Function at 0x140007040
Capabilities:
Delete file
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, qword [rbp + 0x228]
mov r15, qword [rbp + 0x230]
mov r13, qword [rbp + 0x240]
mov r12, qword [rbp + 0x248]
mov rax, rcx
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbp + 0x258]
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x260]
mov rsi, r9
mov qword [rbp - 0x68], rcx
mov rcx, qword [rbp + 0x278]
mov rdi, r8
mov qword [rbp - 0x80], rcx
mov rcx, qword [rbp + 0x280]
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x290]
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], rcx
cmp dword [rax], ecx
je 0x1400077d1
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx + 0x30], 7
jge 0x140007128
mov ebx, 0x8007139f
jmp 0x14000773e
test rbx, rbx
je 0x140007739
test rdi, rdi
je 0x140007739
mov rdx, qword [rdx + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x140007154
add rbx, 2
test ecx, ecx
jne 0x140007141
test eax, eax
je 0x140007162
mov ebx, 0x80070005
jmp 0x14000773e
lea rcx, [rsp + 0x50]
call fcn.14000d238
mov ebx, eax
test eax, eax
jne 0x14000773e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, [0x1400036d0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400071be
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, [0x1400036d0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140007726
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
je 0x140007202
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x140007726
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x140007245
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x14000720e
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007726
mov ecx, 4
lea rax, [rbp + 0x220]
lea rdx, [0x1400037f8]
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007726
mov rcx, qword [rsp + 0x30]
lea rax, [0x1400038f8]
lea rdx, [0x140003950]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007726
test r14, r14
je 0x1400072e7
mov rcx, qword [rsp + 0x30]
mov eax, 4
lea rdx, [0x140003908]
mov dword [rsp + 0x28], eax
mov r9d, eax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r14d, r14d
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x1400038a0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000732f
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400038a0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140007729
test r15, r15
je 0x140007374
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x140007337
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
lea rdx, [0x140003880]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
mov esi, dword [rbp + 0x238]
test esi, esi
jne 0x140007554
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
lea rdx, [0x1400038c8]
mov r15d, 0x103
xor r8d, r8d
mov word [rbp + 0x1a6], r14w
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400073fd
test r13, r13
je 0x1400073dc
lea rdx, [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400073fd
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r13, r13
jne 0x1400073fd
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1400038c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
lea r15, [0x1400037f0]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov word [rbp + 0x1a6], r14w
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007471
test r12, r12
je 0x140007454
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007471
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r12, r12
jne 0x140007476
mov rcx, qword [rsp + 0x38]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r12, r12
je 0x1400074b2
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x140007479
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
test r13, r13
je 0x1400074f8
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x1400074ba
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
lea rdx, [0x1400038c8]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, [0x140003858]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140007540
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [0x140003858]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400038d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400075d0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, [0x1400038d0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000759c
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [0x1400038d0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x250]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [0x140003918]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x78]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400075d8
lea eax, [rax*2 + 2]
mov r15d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov r9d, r15d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
test esi, esi
jne 0x140007741
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140007661
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007627
lea eax, [rax*2 + 2]
lea rdx, [0x140003930]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400076a4
inc rdi
cmp word [rcx + rdi*2], r14w
jne 0x14000766a
lea eax, [rdi*2 + 2]
lea rdx, [0x1400037e0]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140007729
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea rdx, [0x140003840]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400076e8
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, [0x140003840]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140007729
mov rax, qword [rsp + 0x70]
mov r9, qword [rbp - 0x80]
mov r8d, dword [rbp + 0x270]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140005188
mov ebx, eax
test eax, eax
js 0x140007741
mov r9, qword [rbp - 0x70]
mov r8d, dword [rbp + 0x288]
mov rdx, qword [rsp + 0x58]
call fcn.1400050a4
mov ebx, eax
jmp 0x140007741
xor r14d, r14d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140007741
mov ebx, 0x80070057
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140007751
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140007761
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140007771
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007781
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140007791
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x68]
cmp dword [rax], r14d
je 0x1400077a5
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000faa0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8007000e
xor r14d, r14d
jmp 0x140007796