Function at 0x1400e40f0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov r13, qword [rbp + 0x78]
xor r10d, r10d
lea rax, [0x140009390]
mov esi, r10d
mov qword [rbp - 0x48], r10
mov qword [rbp + 0x58], r10
mov qword [rbp + 0x60], r10
mov dword [rbp + 0x50], r10d
mov qword [rbp - 0x40], r10
mov dword [rbp + 0x48], 8
mov r15d, r10d
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
test r13, r13
jne 0x1400e4155
mov esi, 0x80070057
jmp 0x1400e4327
neg dword [rbp + 0x70]
mov dword [r13], r10d
mov r14d, r10d
sbb rdi, rdi
lea r12, [rbp - 0x38]
neg rdi
add rdi, 0xffffffff80000001
mov rbx, rdi
mov rdx, qword [r12]
test rdx, rdx
je 0x1400e41ea
lea rax, [rbp + 0x60]
mov r9d, 0x103
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r10d, r10d
test eax, eax
jne 0x1400e41d3
cmp rdi, rbx
je 0x1400e41af
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r10d, r10d
mov rbx, qword [rbp + 0x60]
cmp r14d, 4
mov eax, 1
cmove r15d, eax
add r14d, eax
add r12, 8
mov qword [rbp + 0x60], r10
cmp r14d, 5
jb 0x1400e4173
jmp 0x1400e41ea
mov qword [rbp + 0x60], r10
cmp eax, 2
je 0x1400e41ea
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp rdi, rbx
je 0x1400e4305
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp - 0x48]
mov r12d, reloc.WSOCK32.dll_inet_ntoa
mov dword [rbp + 0x58], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp + 0x5c], eax
test r15d, r15d
je 0x1400e4273
mov r14, qword [rbp + 0x68]
test r14, r14
je 0x1400e4273
lea rax, [rbp + 0x48]
lea r9, [rbp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e4273
cmp dword [rbp + 0x50], r12d
jne 0x1400e4273
cmp dword [rbp + 0x48], 8
jne 0x1400e4273
mov rax, qword [rbp - 0x40]
cmp rax, 0xffffffffffffffff
je 0x1400e42d5
cmp qword [rbp + 0x58], rax
jb 0x1400e42d5
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400e4305
lea rax, [rbp + 0x48]
lea r9, [rbp + 0x50]
lea rdx, [0x140009368]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
xor r8d, r8d
mov rcx, rbx
mov dword [rbp + 0x48], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e4305
cmp dword [rbp + 0x50], r12d
jne 0x1400e4305
cmp dword [rbp + 0x48], 8
jne 0x1400e4305
mov rax, qword [rbp - 0x40]
cmp rax, 0xffffffffffffffff
je 0x1400e42d5
cmp qword [rbp + 0x58], rax
jb 0x1400e42d5
lea rdx, [0x1400055f4]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x1400e4305
mov eax, 1
lea rdx, [0x1400e4340]
mov r9d, r12d
mov dword [r13], eax
lea rax, [rbp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400e4318
cmp rdi, rbx
je 0x1400e4318
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400e4327
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret