Function at 0x140034e90
Capabilities:
Delete registry key
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x1400a9028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movups xmm0, xmmword [rsi]
lea rax, [rsp + 0x90]
movaps xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xa8]
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.14005b670
cmp qword [rsi], 0
je 0x140035115
lea rsi, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1400350f3
lea r14, [rsp + 0xd0]
add qword [r14], 0xf4240
lea rdx, [rsp + 0xc0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x1400350f3
lea rdx, [rsp + 0xc0]
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
mov eax, dword [rsp + 0xb8]
mov dword [rcx + 8], eax
xor eax, eax
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x7c], eax
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140034fe5
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140034fe5
mov eax, dword [rsp + 0xc0]
cmp eax, dword [rsp + 0xd0]
jne 0x140034fe5
mov eax, dword [rsp + 0xd4]
cmp dword [rsp + 0xc4], eax
je 0x140035092
lea rcx, str.Hash_is_too_close_to_expiration__sleeping_until_next_hash.
lea rdx, str.SetUserChoice
mov r8d, 0x61
call fcn.14002d890
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movups xmm0, xmmword [rsi]
lea rax, [rsp + 0x50]
movaps xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.14005b670
mov rax, qword [rsi]
mov qword [rsi], 0
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rax
test rcx, rcx
je 0x14003508d
call fcn.140058840
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], 0
test rcx, rcx
je 0x140035085
call fcn.140058840
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x1400350f3
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
call fcn.14005b5e0
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400350f3
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140035138
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.SetUserChoice
mov r8d, 0x76
call fcn.14002fad0
xor esi, esi
jmp 0x1400351e1
xor esi, esi
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
test rcx, rcx
je 0x140035117
call fcn.140058840
jmp 0x140035117
xor esi, esi
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140059960
mov eax, esi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0xd0]
lea rdx, [0x1400a14e4]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x140035171
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.SetUserChoice
mov r8d, 0x80
jmp 0x1400351cc
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
lea rdx, [0x1400a14e4]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140035208
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.SetUserChoice
mov r8d, 0x8a
call fcn.14002fad0
xor esi, esi
test rdi, rdi
je 0x1400351e1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], 0
test rcx, rcx
je 0x1400350f5
call fcn.140058840
jmp 0x1400350f5
mov rbx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
lea rdx, str.ProgID
mov rcx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140035249
mov r8d, 0x94
jmp 0x140035290
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea rdx, str.Hash
mov rcx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400352c3
mov r8d, 0x9d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.SetUserChoice
call fcn.14002fad0
xor esi, esi
test rbx, rbx
je 0x1400351d3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400351d3
mov sil, 1
jmp 0x1400352ac