Function at 0x1400172f4
Capabilities:
Delete file
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov r12, r9
mov ebx, r8d
mov rdi, rdx
mov r13, rcx
xor r14d, r14d
mov rbp, r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rsi, r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov word [rsp + 0x2a0], r14w
mov r15d, 0x206
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
lea r8d, [r14 + 0x10]
lea rdx, [rsp + 0x2a0]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__itow]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140015164
mov edi, eax
mov rbx, qword [rsp + 0x50]
cmp eax, r14d
jl 0x140017604
mov qword [rsp + 0x48], r14
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x740]
cvttsd2si rcx, xmm0
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x409
call qword [sym.imp.OLEAUT32.dll_VarBstrFromUI8]
mov edi, eax
cmp eax, r14d
jl 0x140017604
mov r8d, 0x20106
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.14001affc
mov edi, eax
cmp eax, r14d
jl 0x1400175ff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov rbp, qword [rsp + 0x58]
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140005838
mov r13d, 0x80004005
cmp eax, r14d
cmovne edi, r13d
cmp edi, r14d
jl 0x1400175f8
mov word [rsp + 0x90], r14w
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1400174e5
cmp dword [rsp + 0x40], 1
je 0x1400174bc
cmp dword [rsp + 0x40], 2
jne 0x140017534
mov eax, dword [rsp + 0x44]
cmp eax, r14d
je 0x1400174d9
test al, 1
jne 0x140017534
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r14w
je 0x1400174e2
jmp 0x140017534
mov word [rsp + 0x90], r14w
mov eax, r14d
cmp eax, r14d
jne 0x140017534
mov word [rsp + 0x4b0], r14w
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x4b2]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, r14d
je 0x140017534
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_DeleteFileW]
mov rcx, r12
call fcn.1400150fc
cmp rax, r14
jbe 0x140017585
mov eax, r14d
cmp r12, r14
setne al
cmp eax, r14d
jne 0x140017558
mov ecx, r13d
call fcn.1400057b8
int3
mov rcx, r12
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
jmp 0x140017598
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
cmp eax, 2
cmove eax, r14d
cmp eax, r14d
cmovne edi, r13d
cmp edi, r14d
jl 0x140017604
mov r12, qword [rsp + 0x48]
mov eax, r14d
cmp r12, r14
setne al
cmp eax, r14d
jne 0x1400175c0
mov ecx, r13d
call fcn.1400057b8
int3
mov rcx, r12
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400037b8]
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
cmp eax, r14d
cmovne edi, r13d
jmp 0x140017604
mov rsi, qword [rsp + 0x70]
jmp 0x140017604
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rsi, r14
je 0x140017629
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
cmp rbp, r14
je 0x140017637
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.140022620
add rsp, 0x6d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret