Function at 0x100324c
Capabilities:
Check os version
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x01007100]
xor rax, rsp
mov qword [rsp + 0x160], rax
and qword [rsp + 0x60], 0
and qword [rsp + 0x50], 0
mov eax, 0x11d1
mov word [rsp + 0x7e], ax
mov word [rsp + 0xae], ax
mov eax, 0x683f
mov word [rsp + 0x9c], ax
mov eax, 0x11d2
mov esi, ecx
mov word [rsp + 0x9e], ax
mov ecx, 0xa23d
mov eax, 0x2bc6
mov word [rsp + 0x7c], cx
mov word [rsp + 0xac], cx
mov word [rsp + 0x8c], ax
mov eax, 0x4ac2
mov ebx, 0x94
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, rbx
mov dword [rsp + 0x68], 4
mov word [rsp + 0x8e], ax
mov dword [rsp + 0x78], 0xea502723
mov byte [rsp + 0x80], 0xa7
mov byte [rsp + 0x81], 0xd3
mov byte [rsp + 0x82], 0
mov byte [rsp + 0x83], 0
mov byte [rsp + 0x84], 0xf8
mov byte [rsp + 0x85], 0x75
mov byte [rsp + 0x86], 0x71
mov byte [rsp + 0x87], 0xe3
mov dword [rsp + 0xa8], 0xea502722
mov byte [rsp + 0xb0], 0xa7
mov byte [rsp + 0xb1], 0xd3
mov byte [rsp + 0xb2], 0
mov byte [rsp + 0xb3], 0
mov byte [rsp + 0xb4], 0xf8
mov byte [rsp + 0xb5], 0x75
mov byte [rsp + 0xb6], 0x71
mov byte [rsp + 0xb7], 0xe3
mov dword [rsp + 0x98], 0x35378eac
mov byte [rsp + 0xa0], 0xa8
mov byte [rsp + 0xa1], 0x9a
mov byte [rsp + 0xa2], 0
mov byte [rsp + 0xa3], 0xc0
mov byte [rsp + 0xa4], 0x4f
mov byte [rsp + 0xa5], 0xbb
mov byte [rsp + 0xa6], 0xcf
mov byte [rsp + 0xa7], 0xa2
mov dword [rsp + 0x88], 0x3d271cfc
mov byte [rsp + 0x90], 0xb6
mov byte [rsp + 0x91], 0x33
mov byte [rsp + 0x92], 0x3b
mov byte [rsp + 0x93], 0xdf
mov byte [rsp + 0x94], 0xf5
mov byte [rsp + 0x95], 0xbd
mov byte [rsp + 0x96], 0xab
mov byte [rsp + 0x97], 0x2a
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1003455
cmp dword [rsp + 0xd0], 2
jne 0x1003455
cmp dword [rsp + 0xc4], 6
jae 0x1003455
mov eax, 1
jmp 0x10036b8
lea rax, [rsp + 0x58]
mov ebx, 1
lea r9, [rsp + 0x78]
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x100348c
lea rcx, [0x01001c70]
jmp 0x1003645
mov rcx, qword [rsp + 0x58]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x10034a9
lea rcx, [0x01001c98]
jmp 0x1003645
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov edx, 2
mov rax, qword [rcx]
call qword [rax + 0x78]
mov edi, eax
test eax, eax
jns 0x10034d0
lea rcx, [0x01001cc0]
jmp 0x1003645
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x6c]
lea rdx, [0x01001ce8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1003521
mov edx, edi
lea rcx, [0x01001d28]
jmp 0x1003647
or edi, 0xffffffff
cmp dword [rsp + 0x6c], 2
jne 0x100358e
test esi, esi
je 0x1003592
cmp dword [0x01007438], edi
jne 0x100358e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [0x01007438]
lea rdx, [0x01001d50]
xor r8d, r8d
mov dword [rsp + 0x74], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x100357c
mov dword [0x01007438], edi
jmp 0x100358e
test eax, eax
je 0x100358e
lea rcx, [0x01001d68]
mov edx, eax
call fcn.010024fc
test esi, esi
jne 0x10035ae
cmp dword [0x01007438], edi
jne 0x10035ae
mov rcx, qword [rsp + 0x50]
lea rdx, [0x01001d50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10035ea
mov eax, dword [0x01007438]
mov rcx, qword [rsp + 0x50]
test esi, esi
cmovne eax, ebx
lea rdx, [0x01001d50]
mov r9d, 4
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test eax, eax
je 0x10035fe
lea rcx, [0x01001da8]
mov edx, eax
call fcn.010024fc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x20], rdx
test esi, esi
lea r9, [rsp + 0x98]
setne r8b
mov edx, ebx
call qword [rax + 0x38]
test edi, edi
je 0x1003680
lea rcx, [0x01001de0]
mov edx, eax
call fcn.010024fc
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100365c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100366c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x100367c
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
jmp 0x10036b8
lea rax, [0x01001e18]
lea rdx, [0x01001e28]
test esi, esi
lea rcx, [0x01001e38]
cmovne rdx, rax
call fcn.010024fc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.010040a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret