Function at 0x1000732f4
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x740
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x730], rax
xor ebp, ebp
lea rax, [rsp + 0x68]
mov rdx, rcx
mov r14d, 0x20019
mov r12, 0xffffffff80000000
lea ebx, [rbp + 1]
xor r8d, r8d
mov r9d, r14d
mov rcx, r12
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x54], ebp
mov edi, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x100073904
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4e0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000738f9
cmp dword [rsp + 0x50], ebx
jne 0x1000738f9
lea rax, [rsp + 0x4e0]
cmp rax, rbp
je 0x1000738f9
cmp bp, word [rsp + 0x4e0]
je 0x1000738f9
mov esi, 0x103
lea r9, [rsp + 0x4e0]
lea r8, [0x100030cd8]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
mov qword [rsp + 0x58], rbp
call fcn.10003a080
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000734e4
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000734d9
cmp dword [rsp + 0x50], ebx
je 0x100073466
cmp dword [rsp + 0x50], 2
jne 0x1000734d9
lea rax, [rsp + 0x80]
cmp rax, rbp
je 0x1000734d9
cmp bp, word [rsp + 0x80]
je 0x1000734d9
lea rcx, [rsp + 0x80]
mov edi, ebx
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [0x10002ede8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbp
jne 0x1000734b6
lea rcx, [rsp + 0x80]
call fcn.1000732a4
jmp 0x1000734b8
mov eax, ebx
cmp eax, ebp
jne 0x1000734d9
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100073906
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x4e0]
lea r8, [0x100030d08]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
call fcn.10003a080
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000735f4
lea r9, [rsp + 0x4e0]
lea r8, [0x100030d38]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
mov qword [rsp + 0x60], rbp
call fcn.10003a080
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x2d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x1000735a5
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.100056b60
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x4e0]
lea r8, [0x100030d08]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
call fcn.10003a080
lea rdx, [rsp + 0x2d0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebp
je 0x1000735f4
lea rdx, [rsp + 0x2d0]
mov rcx, r12
call fcn.100057734
lea r9, [rsp + 0x4e0]
lea r8, [0x100030d70]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
call fcn.10003a080
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x2d0]
mov r9d, r14d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000738f9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000738ee
cmp dword [rsp + 0x50], ebx
jne 0x1000738ee
lea rax, [rsp + 0x80]
cmp rax, rbp
je 0x1000738ee
cmp bp, word [rsp + 0x80]
je 0x1000738ee
mov esi, 0x104
lea r8, [0x1000297b8]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
mov qword [rsp + 0x60], rbp
call fcn.100039ee4
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
call fcn.100039ee4
mov esi, 0x121
lea r9, [rsp + 0x2d0]
lea r8, [0x100030d88]
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.10003a080
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, r14d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000737de
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x54], 0x244
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000737d3
cmp dword [rsp + 0x50], ebx
je 0x10007376c
cmp dword [rsp + 0x50], 2
jne 0x1000737d3
cmp bp, word [rsp + 0x80]
je 0x1000737d3
lea rcx, [rsp + 0x80]
mov edi, ebx
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [0x10002ede8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbp
jne 0x1000737af
lea rcx, [rsp + 0x80]
call fcn.1000732a4
mov ebx, eax
cmp ebx, ebp
jne 0x1000737d3
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
jmp 0x1000734cc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x2d0]
lea r8, [0x100030da0]
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.10003a080
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, r14d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1000738ee
lea r9, [rsp + 0x2d0]
lea r8, [0x100030db8]
lea rcx, [rsp + 0x80]
mov rdx, rsi
mov qword [rsp + 0x70], rbp
call fcn.10003a080
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x2d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x10007389f
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.100056b60
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x2d0]
lea r8, [0x100030da0]
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.10003a080
lea rdx, [rsp + 0x80]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebp
je 0x1000738ee
lea rdx, [rsp + 0x80]
mov rcx, r12
call fcn.100057734
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret