Function at 0x10003c6b8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15d, r9d
mov r12, r8
mov r10, qword [0x100152eb8]
mov r14d, dword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
lea rbx, [0x100152eb8]
mov eax, 5
lea r8, [0x10001e7f0]
mov r11, 0xffffffff80000002
cmp r10, rbx
je 0x10003c768
test byte [r10 + 0x1c], 1
je 0x10003c768
cmp byte [r10 + 0x19], al
jb 0x10003c768
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x40], r14d
lea edx, [rax + 0x17]
mov eax, dword [r13]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r8
lea r8, [0x10001e5a0]
mov r9, r11
call fcn.10003c100
mov r10, qword [0x100152eb8]
mov r11, 0xffffffff80000002
lea r8, [0x10001e7f0]
xor edx, edx
mov rbp, r11
mov edi, edx
mov ecx, edx
mov rsi, rdx
cmp r12, rdx
je 0x10003c8e0
cmp dx, word [r12]
je 0x10003c8e0
mov dword [r13], r15d
cmp r8, rdx
je 0x10003c7ca
mov qword [rsp + 0x58], rdx
lea rax, [rsp + 0x58]
lea rdx, [0x10001e7f0]
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov ecx, eax
cmp eax, edx
jne 0x10003c7d0
mov rsi, qword [rsp + 0x58]
mov ecx, edx
jmp 0x10003c7d0
mov rbp, rdx
mov rsi, r11
cmp ecx, edx
jne 0x10003c849
lea rax, [rsp + 0x50]
mov dword [rsp + 0x90], edx
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
mov ecx, eax
cmp eax, edx
jne 0x10003c824
mov eax, dword [rsp + 0x54]
sub eax, 4
neg eax
sbb ecx, ecx
and ecx, 0xd
cmp ecx, edx
jne 0x10003c833
mov eax, dword [rsp + 0x90]
mov dword [r13], eax
cmp r14d, 1
jne 0x10003c849
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edx, edx
mov ecx, eax
mov ebx, 2
cmp ecx, 0x490
je 0x10003c85a
cmp ecx, ebx
jne 0x10003c85c
mov ecx, edx
cmp ecx, edx
je 0x10003c938
movzx edi, cx
or edi, 0x80070000
cmp ecx, edx
cmovle edi, ecx
mov r10, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp r10, rax
je 0x10003c97f
mov r8d, 5
test byte [r10 + 0x1c], bl
je 0x10003c945
movzx ecx, byte [r10 + 0x19]
cmp edi, edx
mov eax, ebx
cmovge eax, r8d
cmp ecx, eax
jl 0x10003c945
mov eax, dword [r13]
mov dword [rsp + 0x48], r14d
lea edx, [r8 + 0x19]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r12
lea rax, [0x10001e7f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
jmp 0x10003c923
mov edi, 0x80070057
cmp r10, rbx
je 0x10003c984
mov ebx, 2
test byte [r10 + 0x1c], bl
je 0x10003c93f
cmp byte [r10 + 0x19], bl
jb 0x10003c93f
mov eax, dword [r13]
mov dword [rsp + 0x48], r14d
lea edx, [rbx + 0x1b]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r11
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e5a0]
mov r9d, edi
call fcn.10003be0c
xor edx, edx
mov r10, qword [0x100152eb8]
mov r8d, 5
lea r12, [0x100152eb8]
cmp r10, r12
je 0x10003c97f
test byte [r10 + 0x1c], 1
je 0x10003c97f
movzx eax, byte [r10 + 0x19]
cmp edi, edx
cmovge ebx, r8d
cmp eax, ebx
jl 0x10003c97f
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e5a0]
mov edx, 0x1f
mov r9d, edi
call fcn.100036328
test rbp, rbp
je 0x10003c98d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x10003c99b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret