Function at 0x1400094e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
mov rax, qword [0x1400246e0]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rax, str.RegistryMachineSystemCurrentControlSetControlMiniNT
mov qword [rsp + 0x40], rcx
mov qword [rbp - 0x60], rax
xor r13d, r13d
lea rax, str.Sessions
mov dword [rbp - 0x68], 0x740072
mov qword [rbp - 0x30], rax
mov r15, rcx
lea rax, str.RegistryMachineSystemCurrentControlSetControlSession_ManagerEnvironment
mov dword [rbp - 0x38], 0x140012
mov qword [rbp - 0x50], rax
mov r12d, r13d
lea rax, str.NUMBER_OF_PROCESSORS
mov dword [rbp - 0x58], 0x9e009c
mov qword [rbp - 0x40], rax
lea rax, [0x140025220]
mov qword [0x140025228], rax
mov qword [0x140025220], rax
lea rax, [0x140025230]
mov qword [0x140025238], rax
mov qword [0x140025230], rax
lea rax, [0x140025240]
mov qword [0x140025248], rax
mov qword [0x140025240], rax
lea rax, [0x140025250]
mov qword [0x140025258], rax
mov qword [0x140025250], rax
lea rax, [0x140025360]
mov qword [0x140025368], rax
mov qword [0x140025360], rax
lea rax, [0x140025260]
mov qword [0x140025268], rax
mov qword [0x140025260], rax
lea rax, [0x140025270]
mov qword [0x140025278], rax
mov qword [0x140025270], rax
lea rax, [0x140025280]
mov qword [0x140025288], rax
mov qword [0x140025280], rax
lea rax, [0x140025290]
mov qword [0x140025298], rax
mov qword [0x140025290], rax
lea rax, [0x1400252a0]
mov qword [0x1400252a8], rax
mov qword [0x1400252a0], rax
lea rax, [0x1400252b0]
mov qword [0x1400252b8], rax
mov qword [0x1400252b0], rax
lea rax, [0x140025350]
mov qword [0x140025358], rax
mov qword [0x140025350], rax
mov dword [rbp - 0x48], 0x2a0028
mov dword [0x1400252c0], r13d
call qword [sym.imp.ntdll.dll_RtlGetNtSystemRoot]
nop dword [rax + rax]
lea r8, str.___s
mov edx, 0x20a
mov r9, rax
lea rcx, [0x140025000]
call fcn.140001d60
lea rdx, [0x140025000]
lea rcx, [0x140025210]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea ebx, [r13 + 1]
mov cl, bl
lea rdx, [0x140025a40]
call qword [sym.imp.ntdll.dll_RtlCreateEnvironment]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jns 0x1400096f5
mov rax, qword [sym.imp.ntdll.dll_RtlCreateEnvironment]
mov dword [0x140024dd0], 0x82e
mov dword [0x140024dd4], ecx
mov qword [0x140024dd8], rax
mov eax, ecx
jmp 0x140009f8c
mov r14d, 0x30
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x68]
mov dword [rsp + 0x48], r14d
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
mov esi, 0xf003f
lea r8, [rsp + 0x48]
lea edi, [r14 + 0x10]
mov edx, esi
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x60], edi
movdqu xmmword [rsp + 0x68], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
test eax, eax
js 0x140009757
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov byte [0x140025374], bl
call fcn.140005b10
lea rax, [rbp - 0x58]
mov dword [rsp + 0x48], r14d
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x50], r13
mov edx, esi
mov dword [rsp + 0x60], edi
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x68], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jns 0x1400097b0
mov rax, qword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [0x140024dd0], 0x85e
jmp 0x1400096e1
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140017090]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
movsx r9d, byte [0x140025338]
lea r8, [0x140018d7c]
mov edx, 0x200
lea rcx, [rbp + 0x60]
call fcn.140001d60
lea rcx, [rbp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400097ed
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [rbp - 0x48]
lea rax, [rbp + 0x60]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jns 0x140009842
mov rax, qword [sym.imp.ntdll.dll_NtSetValueKey]
mov dword [0x140024dd0], 0x888
jmp 0x1400096e1
mov rcx, qword [0x140025a40]
lea rdx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlSetCurrentEnvironment]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [0x140024100]
lea rdx, str.Session_Manager
lea edi, [r9 + 2]
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlQueryRegistryValuesEx]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jns 0x14000989d
mov rax, qword [sym.imp.ntdll.dll_RtlQueryRegistryValuesEx]
mov dword [0x140024dd0], 0x8a2
jmp 0x1400096e1
call fcn.140005bc0
test eax, eax
jns 0x1400098c9
mov dword [0x140024dd0], 0x8af
lea rcx, [fcn.140005bc0]
mov dword [0x140024dd4], eax
mov qword [0x140024dd8], rcx
jmp 0x140009f8c
lea rcx, [0x140019058]
call fcn.140009fc4
lea rax, [0x140024dc0]
mov r8d, ebx
lea r9, [0x140024db8]
mov qword [rsp + 0x20], rax
lea rdx, [0x1400246b0]
lea rcx, [0x1400246c0]
call fcn.1400057b0
test eax, eax
jns 0x140009923
mov qword [0x140024db8], r13
lea rcx, [fcn.1400057b0]
mov qword [0x140024dc0], r13
mov dword [0x140024dd0], 0x8c7
jmp 0x1400098b7
cmp byte [0x140024d28], r13b
mov eax, dword [0x1400252c4]
je 0x14000993f
test dil, al
je 0x14000993f
or eax, ebx
mov dword [0x1400252c4], eax
test bl, al
je 0x140009955
mov ecx, ebx
call fcn.140007a30
test eax, eax
js 0x140009960
call fcn.14000f0e4
jmp 0x14000995c
xor ecx, ecx
call fcn.140007a30
test eax, eax
jns 0x140009976
mov dword [0x140024dd0], 0x8e8
lea rcx, [fcn.140007a30]
jmp 0x1400098b7
call fcn.14000a7b0
test eax, eax
jns 0x140009995
mov dword [0x140024dd0], 0x8ef
lea rcx, [fcn.14000a7b0]
jmp 0x1400098b7
mov rcx, qword [rbp - 0x80]
lea rdx, [0x140025a40]
call qword [sym.imp.ntdll.dll_RtlSetCurrentEnvironment]
nop dword [rax + rax]
call fcn.140009160
test eax, eax
jns 0x1400099cb
mov dword [0x140024dd0], 0x904
lea rcx, [fcn.140009160]
jmp 0x1400098b7
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x48]
mov rax, qword [0x140024e28]
lea rcx, [0x140024fb0]
mov edx, 0xf000f
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x60], 0xd0
mov qword [rsp + 0x70], r13
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jns 0x140009a30
mov rax, qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
mov dword [0x140024dd0], 0x924
jmp 0x1400096e1
call fcn.140005cc0
test eax, eax
jns 0x140009a4f
mov dword [0x140024dd0], 0x935
lea rcx, [fcn.140005cc0]
jmp 0x1400098b7
cmp byte [0x140025ae8], r13b
mov r14, r13
mov qword [rsp + 0x78], r13
jne 0x140009a67
mov esi, 0xc0000001
jmp 0x140009ab6
cmp byte [0x140025374], r13b
jne 0x140009a99
cmp dword [0x140024710], 0xffffffff
jne 0x140009a99
cmp byte [0x140024fb9], r13b
jne 0x140009a99
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.140006838
mov r14, qword [rsp + 0x78]
mov esi, eax
jmp 0x140009ab6
mov esi, 0xc0000001
call fcn.1400150f8
test al, al
je 0x140009ab6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.14001525c
mov rcx, qword [0x140025220]
lea rdx, [0x140025220]
mov rax, qword [0x140025250]
mov rbx, rax
cmp rcx, rdx
je 0x140009b26
cmp qword [rcx], rdx
jne 0x140009b51
lea rdi, [rcx + 0x10]
mov r8b, 1
mov rdx, rdi
lea rcx, [0x140017050]
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
nop dword [rax + rax]
test al, al
jne 0x140009b1f
cmp byte [0x140024d28], r13b
je 0x140009b51
mov r8b, 1
lea rcx, [0x140017060]
mov rdx, rdi
call qword [sym.imp.ntdll.dll_RtlPrefixUnicodeString]
nop dword [rax + rax]
test al, al
je 0x140009b51
mov rax, qword [0x140025250]
lea rcx, [0x140025250]
cmp rax, rcx
je 0x140009b4d
cmp qword [rbx], rcx
jne 0x140009b51
cmp byte [0x140024d28], r13b
je 0x140009b51
lea rdx, [rbx + 0x10]
call fcn.14000f3d4
test al, al
je 0x140009b51
test esi, esi
js 0x140009b78
call fcn.1400094a0
test eax, eax
jns 0x140009b78
mov dword [0x140024dd0], 0x995
mov dword [0x140024dd4], eax
mov rax, qword [sym.imp.ntdll.dll_NtSerializeBoot]
mov qword [0x140024dd8], rax
lea rcx, [0x1400190c8]
call fcn.140009fc4
mov rbx, qword [0x140025240]
jmp 0x140009bb7
cmp byte [0x140025ae8], r13b
mov rdi, rbx
je 0x140009bac
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
call fcn.1400042c8
mov rbx, qword [rbx]
mov rcx, rdi
call fcn.140005780
lea rax, [0x140025240]
cmp rbx, rax
jne 0x140009b8d
lea rcx, [0x140019138]
call fcn.140009fc4
lea rcx, [0x140019068]
call fcn.140009fc4
mov rdi, qword [0x140025220]
lea rax, [0x140025220]
cmp rdi, rax
je 0x140009c1e
lea r12, [0x140025220]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
mov rbx, rdi
call fcn.1400042c8
mov rdi, qword [rdi]
mov rcx, rbx
call fcn.140005780
cmp rdi, r12
jne 0x140009bf5
mov r12, r13
lea rcx, [0x140019088]
call fcn.140009fc4
lea rcx, [0x140019098]
call fcn.140009fc4
mov rdi, qword [0x140025230]
lea rax, [0x140025230]
cmp rdi, rax
je 0x140009c7b
lea r15, [0x140025230]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
mov rbx, rdi
call fcn.1400042c8
mov rdi, qword [rdi]
mov rcx, rbx
call fcn.140005780
cmp rdi, r15
jne 0x140009c50
mov r15, qword [rsp + 0x40]
lea rcx, [0x1400190f8]
call fcn.140009fc4
test r15, r15
je 0x140009c9d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtSetEvent]
nop dword [rax + rax]
lea rcx, [0x140019038]
call fcn.140009fc4
cmp byte [0x140024d29], r13b
je 0x140009cb7
call fcn.14000f27c
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtInitializeRegistry]
nop dword [rax + rax]
lea rcx, [0x1400190b8]
call fcn.140009fc4
test esi, esi
js 0x140009e05
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceFrequency]
nop dword [rax + rax]
neg eax
sbb rcx, rcx
and qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x70]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
nop dword [rax + rax]
neg eax
lea rax, [rbp - 0x10]
sbb rcx, rcx
mov qword [rsp + 0x20], rax
and qword [rsp + 0x30], rcx
xor edx, edx
lea rcx, [rbp - 0x28]
lea r9d, [rdx + 0x20]
call fcn.1400042c8
test eax, eax
js 0x140009d98
test byte [rbp + 0x46], 0x80
je 0x140009d5c
mov rcx, qword [rbp]
xor edx, edx
mov ebx, r13d
call qword [sym.imp.ntdll.dll_NtResumeThread]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
jmp 0x140009d76
mov rcx, qword [rbp - 8]
mov edx, 0xc0000428
mov ebx, 3
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140009d9d
mov ebx, 1
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
nop dword [rax + rax]
neg eax
sbb r8, r8
and r8, qword [rsp + 0x30]
mov qword [rsp + 0x30], r8
jle 0x140009dd5
mov rax, qword [rbp - 0x78]
sub rax, qword [rbp - 0x70]
imul rax, rax, 0x3e8
cqo
idiv r8
mov r12, rax
lea r9, [rbp - 0x28]
mov r8, r12
mov rdx, r14
mov ecx, ebx
call fcn.14001525c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x20]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, r13d
call qword [sym.imp.ntdll.dll_RtlIsStateSeparationEnabled]
nop dword [rax + rax]
test al, al
je 0x140009e46
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [0x140024050]
xor ecx, ecx
lea rdx, str.REGISTRYMACHINEOSDATASession_Manager
call qword [sym.imp.ntdll.dll_RtlQueryRegistryValuesEx]
nop dword [rax + rax]
test eax, eax
mov eax, 1
cmovns ebx, eax
cmp byte [0x140025374], r13b
jne 0x140009e56
mov ecx, ebx
call fcn.140009358
lea r9, [0x140024d40]
mov qword [rsp + 0x40], r13
xor r8d, r8d
lea rdx, [0x140006d50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_TpAllocWork]
nop dword [rax + rax]
test eax, eax
jns 0x140009e97
mov rcx, qword [sym.imp.ntdll.dll_TpAllocWork]
mov dword [0x140024dd0], 0xa8a
jmp 0x1400098b7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_TpPostWork]
nop dword [rax + rax]
cmp dword [0x140024fa8], r13d
je 0x140009ec4
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntdll.dll_TpWaitForWork]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_TpReleaseWork]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call fcn.14000a120
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
jns 0x140009f18
mov dword [0x140024dd0], 0xaa4
lea rax, [fcn.14000a120]
mov dword [0x140024dd4], ebx
mov qword [0x140024dd8], rax
mov eax, ebx
jmp 0x140009f8c
lea rcx, [0x140019118]
call fcn.140009fc4
mov rdi, qword [0x140025250]
lea rsi, [0x140025250]
jmp 0x140009f55
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
mov rbx, rdi
call fcn.1400042c8
mov rdi, qword [rdi]
mov rcx, rbx
call fcn.140005780
cmp rdi, rsi
jne 0x140009f34
lea rcx, [0x1400190d8]
call fcn.140009fc4
call fcn.14000a820
test eax, eax
jns 0x140009f85
mov dword [0x140024dd0], 0xacf
lea rcx, [fcn.14000a820]
jmp 0x1400098b7
call fcn.14000b070
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14000e710
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret