
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x100019cbd
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r13d
jne 0x100019ced
lea rax, [rsp + 0x60]
lea r8, [0x100013bb8]
lea rdx, [0x100013be0]
mov r9d, r14d
mov rcx, r12
mov dword [rsp + 0x28], 0x70
mov qword [rsp + 0x20], rax
call fcn.100019894
mov qword [rsp + 0x30], r13
lea rcx, [0x100013b70]
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [0x100013b48]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x48]
lea rdx, [0x100013b48]
lea r8d, [rax + rax + 2]
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.10001dd30
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret