Function at 0x140055340
Capabilities:
Delete registry key
Delete registry value
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
lea rdx, str.SoftwareSystems_InternalsProcess_Explorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r13, [0x140126af0]
xor edx, edx
mov rcx, r13
mov r8d, 0x47e0
call fcn.1400a8b00
mov edx, dword [0x14012640c]
mov r8d, 0x60
lea ecx, [r8 - 0x2e]
mov dword [0x140126af8], 1
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x14012640c]
mov r8d, 0x60
mov ecx, 0x28a
mov dword [0x140126b10], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
mov r12d, 0x64
mov ecx, r12d
mov r8d, 0x60
mov dword [0x140126b18], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
lea r8d, [r12 - 4]
mov ecx, 0x384
mov dword [0x140126b0c], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x14012640c]
lea r8d, [r12 - 4]
lea ecx, [r12 + 0x32]
mov dword [0x140126b14], eax
mov dword [0x140126af0], 0x2c
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
lea r8d, [r12 - 4]
lea ecx, [r12 + 0x32]
mov dword [0x140126b3c], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x14012640c]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126b38], eax
mov dword [0x140126b1c], 0x2c
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126b68], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x14012640c]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126b64], eax
mov dword [0x140126b48], 0x2c
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126b94], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x14012640c]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126b90], eax
mov dword [0x140126b74], 0x2c
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x140126408]
lea r8d, [r12 - 4]
lea ecx, [r12 - 0x3c]
mov dword [0x140126bc0], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor ebx, ebx
mov dword [0x140126ba0], 0x2c
mov ecx, ebx
lea rdx, [0x14012b270]
mov dword [0x140126bbc], eax
inc ecx
mov dword [rdx], 0xffffffff
lea rdx, [rdx + 0xc]
movsxd rax, ecx
cmp rax, 8
jb 0x140055540
mov dword [0x140126e7c], 6
mov esi, ebx
lea r14, [0x140126e80]
mov rdi, rbx
lea r15, [0x140000000]
movzx eax, word [rdi + r15 + 0x11d000]
movzx ecx, word [rdi + r15 + 0x11d002]
mov edx, dword [0x140126408]
mov r8d, 0x60
mov dword [rbp + rdi + 0x134], eax
mov dword [rdi + r13 + 0x450], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
inc esi
lea rdi, [rdi + 4]
mov word [r14], ax
cmp esi, dword [0x140126e7c]
lea r14, [r14 + 2]
jl 0x140055572
mov dword [0x1401270cc], 2
mov esi, ebx
lea r14, [0x1401270d0]
mov rdi, rbx
movzx eax, word [rdi + r15 + 0x11d018]
movzx ecx, word [rdi + r15 + 0x11d01a]
mov edx, dword [0x140126408]
mov r8d, 0x60
mov dword [rdi + r13 + 0x6ec], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
inc esi
lea rdi, [rdi + 4]
mov word [r14], ax
cmp esi, dword [0x1401270cc]
lea r14, [r14 + 2]
jl 0x1400555d1
mov dword [0x140127198], 4
mov esi, ebx
lea r14, [0x14012719c]
mov rdi, rbx
nop dword [rax]
movzx eax, word [rdi + r15 + 0x11d020]
movzx ecx, word [rdi + r15 + 0x11d022]
mov edx, dword [0x140126408]
mov r8d, 0x60
mov dword [rdi + r13 + 0x620], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
inc esi
lea rdi, [rdi + 4]
mov word [r14], ax
cmp esi, dword [0x140127198]
lea r14, [r14 + 2]
jl 0x140055630
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.GDI32.dll_GetStockObject]
lea r8, [rsp + 0x50]
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [0x14012640c]
mov r8d, 0x48
lea ecx, [r8 - 0x40]
mov dword [rsp + 0x60], 0x190
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsp + 0x54], ebx
lea rcx, str.SoftwareSysinternalsProcess_Explorer
movaps xmm1, xmmword [rsp + 0x60]
neg eax
movups xmmword [0x140126c08], xmm1
movaps xmm1, xmmword [rbp - 0x80]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x58]
movups xmmword [0x140126c28], xmm1
movsd xmm1, qword [rbp - 0x60]
movaps xmm0, xmmword [rsp + 0x50]
movsd qword [0x140126c48], xmm1
mov dword [0x140126c50], eax
movups xmmword [0x140126bf8], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [0x140126c18], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [0x140126c38], xmm0
call fcn.1400a8238
lea rdx, str.Windowplacement
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14003c810
mov ecx, dword [0x140126bf8]
test ecx, ecx
jle 0x14005574e
mov edx, dword [0x14012640c]
mov r8d, 0x48
call qword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x140126bf8], eax
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareSysinternalsProcess_Explorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400559be
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.Settings
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x6f8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400559be
mov eax, dword [rbp - 0x50]
add eax, 0xfffffe0b
cmp eax, 0x140
ja 0x1400559be
mov r9d, dword [rbp + 0x130]
mov edx, ebx
mov r11d, 0x7cf
test r9d, r9d
jle 0x14005584f
lea rcx, [rbp + 0x588]
lea r8, [rbp + 0x48]
nop dword [rax]
movzx eax, word [r8]
dec ax
cmp ax, r11w
ja 0x140055809
mov eax, dword [rcx]
dec eax
cmp eax, 0xa027
ja 0x140055809
inc edx
add r8, 2
add rcx, 4
cmp edx, r9d
jl 0x1400557e0
jmp 0x14005584f
mov edx, ebx
lea rcx, [rbp + 0x134]
lea r8, [rbp + 0x48]
nop word [rax + rax]
movzx eax, word [r8]
dec ax
cmp ax, r11w
ja 0x1400559be
mov eax, dword [rcx]
dec eax
cmp eax, 0xa027
ja 0x1400559be
inc edx
add r8, 2
add rcx, 4
cmp edx, r9d
jl 0x140055820
mov r9d, dword [rbp + 0x1b4]
mov edx, ebx
test r9d, r9d
jle 0x14005589f
lea rcx, [rbp + 0x1b8]
lea r8, [rbp + 0xc8]
nop dword [rax + rax]
movzx eax, word [r8]
dec ax
cmp ax, r11w
ja 0x1400559be
mov eax, dword [rcx]
dec eax
cmp eax, 0xa027
ja 0x1400559be
inc edx
add r8, 2
add rcx, 4
cmp edx, r9d
jl 0x140055870
mov r10d, dword [rbp + 0x238]
mov r8d, ebx
test r10d, r10d
jle 0x1400558f0
lea rcx, [rbp + 0x23c]
lea r9, [rbp + 0x88]
nop dword [rax]
movzx eax, word [r9]
dec ax
cmp ax, r11w
ja 0x1400559be
mov eax, dword [rcx]
dec eax
cmp eax, 0xa027
ja 0x1400559be
inc r8d
add r9, 2
add rcx, 4
cmp r8d, r10d
jl 0x1400558c0
mov r8d, dword [rsp + 0x30]
lea rdx, [rbp - 0x50]
mov rcx, r13
call fcn.14004f100
mov rcx, qword [rsp + 0x38]
lea rdx, str.Settings
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14012ae1c]
mov ecx, 0xffd0d0
test eax, eax
cmove eax, r12d
mov dword [0x14012ae1c], eax
mov eax, dword [0x14012b240]
test eax, eax
cmove eax, ecx
cmp dword [0x140126f40], ebx
mov dword [0x14012b240], eax
jne 0x1400559be
movups xmm0, xmmword [rbp + 0x134]
movups xmm1, xmmword [rbp + 0x144]
movaps xmmword [0x140126f40], xmm0
movaps xmmword [0x140126f50], xmm1
movups xmm0, xmmword [rbp + 0x154]
movups xmm1, xmmword [rbp + 0x164]
movaps xmmword [0x140126f60], xmm0
movaps xmmword [0x140126f70], xmm1
movups xmm0, xmmword [rbp + 0x174]
movups xmm1, xmmword [rbp + 0x184]
movaps xmmword [0x140126f80], xmm0
movaps xmmword [0x140126f90], xmm1
movups xmm0, xmmword [rbp + 0x194]
movups xmm1, xmmword [rbp + 0x1a4]
movaps xmmword [0x140126fa0], xmm0
movaps xmmword [0x140126fb0], xmm1
cmp dword [0x140126e7c], ebx
mov r14d, ebx
lea r15, [0x140126f40]
jle 0x140055a55
mov r12, r15
cmp dword [r12], 3
jne 0x140055a45
mov ecx, dword [0x140126e7c]
lea eax, [r14 + 1]
lea rdx, [r13 + 0x450]
dec ecx
movsxd rdi, eax
movsxd rsi, r14d
mov dword [0x140126e7c], ecx
sub ecx, r14d
lea rdx, [rdx + rdi*4]
movsxd r8, ecx
lea rcx, [r13 + 0x450]
lea rcx, [rcx + rsi*4]
shl r8, 2
call fcn.1400a7cd0
mov eax, dword [0x140126e7c]
lea rdx, [r13 + 0x390]
sub eax, r14d
lea rcx, [r13 + 0x390]
lea rdx, [rdx + rdi*2]
movsxd r8, eax
lea rcx, [rcx + rsi*2]
add r8, r8
call fcn.1400a7cd0
inc r14d
add r12, 4
cmp r14d, dword [0x140126e7c]
jl 0x1400559d7
or esi, 0xffffffff
cmp dword [0x140126e7c], ebx
mov edi, ebx
jle 0x140055acd
cmp dword [r15], 4
jne 0x140055a74
cmp byte [0x14012ae1a], bl
mov esi, edi
jne 0x140055ac8
jmp 0x140055aba
call fcn.140064600
test al, al
jne 0x140055aba
cmp byte [0x14012ae1a], bl
jne 0x140055aba
mov eax, dword [r15]
sub eax, 0x649
cmp eax, 0x1b
ja 0x140055aba
lea r8, [0x1400d25b0]
lea rdx, str.Note_that_Disk_and_Networking_information_requires_administrative_rights
mov r9d, gethostbyaddr
xor ecx, ecx
mov byte [0x14012ae1a], 1
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, 0xffffffff
jne 0x140055af0
inc edi
add r15, 4
cmp edi, dword [0x140126e7c]
jl 0x140055a62
cmp esi, 0xffffffff
jne 0x140055af0
movsxd rax, edi
mov ecx, 0xc8
mov dword [r13 + rax*4 + 0x450], 4
mov word [r13 + rax*2 + 0x390], cx
inc dword [0x140126e7c]
cmp dword [0x140127264], ebx
jle 0x140055b20
lea rdi, [0x140127268]
nop
movsxd rax, ebx
mov edx, ebx
xor ecx, ecx
imul r8, rax, 0x5f4
add r8, rdi
call fcn.140052aa0
inc ebx
cmp ebx, dword [0x140127264]
jl 0x140055b00
cmp word [0x14012b036], 0
jne 0x140055b44
lea rdx, [0x14012b036]
lea rcx, str._NT_SYMBOL_PATH
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [0x140126bf8]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [0x140126bf8]
movups xmm1, xmmword [0x140126c08]
mov qword [0x140126ac8], rax
mov eax, dword [0x140126c50]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov dword [rbp - 0x58], eax
mov byte [rsp + 0x65], 1
movups xmm0, xmmword [0x140126c18]
movups xmm1, xmmword [0x140126c28]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x140126c38]
movsd xmm1, qword [0x140126c48]
movaps xmmword [rbp - 0x70], xmm0
movsd qword [rbp - 0x60], xmm1
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov rcx, qword [rsp + 0x40]
mov qword [0x140126ad0], rax
call fcn.1400a82b0
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.1400ab140
lea r11, [rsp + 0x7c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret