Function at 0x7ff7bffe52e0
Capabilities:
Delete registry value
Map section object
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x7ff7bffe5b7c
cmp qword [rcx], 0
je 0x7ff7bffe5b7c
lea rax, [0x7ff7c0175d98]
mov qword [rbp - 8], 8
mov r8b, 1
mov qword [rbp], rax
lea rdx, [rbp - 8]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffe5dd4
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0175d90]
mov r8b, 1
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov qword [rbp + 8], 6
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
jne 0x7ff7bffe5dd4
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0175d58]
mov r8b, 1
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffe5dd4
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0175d70]
mov r8b, 1
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x28]
mov qword [rbp + 0x28], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffe5dd4
mov rcx, qword ds:[rbx + 0x10]
lea rax, [0x7ff7c01771d0]
mov r8b, 1
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe5425
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
test rdx, rdx
je 0x7ff7bffe5405
add rsp, 0x220
pop rdi
pop rbx
pop rbp
nop
jmp fcn.7ff7bffcf630
lea r8, [0x7ff7c01773a0]
mov edx, 0x10
add rsp, 0x220
pop rdi
pop rbx
pop rbp
jmp sym.ProcessHacker.exe_PhShowMessage
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0175cd0]
mov qword [rsp + 0x210], r12
lea rdx, [rbp + 0x48]
mov r8b, 1
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x1f8], r15
mov qword [rbp + 0x48], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffe5634
xor r15d, r15d
mov edx, 0x1000
cmp qword [0x7ff7c01d3db0], r15
je 0x7ff7bffe5577
cmp byte [0x7ff7c01d30ef], r15b
lea rcx, [rsp + 0x50]
mov rax, qword [rbx]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
jne 0x7ff7bffe54e4
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rsp + 0x60]
mov qword [rbp - 0x30], r15
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r15d
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x28], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe54ee
cmp byte [0x7ff7c01d30ef], r15b
je 0x7ff7bffe5b6c
mov edx, 0x1000
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x60]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe5b6c
mov rax, qword ds:[rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov dword [rsp + 0x48], r15d
xor edx, edx
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], r15
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x70], rcx
mov rcx, qword [0x7ff7c01d3db0]
mov dword [rsp + 0x28], 0x9999225f
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x68], 4
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r15
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovns r15, qword [rbp + 0xa0]
jmp 0x7ff7bffe55c4
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x148]
mov r8, qword [rbx]
call fcn.7ff7bffe51c0
test eax, eax
js 0x7ff7bffe5b6c
mov rcx, qword [rbp + 0x148]
lea r8, [rbp + 0xb0]
mov r9d, 0x30
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x148]
test eax, eax
cmovns r15, qword [rbp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
test r15, r15
je 0x7ff7bffe5b6c
mov rcx, r15
call sym.ProcessHacker.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x7ff7bffe5dbb
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov r9, rax
xor r8d, r8d
mov edx, 0x8078
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[rbx - 0x10]
mov r12, 0xffffffffffffffff
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x7ff7bffe5b6c
call fcn.7ff7c00c6290
jmp 0x7ff7bffe5b6c
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0177218]
mov r8b, 1
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x58]
mov qword [rbp + 0x58], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe5b9a
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x158]
mov r8, qword [rbx]
xor r15d, r15d
mov qword [rsp + 0x218], rsi
xor sil, sil
mov qword [rsp + 0x208], r13
mov qword [rsp + 0x200], r14
lea edx, [r15 + 7]
mov qword [rbp + 0x158], r15
call fcn.7ff7bffe51c0
mov r13d, eax
test eax, eax
jns 0x7ff7bffe56c1
mov r9, qword [rbx + 8]
lea edx, [r15 + 5]
mov r8, qword [rbx]
lea rcx, [rbp + 0x158]
call fcn.7ff7bffe51c0
mov r13d, eax
mov sil, 1
mov rdx, qword [rbp + 0x158]
lea r14, [0x7ff7c017439c]
mov r12, 0xffffffffffffffff
test rdx, rdx
je 0x7ff7bffe5ab2
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x148]
mov qword [rsp + 0x30], r15
mov r8d, 0xffffffff
mov qword [rsp + 0x28], r15
mov rcx, r12
mov qword [rsp + 0x20], rax
xor r14b, r14b
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0x2000000
mov qword [rsp + 0x70], r15
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x7ff7bffe5765
cmp dword [rbp + 0x148], r15d
jge 0x7ff7bffe5765
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r15
test rcx, rcx
je 0x7ff7bffe5765
add rcx, 0xfffffffffffffff0
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe5765
nop dword [rax]
call fcn.7ff7c00c6290
mov rcx, qword ds:[rbp + 0x158]
lea r8, [rbp + 0x68]
mov r9d, 0x18
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov r13d, eax
test eax, eax
js 0x7ff7bffe5a7d
mov rax, qword [rbp + 0x78]
cmp rax, 0x2000000
jg 0x7ff7bffe57a4
mov qword [rsp + 0x58], rax
jmp 0x7ff7bffe57a7
mov r14b, 1
mov rcx, qword [rbp + 0x158]
lea r8, [rsp + 0x70]
movzx eax, sil
xor r9d, r9d
xor eax, 1
mov rdx, r12
lea eax, [rax*2 + 2]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov r13d, eax
cmp eax, 0xc000004e
jne 0x7ff7bffe584d
nop dword [rax]
test sil, sil
jne 0x7ff7bffe59e9
mov rcx, qword [rbp + 0x158]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov r13d, eax
test r13d, r13d
js 0x7ff7bffe59d6
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
lea r8d, [rdx + 0x34]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov qword [rsp + 0x78], rax
mov rbx, rax
test r14b, r14b
je 0x7ff7bffe588d
lea r8, [0x7ff7c0177440]
mov edx, 0x30
mov rcx, rdi
call sym.ProcessHacker.exe_PhShowMessage
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
mov qword [rbx + 8], rcx
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x50]
mov dword [rbx + 0x20], 0xffffffff
test rax, rax
je 0x7ff7bffe5962
mov r14, qword [rax + 8]
lea rcx, [0x7ff7c01774f8]
call sym.ProcessHacker.exe_PhCountStringZ
mov rsi, rax
mov rcx, r14
add rsi, rsi
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword [0x7ff7c01d3b58]
mov rdi, rax
add rdi, rdi
lea rbx, [rdi + rsi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, rsi
mov qword [rbp + 0x150], rax
lea rdx, [0x7ff7c01774f8]
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
mov rcx, qword [rax + 8]
call fcn.7ff7c0125120
mov r15, qword [rbp + 0x150]
mov r8, rdi
mov rdx, r14
mov rcx, qword [r15 + 8]
add rcx, rsi
call fcn.7ff7c0125120
mov rdi, qword [rbp + 0x140]
mov rbx, qword [rsp + 0x78]
jmp 0x7ff7bffe59ae
mov rdx, qword [0x7ff7c01d3b58]
mov ecx, 0x20
call sym.ProcessHacker.exe_PhCreateObject
mov qword [rax], 0xe
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0xe], r15w
mov r15, rax
mov rdx, qword [rax + 8]
movsd xmm0, qword [0x7ff7c0177218]
movsd qword [rdx], xmm0
mov ecx, dword [0x7ff7c0177220]
mov dword [rdx + 8], ecx
movzx ecx, word [0x7ff7c0177224]
mov word [rdx + 0xc], cx
mov qword [rbx + 0x28], r15
mov r9, rbx
mov dword [rbx + 0x30], 1
xor r8d, r8d
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x8080
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x7ff7bffe5a7d
cmp r13d, 0xc0000022
je 0x7ff7bffe59fe
nop
cmp r13d, 0xc0000005
je 0x7ff7bffe59fe
mov eax, r13d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7bffe5a0b
movzx eax, r13w
jmp 0x7ff7bffe5a07
mov ecx, r13d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7bffe5a15
mov ecx, r13d
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7bffe5a1c
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c0177510]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x7ff7bffe5a6c
mov rax, qword [rax + 8]
lea r14, [0x7ff7c017439c]
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], r14
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe5a84
call fcn.7ff7c00c6290
jmp 0x7ff7bffe5a84
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea r14, [0x7ff7c017439c]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x7ff7bffe5aa5
lea rcx, [rax - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe5aa5
nop
call fcn.7ff7c00c6290
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.ntdll.dll_NtClose]
mov rsi, qword ss:[rsp + 0x218]
test r13d, r13d
jns 0x7ff7bffe5b5c
cmp r13d, 0xc0000022
je 0x7ff7bffe5af0
cmp r13d, 0xc0000005
je 0x7ff7bffe5af0
mov eax, r13d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7bffe5afd
movzx eax, r13w
jmp 0x7ff7bffe5af9
mov ecx, r13d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7bffe5b07
mov ecx, r13d
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7bffe5b0e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c0177560]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x7ff7bffe5b87
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], r14
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x7ff7bffe5b5c
call fcn.7ff7c00c6290
mov r14, qword [rsp + 0x200]
mov r13, qword [rsp + 0x208]
mov r12, qword [rsp + 0x210]
mov r15, qword [rsp + 0x1f8]
add rsp, 0x220
pop rdi
pop rbx
pop rbp
ret
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x7ff7bffe5b5c
mov rcx, qword [rbx + 0x10]
lea rax, [0x7ff7c0177250]
mov r8b, 1
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x7ff7bffe5b6c
cmp qword [0x7ff7c01d3db0], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
je 0x7ff7bffe5ce5
mov rax, qword [rbx]
lea rcx, [rsp + 0x50]
xor r15d, r15d
mov qword [rsp + 0x60], rax
cmp byte [0x7ff7c01d30ef], r15b
mov edx, 0x1000
mov qword [rsp + 0x68], r15
jne 0x7ff7bffe5c44
lea r9, ds:[rsp + 0x60]
mov dword [rbp - 0x38], 0x30
lea r8, [rbp - 0x38]
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x20], r15d
mov qword [rbp - 0x28], r15
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe5c4e
cmp byte [0x7ff7c01d30ef], r15b
je 0x7ff7bffe5b6c
mov edx, 0x1000
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x60]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe5b6c
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov dword [rsp + 0x48], r15d
xor edx, edx
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], r15
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x70], rcx
mov rcx, qword [0x7ff7c01d3db0]
mov dword [rsp + 0x28], 0x9999225f
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x68], 5
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r15
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x7ff7bffe5cd8
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rsp + 0x78], xmm0
mov rcx, qword ds:[rsp + 0x50]
jmp 0x7ff7bffe5d41
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x148]
mov r8, qword [rbx]
mov edx, 0x800
call fcn.7ff7bffe51c0
nop dword [rax]
test eax, eax
js 0x7ff7bffe5b6c
mov rcx, qword [rbp + 0x148]
lea r8, [rbp + 0x80]
xor r15d, r15d
xor edx, edx
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x7ff7bffe5d3a
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rsp + 0x78], xmm0
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x7ff7bffe5b6c
call sym.ProcessHacker.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x7ff7bffe5dbb
mov rdx, rax
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateProcessPropContext
mov rdi, rax
lea rcx, [rbx - 0x10]
mov r12, 0xffffffffffffffff
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x7ff7bffe5d92
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x80]
lea r9, [0x7ff7bffe52a0]
mov qword [rdi + 0x78], rcx
mov r8, rdi
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x808a
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x7ff7bffe5b6c
lea r8, [0x7ff7c0177408]
mov edx, 0x10
mov rcx, rdi
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x7ff7bffe5b6c
mov r8, qword ds:[rbx + 0x18]
mov rcx, rdi
test r8, r8
je 0x7ff7bffe5e10
mov r8, qword ds:[r8 + 8]
lea rax, [0x7ff7c0177280]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7c01772e8]
call sym.ProcessHacker.exe_PhShellExecuteUserString
add rsp, 0x220
pop rdi
pop rbx
pop rbp
ret
lea r8, [0x7ff7c0177320]
mov edx, 0x10
add rsp, 0x220
pop rdi
pop rbx
pop rbp
jmp sym.ProcessHacker.exe_PhShowMessage