Function at 0x14000a588
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov rbx, rdx
mov qword [rbp - 8], rdx
or rdx, 0xffffffffffffffff
mov r13, rcx
mov esi, r12d
mov edi, r12d
mov qword [rbp + 0x48], r12
mov rax, rdx
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14000a5c7
add ax, ax
mov ecx, 2
mov qword [rbp - 0x18], r9
mov word [rbp - 0x10], ax
add ax, cx
mov word [rbp - 0xe], ax
mov rax, rdx
inc rax
cmp word [r9 + rax*2], r12w
jne 0x14000a5eb
add ax, ax
mov r8d, ecx
lea r9, [rbp + 0x48]
mov word [rbp - 0x20], ax
add ax, cx
mov rcx, r13
mov rdx, rbx
mov word [rbp - 0x1e], ax
call fcn.14001403c
test eax, eax
jns 0x14000a65c
cmp eax, 0xc0000034
je 0x14000a81f
lea rcx, [0x14001dc10]
mov qword [rsp + 0x30], rbx
lea r9, [0x14001dc50]
mov qword [rsp + 0x28], rcx
lea rdx, [0x14001d9f0]
mov r8d, 0xa5
mov ecx, 7
mov dword [rsp + 0x20], eax
call fcn.14000944c
jmp 0x14000a81f
mov rax, qword [rbp + 0x48]
mov ebx, 7
cmp dword [rax + 4], ebx
jne 0x14000a7d0
mov edx, dword [rax + 8]
lea ecx, [rbx - 6]
mov r8d, 0x414e4d5a
mov r15d, r12d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x14000a6bf
lea rax, [0x14001dc70]
lea r9, [0x14001dc50]
lea rdx, [0x14001d9f0]
mov qword [rsp + 0x28], rax
mov r8d, 0xb8
mov ecx, ebx
mov dword [rsp + 0x20], 0xc000009a
call fcn.14000944c
jmp 0x14000a81f
mov rax, qword [rbp + 0x48]
xor r8d, r8d
mov edx, dword [rax + 8]
lea rcx, [rax + 0xc]
call fcn.140005584
mov r14, rax
test rax, rax
je 0x14000a773
mov r13, qword [rbp + 0x50]
inc r15d
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r12w
jne 0x14000a6e9
lea r12d, [rax*2 + 2]
lea rax, [0x14001dca0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x14001dc50]
lea rdx, [0x14001d9f0]
mov r8d, 0xc0
mov ecx, 1
call fcn.14000944c
mov rcx, r14
call r13
test eax, eax
jne 0x14000a74d
mov ecx, edi
mov r8d, r12d
mov rdx, r14
add rcx, rsi
call fcn.1400011a0
add edi, r12d
mov rax, qword [rbp + 0x48]
mov r8d, r15d
mov edx, dword [rax + 8]
lea rcx, [rax + 0xc]
call fcn.140005584
xor r12d, r12d
mov r14, rax
test rax, rax
jne 0x14000a6e2
mov r13, qword [rbp + 0x40]
mov eax, edi
add edi, 2
shr rax, 1
mov word [rsi + rax*2], r12w
cmp edi, 2
jbe 0x14000a7d0
lea rdx, [rbp - 0x20]
mov r9d, ebx
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
jns 0x14000a7d0
lea rcx, [0x14001dcb0]
lea r9, [0x14001dc50]
lea rdx, [0x14001d9f0]
mov qword [rsp + 0x28], rcx
mov ecx, ebx
mov r8d, 0xdb
mov dword [rsp + 0x20], eax
call fcn.14000944c
lea rdx, [rbp - 0x10]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
test eax, eax
jns 0x14000a80c
lea rcx, [0x14001dce0]
lea r9, [0x14001dc50]
lea rdx, [0x14001d9f0]
mov qword [rsp + 0x28], rcx
mov ecx, ebx
mov r8d, 0xe9
mov dword [rsp + 0x20], eax
call fcn.14000944c
test rsi, rsi
je 0x14000a81f
mov edx, 0x414e4d5a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000a82d
call fcn.1400055e8
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret