Function at 0x100030d34
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x590
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x50]
xor esi, esi
mov edi, 0x20019
mov rbp, 0xffffffff80000001
lea rdx, [0x10001d760]
xor r8d, r8d
mov r9d, edi
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100030dcb
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10001d7c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10001d7e8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [0x10001c490]
mov r9d, edi
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100030e11
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10001d810]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [0x10001d830]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100030e8c
mov edi, 0x80
mov dword [rsp + 0x58], edi
jmp 0x100030e52
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rsp + 0x50]
cmp eax, esi
je 0x100030e43
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [0x10001c750]
mov r9d, 2
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 1
cmp eax, esi
jne 0x100030ee7
lea rdi, [0x10001c230]
lea ebx, [r12 + 0x27]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rdi, 8
sub rbx, r12
jne 0x100030ec5
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [0x10001c750]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x100030f95
mov rcx, qword [rsp + 0x50]
mov edi, 4
lea rax, [rsp + 0x5c]
lea rdx, [0x10001d880]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x5c], esi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r8, [0x10001d8b8]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x5c], r12d
call fcn.1000427b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10001d8f0]
mov rcx, rbp
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, [0x10001d960]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
or r14, 0xffffffffffffffff
mov ebx, 0x104
cmp eax, esi
jne 0x1000310e2
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x160]
mov r9d, ebx
mov edx, 0x26fd
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, esi
je 0x100031055
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, r14
repne scasw ax, word [rdi]
lea rdx, [0x10001d9d0]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x370]
cmp rax, rsi
je 0x1000310d7
lea rcx, [rsp + 0x370]
mov r8, rbx
mov edx, r12d
call fcn.100040758
cmp eax, esi
je 0x1000310d7
lea r8, [0x100001d70]
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.10002e3d4
cmp eax, esi
jl 0x1000310d7
xor eax, eax
lea rdi, [rsp + 0x370]
mov rcx, r14
repne scasw ax, word [rdi]
lea rdx, [0x10001d9e0]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
lea rdx, [0x10001d9f0]
mov r9d, 2
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003117d
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x160]
mov r9d, ebx
mov edx, 0xa4
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, esi
je 0x100031172
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, r14
repne scasw ax, word [rdi]
lea rdx, [0x10001d5c8]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret