Function at 0x180006a70
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
movzx eax, byte [rdx]
mov r9, rdx
mov rbx, rcx
cmp al, 0xc9
je case.default.0x180006aa6
add eax, 0xfffffffc
cmp eax, 5
ja case.default.0x180006aa6
lea rcx, [0x180000000]
cdqe
mov edx, dword [rcx + rax*4 + 0x6c74]
add rdx, rcx
jmp rdx
cmp r8d, 6
jb 0x180006ac7
movzx edx, byte [r9 + 2]
mov rcx, rbx
add r9, 4
mov r8, r9
add rsp, 0x50
pop rbx
jmp 0x180007770
xor r9d, r9d
mov dl, 2
mov r8d, r9d
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x180007770
movzx ecx, byte [r9 + 2]
test ecx, ecx
je 0x180006b1d
sub ecx, 1
je 0x180006b14
sub ecx, 1
je 0x180006af9
sub ecx, 1
je 0x180006b0b
cmp ecx, 1
je 0x180006b02
mov rcx, 0xffffffff80000002
jmp 0x180006b24
mov rcx, 0xffffffff80000005
jmp 0x180006b24
mov rcx, 0xffffffff80000003
jmp 0x180006b24
mov rcx, 0xffffffff80000001
jmp 0x180006b24
mov rcx, 0xffffffff80000000
lea rax, [rsp + 0x68]
mov qword [rbx + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rdx, [r9 + 4]
xor r9d, r9d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180006b72
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x38], rax
mov byte [rsp + 0x68], 3
jmp 0x180006b77
mov byte [rsp + 0x68], 2
cmp dword [rbx + 0x18], 0
jne case.default.0x180006aa6
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
add rsp, 0x50
pop rbx
ret
movzx ecx, byte [r9 + 2]
test ecx, ecx
je 0x180006bdd
sub ecx, 1
je 0x180006bd4
sub ecx, 1
je 0x180006bb9
sub ecx, 1
je 0x180006bcb
cmp ecx, 1
je 0x180006bc2
mov rcx, 0xffffffff80000002
jmp 0x180006be4
mov rcx, 0xffffffff80000005
jmp 0x180006be4
mov rcx, 0xffffffff80000003
jmp 0x180006be4
mov rcx, 0xffffffff80000001
jmp 0x180006be4
mov rcx, 0xffffffff80000000
lea rdx, [r9 + 4]
mov qword [rbx + 0x38], rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x180006b72
mov byte [rsp + 0x68], 3
jmp 0x180006b77
lea rdx, [r9 + 1]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x180006df0
movsx ecx, byte [r9 + 1]
test ecx, ecx
je 0x180006c4a
sub ecx, 1
je 0x180006c39
cmp ecx, 2
jne case.default.0x180006aa6
lea rdx, [r9 + 2]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x180007120
lea rdx, [r9 + 2]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x1800072f0
lea rdx, [r9 + 2]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x180006f50
lea rdx, [r9 + 1]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x180006c90
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov rbp, rdx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006cf1
sub ecx, 1
je 0x180006ce7
sub ecx, 1
je 0x180006cc9
sub ecx, 1
je 0x180006cdd
cmp ecx, 1
je 0x180006cd3
mov qword [rsi + 0x38], 0xffffffff80000002
jmp 0x180006cf9
mov qword [rsi + 0x38], 0xffffffff80000005
jmp 0x180006cf9
mov qword [rsi + 0x38], 0xffffffff80000003
jmp 0x180006cf9
mov qword [rsi + 0x38], 0xffffffff80000001
jmp 0x180006cf9
mov qword [rsi + 0x38], 0xffffffff80000000
movsxd rdi, dword [rdx + 1]
movsxd rbx, dword [rdx + 5]
mov rcx, rdi
call fcn.1800092b8
mov r8, rdi
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.18000af10
lea r8, [rdi - 4]
mov rcx, r14
lea rdx, [rbp + 9]
call fcn.18000a860
mov rcx, rbx
call fcn.1800092b8
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.18000af10
lea rdx, [rbp + 9]
mov r8, rbx
add rdx, rdi
mov rcx, r15
call fcn.18000a860
lea rcx, [0x18002b450]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180006dba
lea rdx, str.RegRenameKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180006d9a
mov rcx, qword [rsi + 0x38]
mov r8, r15
mov rdx, r14
call rax
mov ecx, dword [rsi + 0x18]
test eax, eax
je 0x180006d96
mov byte [rsp + 0x48], 3
test ecx, ecx
jmp 0x180006da3
test ecx, ecx
jmp 0x180006d9e
cmp dword [rsi + 0x18], 0
mov byte [rsp + 0x48], 2
jne 0x180006dba
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call fcn.180009248
mov rcx, r15
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.180009248
push rbp
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006e3f
sub ecx, 1
je 0x180006e35
sub ecx, 1
je 0x180006e17
sub ecx, 1
je 0x180006e2b
cmp ecx, 1
je 0x180006e21
mov qword [rbp + 0x38], 0xffffffff80000002
jmp 0x180006e47
mov qword [rbp + 0x38], 0xffffffff80000005
jmp 0x180006e47
mov qword [rbp + 0x38], 0xffffffff80000003
jmp 0x180006e47
mov qword [rbp + 0x38], 0xffffffff80000001
jmp 0x180006e47
mov qword [rbp + 0x38], 0xffffffff80000000
mov edi, dword [rdx + 9]
lea r14, [rdx + 0xd]
movsd xmm0, qword [rdx + 1]
movsd qword [rsp + 0x30], xmm0
test edi, edi
je 0x180006f3c
mov rax, qword [rsp + 0x30]
shr rax, 0x20
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
test eax, eax
je 0x180006ed4
lea rcx, [rax + 2]
call fcn.1800092b8
mov esi, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
mov rbx, rax
lea r8, [rsi + 2]
call fcn.18000af10
mov r8d, esi
mov rdx, r14
mov rcx, rbx
call fcn.18000a860
mov rcx, qword [rbp + 0x38]
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006f12
mov rax, qword [rsp + 0x68]
add r14, rsi
mov qword [rbp + 0x38], rax
lea rcx, [rdi + 2]
call fcn.1800092b8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.18000af10
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.18000a860
mov rcx, qword [rbp + 0x38]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180006f17
mov byte [rsp + 0x68], 2
cmp dword [rbp + 0x18], 0
jne 0x180006f32
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006f9d
sub ecx, 1
je 0x180006f93
sub ecx, 1
je 0x180006f75
sub ecx, 1
je 0x180006f89
cmp ecx, 1
je 0x180006f7f
mov qword [rsi + 0x38], 0xffffffff80000002
jmp 0x180006fa5
mov qword [rsi + 0x38], 0xffffffff80000005
jmp 0x180006fa5
mov qword [rsi + 0x38], 0xffffffff80000003
jmp 0x180006fa5
mov qword [rsi + 0x38], 0xffffffff80000001
jmp 0x180006fa5
mov qword [rsi + 0x38], 0xffffffff80000000
cmp dword [rdx + 9], 0
lea rbp, [rdx + 0xd]
movsd xmm0, qword [rdx + 1]
movsd qword [rsp + 0x30], xmm0
jbe 0x1800070ec
mov rax, qword [rsp + 0x30]
shr rax, 0x20
test eax, eax
je 0x1800070ec
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r14
test eax, eax
jle 0x18000704e
lea rcx, [rax + 2]
mov r14, rax
call fcn.1800092b8
lea r8, [r14 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000af10
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.18000a860
mov rcx, qword [rsi + 0x38]
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800070f3
mov rax, qword [rsp + 0x68]
add rbp, r14
mov rcx, rdi
mov qword [rsi + 0x38], rax
call fcn.180009248
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800092b8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.18000af10
mov r8d, edi
mov rdx, rbp
mov rcx, r14
call fcn.18000a860
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x38]
mov r9d, 1
xor r8d, r8d
mov rdx, r14
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x1800070ba
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x18], 0
jne 0x1800070d5
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call fcn.180009248
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x18], 0
mov byte [rsp + 0x68], 2
jne 0x1800070dd
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1800070dd
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x18000716d
sub ecx, 1
je 0x180007163
sub ecx, 1
je 0x180007145
sub ecx, 1
je 0x180007159
cmp ecx, 1
je 0x18000714f
mov qword [rsi + 0x38], 0xffffffff80000002
jmp 0x180007175
mov qword [rsi + 0x38], 0xffffffff80000005
jmp 0x180007175
mov qword [rsi + 0x38], 0xffffffff80000003
jmp 0x180007175
mov qword [rsi + 0x38], 0xffffffff80000001
jmp 0x180007175
mov qword [rsi + 0x38], 0xffffffff80000000
cmp dword [rdx + 9], 0
lea rbp, [rdx + 0xd]
movsd xmm0, qword [rdx + 1]
movsd qword [rsp + 0x30], xmm0
jbe 0x1800072bc
mov rax, qword [rsp + 0x30]
shr rax, 0x20
test eax, eax
je 0x1800072bc
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r14
test eax, eax
jle 0x18000721e
lea rcx, [rax + 2]
mov r14, rax
call fcn.1800092b8
lea r8, [r14 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000af10
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.18000a860
mov rcx, qword [rsi + 0x38]
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800072c3
mov rax, qword [rsp + 0x68]
add rbp, r14
mov rcx, rdi
mov qword [rsi + 0x38], rax
call fcn.180009248
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800092b8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.18000af10
mov r8d, edi
mov rdx, rbp
mov rcx, r14
call fcn.18000a860
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x38]
mov r9d, 2
xor r8d, r8d
mov rdx, r14
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x18000728a
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x18], 0
jne 0x1800072a5
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call fcn.180009248
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x18], 0
mov byte [rsp + 0x68], 2
jne 0x1800072ad
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1800072ad
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x18000733d
sub ecx, 1
je 0x180007333
sub ecx, 1
je 0x180007315
sub ecx, 1
je 0x180007329
cmp ecx, 1
je 0x18000731f
mov qword [rsi + 0x38], 0xffffffff80000002
jmp 0x180007345
mov qword [rsi + 0x38], 0xffffffff80000005
jmp 0x180007345
mov qword [rsi + 0x38], 0xffffffff80000003
jmp 0x180007345
mov qword [rsi + 0x38], 0xffffffff80000001
jmp 0x180007345
mov qword [rsi + 0x38], 0xffffffff80000000
cmp dword [rdx + 9], 0
lea rbp, [rdx + 0xd]
movsd xmm0, qword [rdx + 1]
movsd qword [rsp + 0x30], xmm0
jbe 0x180007494
mov rax, qword [rsp + 0x30]
shr rax, 0x20
test eax, eax
je 0x180007494
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r14
test eax, eax
jle 0x1800073ee
lea rcx, [rax + 2]
mov r14, rax
call fcn.1800092b8
lea r8, [r14 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000af10
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.18000a860
mov rcx, qword [rsi + 0x38]
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000749b
mov rax, qword [rsp + 0x68]
add rbp, r14
mov rcx, rdi
mov qword [rsi + 0x38], rax
call fcn.180009248
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800092b8
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.18000af10
mov r8d, edi
mov rdx, rbp
mov rcx, r14
call fcn.18000a860
lea rcx, [rdi + rbp]
call fcn.1800144d4
cvttsd2si rcx, xmm0
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180007462
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x18], 0
jne 0x18000747d
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call fcn.180009248
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x18], 0
mov byte [rsp + 0x68], 2
jne 0x180007485
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180007485
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebx, dl
mov rdi, rcx
xor edx, edx
mov r8d, 0x104
add rcx, 0x50
call fcn.18000af10
mov ecx, ebx
test bl, bl
je 0x1800077e0
sub ecx, 1
je 0x1800077d6
sub ecx, 1
je 0x1800077b8
sub ecx, 1
je 0x1800077cc
cmp ecx, 1
je 0x1800077c2
mov qword [rdi + 0x48], 0xffffffff80000002
jmp 0x1800077e8
mov qword [rdi + 0x48], 0xffffffff80000005
jmp 0x1800077e8
mov qword [rdi + 0x48], 0xffffffff80000003
jmp 0x1800077e8
mov qword [rdi + 0x48], 0xffffffff80000001
jmp 0x1800077e8
mov qword [rdi + 0x48], 0xffffffff80000000
test rsi, rsi
je 0x1800077fa
mov rdx, rsi
lea rcx, [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.1800074c0
mov rbx, rax
test rax, rax
jne 0x180007829
mov byte [rsp + 0x38], 2
cmp dword [rdi + 0x18], eax
jne 0x180007852
mov rcx, qword [rdi + 8]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180007852
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [rdi + 0x18], 0
jne 0x180007849
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.1800078d0
mov rbx, rax
test rax, rax
je 0x18000788d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [rdi + 0x18], 0
jne 0x180007882
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800078ad
cmp dword [rdi + 0x18], 0
mov byte [rsp + 0x38], 2
jne 0x1800078ad
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x38]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret