Function at 0x140063a60
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
test dword [rdx + 0x118], 0x400
mov rax, rdx
mov rcx, rdx
mov rdx, r8
jne 0x1400837d0
jmp fcn.140083430
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp], rax
mov r12, rdx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
mov ebx, 4
cmp qword [rdx + 0x10], rbx
cmovb rbx, qword [rdx + 0x10]
mov r15, rdx
cmp qword [rdx + 0x18], 8
jb 0x140083834
mov r15, qword [rdx]
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x140083fac
mov eax, 0xa
mov qword [rbp - 0x28], 7
cmp rbx, 8
jae 0x140083880
mov qword [rbp - 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x40]
call fcn.14009d3c0
mov word [rbp + rbx - 0x40], r13w
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x40]
jmp 0x1400838ca
mov rdi, rbx
or rdi, 7
cmp rdi, r14
jbe 0x140083891
mov rdi, r14
jmp 0x140083898
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x40]
call fcn.1400037f0
mov rsi, rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.14009d3c0
mov word [rsi + rbx], r13w
mov dword [rsp + 0x30], 1
lea rcx, [rbp - 0x40]
call fcn.140085680
mov qword [rsp + 0x50], rax
mov r15d, 1
and r15d, 0xfffffffe
mov dword [rsp + 0x30], r15d
cmp rdi, 8
jb 0x14008392a
lea rdx, [rdi*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140083922
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083fa6
mov rcx, rsi
call fcn.14009bfe4
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rsi, 0xffffffffffffffff
mov r9, rsi
lea r8d, [rsi + 6]
lea rdx, [rbp - 0x80]
mov rcx, r12
call fcn.14000a520
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14008399b
dec rcx
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rbx, [rdx + rax*2]
cmp word [rbx], 0x5c
je 0x140083993
cmp rbx, rdx
je 0x14008399b
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x140083984
sub rbx, rdx
sar rbx, 1
jmp 0x14008399e
mov rbx, rsi
lea r8, [rbx + 1]
mov r9, rsi
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.14000a520
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
cmp qword [rbp - 0x70], rbx
cmovb rbx, qword [rbp - 0x70]
lea r13, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x68]
cmp r12, 8
cmovae r13, rdi
cmp rbx, r14
ja 0x140083fb2
mov qword [rbp - 0x48], 7
cmp rbx, 8
jae 0x140083a17
mov qword [rbp - 0x50], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.14009d3c0
xor r14d, r14d
mov word [rbp + rbx - 0x60], r14w
jmp 0x140083a70
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x140083a33
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rbp - 0x60]
call fcn.1400037f0
mov rdi, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r14
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.14009d3c0
xor r14d, r14d
mov word [rdi + rbx], r14w
mov r12, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x80]
or r15d, 8
mov dword [rsp + 0x30], r15d
cmp r12, 8
jb 0x140083ab4
lea rdx, [r12*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140083aac
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083fb8
mov rcx, rdi
call fcn.14009bfe4
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
and r15d, 0xfffffff7
mov dword [rsp + 0x30], r15d
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
mov rbx, r14
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x70], r14
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083ec1
mov dword [rsp + 0x68], r14d
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r14d
test rbx, rbx
je 0x140083ec1
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140085430
nop
mov r12, qword [rsp + 0x40]
lea rax, [r12 + 0xf0]
cmp qword [rax + 0x18], 8
jb 0x140083b9d
mov rax, qword [rax]
movzx edi, word [rax]
mov word [rsp + 0x34], di
movzx edx, di
lea rcx, [rsp + 0x38]
call fcn.14001c4a0
mov rcx, qword [rsp + 0x38]
cmp dword [rcx - 0x10], 0
jle 0x140083e81
movzx edx, di
call fcn.14009ec30
test rax, rax
je 0x140083e81
sub rax, qword [rsp + 0x38]
sar rax, 1
test eax, eax
js 0x140083e81
sub r12, 0xffffffffffffff80
mov r14, r12
cmp qword [r12 + 0x18], 8
jb 0x140083bf5
mov r14, qword [r12]
mov r8d, 1
movzx edx, di
lea rcx, [rsp + 0x78]
call fcn.14002ab20
mov r13, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140083c25
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x140083c3f
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140083fbe
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
or r15d, 0x10
mov dword [rsp + 0x30], r15d
test r14, r14
jne 0x140083c60
xor edi, edi
jmp 0x140083c6e
mov rdi, rsi
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140083c63
mov rdx, qword [r13]
mov qword [rsp + 0x48], rdx
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x40], eax
lea r13d, [rdi + rax]
test r13d, r13d
js 0x140083fc9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140083cb4
mov edx, r13d
lea rcx, [rsp + 0x50]
call fcn.140006870
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
movsxd rax, dword [rsp + 0x40]
lea r8, [rax + rax]
mov qword [rsp + 0x48], r8
test r8, r8
je 0x140083cf0
test rbx, rbx
je 0x140083ce0
mov rcx, rbx
test rdx, rdx
je 0x140083cdb
call fcn.14009d3c0
jmp 0x140083cf0
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
movsxd r8, edi
add r8, r8
mov rcx, qword [rsp + 0x48]
lea rcx, [rcx + rbx]
je 0x140083d2c
test rcx, rcx
je 0x140083d1c
test r14, r14
je 0x140083d15
mov rdx, r14
call fcn.14009d3c0
jmp 0x140083d2c
xor edx, edx
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r13d, dword [rbx - 0xc]
jg 0x140083fc9
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
lea r8, [0x1400f1b38]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140022640
test eax, eax
sete dil
and r15d, 0xffffffef
mov dword [rsp + 0x30], r15d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083d82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083da0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test dil, dil
je 0x140083e2e
mov r8d, 1
movzx edx, word [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.14002ab20
nop
cmp qword [r12 + 0x18], 8
jb 0x140083dcb
mov r12, qword [r12]
mov r8, rax
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.14000c7b0
nop
lea r8, [0x1400f1b38]
mov rdx, qword [rax]
lea rcx, [rsp + 0x38]
call fcn.140022640
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083e10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140083e2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x140083e4d
mov eax, 0xd
jmp 0x140083e98
mov rcx, rsi
lea rcx, [rcx + 1]
cmp word [rax + rcx*2], 0
jne 0x140083e50
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140083e98
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140083eba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x60]
jmp 0x140083ec4
xor dil, dil
test rbx, rbx
je 0x140083ed7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140083f1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083fd4
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r14w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140083f6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083f65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083fa6
call fcn.14009bfe4
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
movzx eax, dil
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a3080
nop
call fcn.140003690
nop
call fcn.140003690
int3
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
int3
mov ecx, 0x80070057
call fcn.140007f00
nop
call fcn.1400a3080
int3