Function at 0x1800066f0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
sub rsp, 0x28
movzx eax, byte [rdx]
mov r10d, r8d
mov r9, rcx
cmp al, 0xc9
je case.default.0x180006728
movzx eax, al
add eax, 0xfffffffc
cmp eax, 5
ja case.default.0x180006728
lea rcx, [0x180000000]
cdqe
mov r8d, dword [rcx + rax*4 + 0x67d4]
add r8, rcx
jmp r8
mov rcx, r9
cmp r10d, 6
jb 0x180006745
lea r8, [rdx + 4]
movzx edx, byte [rdx + 2]
add rsp, 0x28
jmp 0x180007400
xor r8d, r8d
mov dl, 2
add rsp, 0x28
jmp 0x180007400
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180007080
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180006fe0
inc rdx
mov rcx, r9
add rsp, 0x28
jmp 0x180006940
movsx ecx, byte [rdx + 1]
test ecx, ecx
je 0x1800067b3
dec ecx
je 0x1800067a3
cmp ecx, 2
jne case.default.0x180006728
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180006c50
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180006e10
add rdx, 2
mov rcx, r9
add rsp, 0x28
jmp 0x180006a90
inc rdx
mov rcx, r9
call fcn.1800067f0
add rsp, 0x28
ret
push rbp
push rdi
push r12
sub rsp, 0x40
mov rbp, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x18000698b
dec ecx
je 0x180006981
dec ecx
je 0x180006963
dec ecx
je 0x180006977
dec ecx
je 0x18000696d
mov qword [rbp + 0x30], 0xffffffff80000002
jmp 0x180006993
mov qword [rbp + 0x30], 0xffffffff80000005
jmp 0x180006993
mov qword [rbp + 0x30], 0xffffffff80000003
jmp 0x180006993
mov qword [rbp + 0x30], 0xffffffff80000001
jmp 0x180006993
mov qword [rbp + 0x30], 0xffffffff80000000
mov edi, dword [rdx + 9]
mov rax, qword [rdx + 1]
lea r12, [rdx + 0xd]
mov qword [rsp + 0x30], rax
test edi, edi
je 0x180006a81
shr rax, 0x20
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
test eax, eax
je 0x180006a19
lea rcx, [rax + 2]
call fcn.1800082ac
mov esi, dword [rsp + 0x34]
xor edx, edx
lea r8, [rsi + 2]
mov rcx, rax
mov rbx, rax
call fcn.18000b160
mov r8d, esi
mov rdx, r12
mov rcx, rbx
call fcn.180008300
mov rcx, qword [rbp + 0x30]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006a57
mov rax, qword [rsp + 0x68]
add r12, rsi
mov qword [rbp + 0x30], rax
lea rcx, [rdi + 2]
call fcn.1800082ac
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.18000b160
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.180008300
mov rcx, qword [rbp + 0x30]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180006a5c
mov byte [rsp + 0x68], 2
cmp dword [rbp + 0x10], 0
jne 0x180006a77
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rbp
ret
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006ad9
dec ecx
je 0x180006acf
dec ecx
je 0x180006ab1
dec ecx
je 0x180006ac5
dec ecx
je 0x180006abb
mov qword [rsi + 0x30], 0xffffffff80000002
jmp 0x180006ae1
mov qword [rsi + 0x30], 0xffffffff80000005
jmp 0x180006ae1
mov qword [rsi + 0x30], 0xffffffff80000003
jmp 0x180006ae1
mov qword [rsi + 0x30], 0xffffffff80000001
jmp 0x180006ae1
mov qword [rsi + 0x30], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x180006c1f
shr rax, 0x20
test eax, eax
je 0x180006c1f
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x180006b84
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800082ac
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000b160
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180008300
mov rcx, qword [rsi + 0x30]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006c26
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x30], rax
call fcn.180008dd0
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800082ac
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.18000b160
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180008300
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x30]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180006bed
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x10], 0
jne 0x180006c08
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r12
call fcn.180008dd0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x10], 0
mov byte [rsp + 0x68], 2
jne 0x180006c10
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180006c10
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006c99
dec ecx
je 0x180006c8f
dec ecx
je 0x180006c71
dec ecx
je 0x180006c85
dec ecx
je 0x180006c7b
mov qword [rsi + 0x30], 0xffffffff80000002
jmp 0x180006ca1
mov qword [rsi + 0x30], 0xffffffff80000005
jmp 0x180006ca1
mov qword [rsi + 0x30], 0xffffffff80000003
jmp 0x180006ca1
mov qword [rsi + 0x30], 0xffffffff80000001
jmp 0x180006ca1
mov qword [rsi + 0x30], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x180006ddf
shr rax, 0x20
test eax, eax
je 0x180006ddf
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x180006d44
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800082ac
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000b160
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180008300
mov rcx, qword [rsi + 0x30]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006de6
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x30], rax
call fcn.180008dd0
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800082ac
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.18000b160
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180008300
add rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi + 0x30]
mov r9d, 2
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180006dad
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x10], 0
jne 0x180006dc8
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r12
call fcn.180008dd0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x10], 0
mov byte [rsp + 0x68], 2
jne 0x180006dd0
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180006dd0
push rbp
push rsi
sub rsp, 0x48
mov rsi, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x180006e59
dec ecx
je 0x180006e4f
dec ecx
je 0x180006e31
dec ecx
je 0x180006e45
dec ecx
je 0x180006e3b
mov qword [rsi + 0x30], 0xffffffff80000002
jmp 0x180006e61
mov qword [rsi + 0x30], 0xffffffff80000005
jmp 0x180006e61
mov qword [rsi + 0x30], 0xffffffff80000003
jmp 0x180006e61
mov qword [rsi + 0x30], 0xffffffff80000001
jmp 0x180006e61
mov qword [rsi + 0x30], 0xffffffff80000000
cmp dword [rdx + 9], 0
mov rax, qword [rdx + 1]
lea rbp, [rdx + 0xd]
mov qword [rsp + 0x30], rax
jbe 0x180006faa
shr rax, 0x20
test eax, eax
je 0x180006faa
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
test eax, eax
jle 0x180006f04
lea rcx, [rax + 2]
mov r12, rax
call fcn.1800082ac
lea r8, [r12 + 2]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.18000b160
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.180008300
mov rcx, qword [rsi + 0x30]
lea r11, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006fb1
mov rax, qword [rsp + 0x68]
mov rcx, rdi
add rbp, r12
mov qword [rsi + 0x30], rax
call fcn.180008dd0
mov edi, dword [rsp + 0x34]
lea rcx, [rdi + 2]
call fcn.1800082ac
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.18000b160
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.180008300
lea rcx, [rdi + rbp]
call fcn.180009088
lea rax, [rsp + 0x68]
mov r9d, 4
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], 4
cvttsd2si rcx, xmm0
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsi + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [rsp + 0x68], 3
test eax, eax
je 0x180006f78
mov byte [rsp + 0x68], 2
cmp dword [rsi + 0x10], 0
jne 0x180006f93
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r12
call fcn.180008dd0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbp
ret
cmp dword [rsi + 0x10], 0
mov byte [rsp + 0x68], 2
jne 0x180006f9b
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180006f9b
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov rbx, rcx
test r8d, r8d
je 0x18000702e
dec r8d
je 0x180007024
dec r8d
je 0x180007006
dec r8d
je 0x18000701a
dec r8d
je 0x180007010
mov qword [rcx + 0x30], 0xffffffff80000002
jmp 0x180007036
mov qword [rcx + 0x30], 0xffffffff80000005
jmp 0x180007036
mov qword [rcx + 0x30], 0xffffffff80000003
jmp 0x180007036
mov qword [rcx + 0x30], 0xffffffff80000001
jmp 0x180007036
mov qword [rcx + 0x30], 0xffffffff80000000
mov rcx, qword [rcx + 0x30]
add rdx, 2
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [rsp + 0x30], 3
test eax, eax
je 0x180007052
mov byte [rsp + 0x30], 2
cmp dword [rbx + 0x10], 0
jne 0x18000706d
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x50
mov rbx, rcx
movzx ecx, byte [rdx]
test ecx, ecx
je 0x1800070c8
dec ecx
je 0x1800070be
dec ecx
je 0x1800070a0
dec ecx
je 0x1800070b4
dec ecx
je 0x1800070aa
mov qword [rbx + 0x30], 0xffffffff80000002
jmp 0x1800070d0
mov qword [rbx + 0x30], 0xffffffff80000005
jmp 0x1800070d0
mov qword [rbx + 0x30], 0xffffffff80000003
jmp 0x1800070d0
mov qword [rbx + 0x30], 0xffffffff80000001
jmp 0x1800070d0
mov qword [rbx + 0x30], 0xffffffff80000000
mov rcx, qword [rbx + 0x30]
lea rax, [rsp + 0x60]
add rdx, 2
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000711f
mov rax, qword [rsp + 0x68]
mov byte [rsp + 0x60], 3
mov qword [rbx + 0x30], rax
jmp 0x180007124
mov byte [rsp + 0x60], 2
cmp dword [rbx + 0x10], 0
jne 0x18000713f
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x60]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebx, dl
mov rdi, rcx
xor edx, edx
mov r8d, 0x104
add rcx, 0x48
call fcn.18000b160
mov r11d, ebx
test bl, bl
je 0x180007471
dec r11d
je 0x180007467
dec r11d
je 0x180007449
dec r11d
je 0x18000745d
dec r11d
je 0x180007453
mov qword [rdi + 0x40], 0xffffffff80000002
jmp 0x180007479
mov qword [rdi + 0x40], 0xffffffff80000005
jmp 0x180007479
mov qword [rdi + 0x40], 0xffffffff80000003
jmp 0x180007479
mov qword [rdi + 0x40], 0xffffffff80000001
jmp 0x180007479
mov qword [rdi + 0x40], 0xffffffff80000000
test rsi, rsi
je 0x18000748b
lea rcx, [rdi + 0x48]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.180007150
mov rbx, rax
test rax, rax
jne 0x1800074ba
mov byte [rsp + 0x38], 2
cmp dword [rdi + 0x10], eax
jne 0x1800074e3
mov rcx, qword [rdi + 8]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1800074e3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [rdi + 0x10], 0
jne 0x1800074da
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.180007560
mov rbx, rax
test rax, rax
je 0x18000751e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [rdi + 0x10], 0
jne 0x180007513
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000753e
cmp dword [rdi + 0x10], 0
mov byte [rsp + 0x38], 2
jne 0x18000753e
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x38]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret