Function at 0x100033240
Capabilities:
Delete registry key
Delete registry value
Get installed programs
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x550
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x540], rax
xor r9d, r9d
mov rsi, r8
mov qword [0x10004ce70], rcx
lea r12d, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov edx, r12d
mov dword [0x10004d3a8], 2
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor ebx, ebx
lea rcx, [rsp + 0x80]
cmp rsi, rbx
je 0x1000332b7
mov r8d, 0x153
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_mbstowcs]
jmp 0x1000332fb
lea rdi, [0x100001db4]
lea rax, [rsp + 0x80]
mov edx, 0x154
sub rdi, rax
lea rax, [rdx + 0x7ffffeaa]
cmp rax, rbx
je 0x1000332ef
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x1000332ef
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x1000332ce
cmp rdx, rbx
jne 0x1000332f8
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
cmp eax, ebx
jge 0x100033320
lea rdx, [0x10001f030]
mov ecx, 2
call fcn.100045708
lea rdx, [0x10001f070]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003333f
call fcn.1000319a0
mov r13, 0xffffffff80000002
lea rdx, [0x10001caf0]
mov qword [rsp + 0x50], rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10001cb70]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rdx, [0x10001cb70]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x1000333b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10001ccd0]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10001cd70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rdx, [0x10001c490]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
or r15, 0xffffffffffffffff
cmp eax, ebx
jne 0x1000334fa
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x330]
lea rdx, [0x10001cad8]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100033480
cmp dword [rsp + 0x58], r12d
jne 0x100033480
xor eax, eax
lea rdi, [rsp + 0x330]
mov rcx, r15
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp rcx, 0x14
jae 0x1000334ef
lea rcx, [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoCreateGuid]
cmp eax, ebx
jne 0x1000334ef
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x68]
mov r8d, 0x103
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, ebx
je 0x1000334ef
xor eax, eax
lea rdi, [rsp + 0x330]
mov rcx, r15
repne scasw ax, word [rdi]
lea rdx, [0x10001cad8]
mov r9d, r12d
not rcx
xor r8d, r8d
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rsi, rbx
je 0x100033b7b
lea rdx, [0x10001f098]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
lea rcx, [rsp + 0x80]
cmp rax, rbx
je 0x100033544
lea rdx, [0x10001f0b8]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
setne bl
mov ecx, ebx
call fcn.100033be4
jmp 0x100033b7b
lea rdx, [0x10001f0e8]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100033b46
lea rdx, [0x10001f100]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100033b46
lea rdx, [0x10001f118]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033620
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
call fcn.100030a0c
lea rdx, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea rdx, [0x10001f140]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x100033610
lea rax, [rsp + 0x50]
lea rdx, [0x10001e090]
mov r9d, 3
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100033b7b
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10001f1a0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
jmp 0x100033615
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100033b7b
lea rdx, [0x10001f1c8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033644
call fcn.1000311b0
jmp 0x100033b7b
call fcn.100042840
lea rdx, [0x10001f1f0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003366d
call fcn.100032c78
jmp 0x100033b7b
lea rdx, [0x10001f210]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100033b7b
lea rdx, [0x10001f230]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100033b7b
lea rdx, [0x10001f250]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x1000336d2
call fcn.10002fd88
call fcn.10002ff60
jmp 0x100033b7b
lea rdx, [0x10001f260]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x1000336f1
call fcn.100030a0c
lea rdx, [0x10001f288]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033715
call fcn.100042c04
jmp 0x100033b7b
lea rdx, [0x10001f2a0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033740
call fcn.10003b530
xor ecx, ecx
call fcn.10003d994
jmp 0x100033b7b
lea rdx, [0x10001f2b8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
lea rdi, [0x10001f2d0]
cmp rax, rbx
je 0x100033777
lea rcx, [rsp + 0x80]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100033791
lea rdx, [0x10001f2f0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033796
call fcn.10003c0f4
lea rdx, [0x10001f310]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003381b
call fcn.100037138
cmp eax, ebx
jne 0x100033b7b
lea rcx, [rsp + 0x80]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_wcsstr]
xor ecx, ecx
cmp rax, rbx
je 0x1000337dc
call fcn.100030418
jmp 0x1000337e1
call fcn.1000300fc
call fcn.100031744
call fcn.1000364bc
call fcn.10003b530
lea rdx, [0x10001dc00]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, 0x3000
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x100033b7b
lea rdx, [0x10001f2b8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
lea rcx, [rsp + 0x80]
cmp rax, rbx
je 0x10003387b
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003385a
call fcn.10002eb00
mov ecx, r12d
call fcn.100030418
jmp 0x100033862
mov ecx, r12d
call fcn.1000300fc
call fcn.100031644
mov ecx, r12d
call fcn.100035e58
call fcn.10003c1b4
call fcn.100031404
jmp 0x100033800
lea rdx, [0x10001f328]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x1000338dc
lea rdi, [0x10004b6a0]
mov esi, 0x13
cmp qword [rdi], rbx
je 0x1000338ac
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, r12d
call fcn.100046b50
add rdi, 0x40
sub rsi, r12
jne 0x100033899
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10003f0f8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x100033bad
lea rdx, [0x10001f350]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033900
call fcn.10004295c
jmp 0x100033b7b
call fcn.10003467c
call fcn.100030a0c
lea rdx, [0x10001f368]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033929
call fcn.100032e94
lea rdx, [0x10001f380]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033948
call fcn.10002f2d4
lea rdx, [0x10001f398]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003398f
mov ecx, r12d
call fcn.10002f19c
cmp eax, ebx
je 0x100033988
lea rdx, [0x10001f3b0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x10003398f
xor ecx, ecx
call fcn.100035e58
xor ecx, ecx
call fcn.10002f19c
mov esi, 0x3000
cmp eax, ebx
je 0x1000339ae
mov r8d, r12d
mov edx, r12d
xor ecx, ecx
call fcn.10003f0f8
jmp 0x100033a0f
lea rdx, [0x10001f3c8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x1000339cf
xor r8d, r8d
xor edx, edx
jmp 0x1000339a5
lea rdx, [0x10001f3e0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x100033a22
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.10003f0f8
mov r8d, r12d
mov edx, r12d
xor ecx, ecx
mov dword [0x10004d398], r12d
call fcn.10003f0f8
call fcn.10002f420
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r9d, 0x44c
mov r8d, 0xa28
mov edx, r12d
mov ecx, 5
call fcn.1000404f0
cmp eax, ebx
je 0x100033b7b
call fcn.100037138
cmp eax, ebx
jne 0x100033b7b
call fcn.100030370
cmp eax, ebx
jne 0x100033b7b
xor ecx, ecx
mov qword [rsp + 0x50], rbx
call fcn.1000300fc
call fcn.1000364bc
call fcn.10003b530
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
lea rdx, [0x10001d4e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x100033b3f
lea rax, [rsp + 0x330]
cmp rax, rbx
je 0x100033ad2
lea rcx, [rsp + 0x330]
mov edx, 0xff
call fcn.10003fbdc
jmp 0x100033ad4
mov eax, ebx
cmp eax, ebx
je 0x100033b34
lea r8, [0x10001d608]
lea rcx, [rsp + 0x330]
mov edx, 0x100
call fcn.10002e3d4
xor eax, eax
lea rdi, [rsp + 0x330]
mov rcx, r15
lea rdx, [0x10001d620]
mov r9d, r12d
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
sub rcx, r12
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, esi
jmp 0x100033805
lea rdx, [0x10001f0e8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, 0x20
cmp rax, rbx
jne 0x100033b6a
mov ecx, 0x40
call fcn.1000372dc
call fcn.10003295c
xor ecx, ecx
call fcn.100035e58
lea r8, [rsp + 0x80]
lea rdx, [0x10001f400]
mov ecx, 2
call fcn.10004575c
mov rcx, qword [0x10004a128]
cmp rcx, r15
je 0x100033bad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x10004a128], r15
xor eax, eax
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret