Function at 0x100042c30
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov rbx, r8
mov r14d, edx
mov r15, rcx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.10003cdb4
nop
lea rcx, [rsp + 0x40]
call fcn.100020360
nop
lea rcx, [rsp + 0xc8]
call fcn.1000193b8
nop
lea esi, [rbp + 1]
mov dword [rsp + 0x38], esi
and dword [rdi], ebp
mov r13, qword [rbx]
test r13, r13
je 0x100042eb2
mov r12d, dword [rsp + 0x158]
xor esi, esi
cmp ebp, esi
jne 0x100042f41
lea rcx, [rsp + 0x30]
call fcn.100020360
nop
mov eax, esi
cmp r13, rsi
setne al
cmp eax, esi
je 0x100042ea7
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001f050
xor r11d, r11d
lea rdi, [0x10000e568]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x100042d0c
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
jne 0x100042d2d
lea rdx, [0x10000f900]
lea ecx, [rsi + 3]
call fcn.100054fd8
mov ebp, esi
mov dword [rsp + 0x38], esi
jmp 0x100042dea
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.100020390
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.10003cf1c
cmp eax, 0xb7
je 0x100042d68
mov ebp, esi
jmp 0x100042dea
lea rax, [rsp + 0x40]
cmp rax, rsi
jne 0x100042d7f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100042d97
lea r8, [rsp + 0x40]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.10003d2d8
cmp eax, esi
jne 0x100042d9b
mov ebp, esi
jmp 0x100042dea
mov r12d, 0x57
mov dword [rsp + 0x50], esi
cmp r14d, 1
je 0x100042dce
cmp r14d, 1
jle 0x100042de8
cmp r14d, 4
jg 0x100042de8
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.100040c74
mov r12d, eax
jmp 0x100042de3
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1000407b0
mov r12d, eax
cmp r12d, esi
je 0x100042e49
mov ebp, esi
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8d, r12d
lea rdx, [0x10000fa70]
mov ecx, 3
call fcn.100054fd8
xor r11d, r11d
lea rdi, [0x10000e568]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x100042e28
sbb r11d, r11d
sbb r11d, 0xffffffff
xor esi, esi
cmp r11d, esi
je 0x100042e60
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.10001f8e0
mov rdi, qword [rsp + 0x158]
jmp 0x100042e72
mov ebp, 1
cmp dword [rsp + 0x50], esi
je 0x100042e6a
mov rdi, qword [rsp + 0x158]
mov dword [rdi], ebp
jmp 0x100042e72
mov rdi, qword [rsp + 0x158]
jmp 0x100042e72
mov rdi, qword [rsp + 0x158]
cmp dword [rsp + 0x80], esi
je 0x100042e86
lea rcx, [rsp + 0x58]
call fcn.10003d1ac
nop
lea rcx, [rsp + 0x30]
call fcn.10002006c
cmp r13, rsi
jne 0x100042cb2
cmp ebp, esi
jne 0x100042f49
mov esi, dword [rsp + 0x38]
jmp 0x100042eb2
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov r8, qword [r15]
lea rdx, [0x10000fb00]
mov r13d, 3
mov ecx, r13d
call fcn.100054fd8
test esi, esi
je 0x1000432a5
lea rdx, [0x10000fb80]
mov ecx, r13d
call fcn.100054fd8
xor esi, esi
mov dword [rsp + 0x158], esi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.100020390
nop
lea r8, [rsp + 0x158]
mov edx, r14d
mov rcx, rax
call fcn.10004055c
cmp eax, esi
jne 0x100042f2f
lea rdx, [0x10000fbd0]
mov ecx, r13d
call fcn.100054fd8
mov ebp, esi
jmp 0x1000432aa
mov ebp, 1
cmp dword [rsp + 0x158], esi
je 0x100042f4f
mov dword [rdi], ebp
jmp 0x100042f4f
mov r13d, 3
jmp 0x100042f4f
mov r13d, 3
cmp qword [rsp + 0xd8], rsi
je 0x1000432aa
lea rcx, [rsp + 0x38]
call fcn.100020360
nop
mov rbx, qword [rsp + 0xc8]
cmp rbx, rsi
je 0x100043127
mov r12, qword [rsp + 0x150]
lea rcx, [rsp + 0x158]
call fcn.100020360
nop
mov eax, esi
cmp rbx, rsi
setne al
cmp eax, esi
je 0x10004311c
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x158]
call fcn.10001f050
lea rdx, [rsp + 0x158]
mov rcx, r12
call fcn.10003ccb4
lea rcx, [rsp + 0x98]
call fcn.1000193b8
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x48]
call fcn.100020390
nop
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.10003cf1c
lea rdx, [rsp + 0x98]
cmp rdx, rsi
jne 0x10004301b
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100043032
lea r8, [rsp + 0x98]
mov edx, 0xa
lea rcx, [rsp + 0x58]
call fcn.10003d658
cmp dword [rsp + 0x80], esi
je 0x100043045
lea rcx, [rsp + 0x58]
call fcn.10003d1ac
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x1000430ea
lea rcx, [rsp + 0x150]
call fcn.100020360
nop
xor eax, eax
test rsi, rsi
setne al
test eax, eax
je 0x100043111
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x150]
call fcn.10001f050
mov rdx, qword [rsp + 0x150]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.10001fec8
test rsi, rsi
jne 0x1000430ab
test rbx, rbx
je 0x1000430d4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x10000fc5c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x10000fc5c]
lea rcx, [rsp + 0x38]
call fcn.10001fec8
nop
lea rcx, [rsp + 0x150]
call fcn.10002006c
test rsi, rsi
jne 0x100043056
lea rcx, [rsp + 0x98]
call fcn.10001f994
nop
lea rcx, [rsp + 0x158]
call fcn.10002006c
xor esi, esi
cmp rbx, rsi
je 0x10004312f
jmp 0x100042f81
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov r12, qword [rsp + 0x150]
mov r8, qword [rsp + 0x38]
cmp dword [r8 - 0x10], esi
jle 0x100043149
lea rdx, [0x10000fc70]
mov ecx, r13d
call fcn.100054fd8
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x150]
call fcn.100020360
nop
lea rdx, [0x10000e5b0]
lea rcx, [rsp + 0x158]
call fcn.100020428
nop
lea r8, [rsp + 0x150]
mov rdx, r15
lea rcx, [rsp + 0x158]
call fcn.100032a84
nop
lea rcx, [rsp + 0x158]
call fcn.10002006c
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100043279
cmp qword [r12 + 0x10], rsi
je 0x100043245
lea rdx, [rsp + 0x158]
mov rcx, r12
call fcn.100035004
mov rdi, rax
cmp rax, rsi
je 0x100043232
mov eax, dword [rsp + 0x158]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x10000e598]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x100043228
mov ebp, esi
lea rdx, [0x10000fdf0]
mov ecx, r13d
call fcn.100054fd8
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10004326c
mov ebp, esi
lea rdx, [0x10000fdf0]
mov ecx, r13d
call fcn.100054fd8
jmp 0x10004326c
lea rdx, [0x10000e598]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10004326c
mov ebp, esi
lea rdx, [0x10000fdf0]
mov ecx, r13d
call fcn.100054fd8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004328b
mov ebp, esi
lea rdx, [0x10000fdf0]
mov ecx, r13d
call fcn.100054fd8
nop
lea rcx, [rsp + 0x150]
call fcn.10002006c
nop
lea rcx, [rsp + 0x38]
call fcn.10002006c
jmp 0x1000432aa
mov ebp, 1
lea rcx, [rsp + 0xc8]
call fcn.10001f994
nop
lea rcx, [rsp + 0x40]
call fcn.10002006c
nop
lea rcx, [rsp + 0x58]
call fcn.10003ce68
nop
mov rcx, r15
call fcn.10002006c
mov eax, ebp
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret