Function at 0x1400527c0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, dl
mov rsi, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rbp - 0x69], r15d
lea rax, [rcx + 0x138]
mov qword [rbp - 0x31], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x168]
call fcn.140053b40
lea rcx, [rsi + 0x178]
call fcn.140053b40
mov dl, 1
mov rcx, rsi
call fcn.140053460
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [r15 + 0x5c]
mov rcx, qword [rsi + 0x1b8]
call fcn.1400c5214
or r14, 0xffffffffffffffff
test rax, rax
jne 0x14005286d
mov eax, r14d
jmp 0x140052877
sub rax, qword [rsi + 0x1b8]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x51]
lea rcx, [rsi + 0x1b8]
call fcn.140025310
nop
mov r8d, dword [0x1401a9d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xe
jne 0x1400528f7
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400c1e58
mov rcx, rax
call fcn.1400c2f38
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b8]
mov rcx, qword [rsi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140052a06
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi + 0x1b8]
mov rcx, qword [rsi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140052a06
mov edx, eax
lea rcx, [rbp + 7]
call fcn.140048c80
mov rbx, rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401a19a8]
mov rdx, qword [0x1401a19a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rbp - 0x41]
call fcn.1400032d0
cmp qword [rbx + 0x18], 0x10
jb 0x1400529d1
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400032d0
lea r8, [0x140133994]
lea rdx, [0x140133998]
lea rcx, [rbp - 0x41]
call fcn.14000e600
nop
lea rdx, [0x14016ca48]
lea rcx, [rbp - 0x41]
call fcn.1400ca6e8
nop
test r13b, r13b
je 0x140052a49
lea r8, str._ver
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.140019af0
nop
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052a46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
xor esi, esi
mov r15d, esi
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
nop word [rax + rax]
mov dword [rbp - 0x49], 0x7ffe
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7ffe
or eax, ecx
jge 0x140052a9d
mov edx, 0x7ffe
lea rcx, [rbp - 0x61]
call fcn.140002550
mov rbx, qword [rbp - 0x61]
cmp dword [rbx - 0xc], 0x7ffe
jl 0x140052f21
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x49]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400c3494
test eax, eax
js 0x140052f16
cmp eax, dword [rbx - 0xc]
jg 0x140052f16
mov dword [rbx - 0x10], eax
movsxd rcx, eax
mov word [rbx + rcx*2], si
cmp byte [0x1401aa974], 0
jne 0x140052b79
movzx eax, byte [0x1401a4d90]
xor al, 0x59
movzx eax, al
mov word [0x1401a5ad8], ax
movzx eax, byte [0x1401a4d91]
xor al, 0xd
movzx eax, al
mov word [0x1401a5ada], ax
movzx eax, byte [0x1401a4d92]
xor al, 4
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocStringLen], ax
movzx eax, byte [0x1401a4d93]
xor al, 0x12
movzx eax, al
mov word [0x1401a5ade], ax
movzx eax, byte [0x1401a4d94]
xor al, 0xc
movzx eax, al
mov word [0x1401a5ae0], ax
mov byte [0x1401aa974], 1
lea r8, [0x1401a5ad8]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
call fcn.140019af0
nop
or edi, 1
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140052bbe
cmp dword [rbx - 0x10], 0
jl 0x140052bbe
mov rcx, rbx
call fcn.1400c3664
test rax, rax
je 0x140052bbe
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140052cf7
cmp byte [0x1401aa991], 0
jne 0x140052c28
movzx eax, byte [0x1401a4d90]
xor al, 0x59
movzx eax, al
mov word [0x1401a5c68], ax
movzx eax, byte [0x1401a4d91]
xor al, 0xf
movzx eax, al
mov word [0x1401a5c6a], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x17
movzx eax, al
mov word [0x1401a5c6c], ax
movzx eax, byte [0x1401a4d93]
xor al, 9
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantCopy], ax
movzx eax, byte [0x1401a4d94]
mov word [0x1401a5c70], ax
mov byte [0x1401aa991], 1
lea r8, [0x1401a5c68]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x11]
call fcn.140019af0
nop
or edi, 2
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140052c6d
cmp dword [rbx - 0x10], 0
jl 0x140052c6d
mov rcx, rbx
call fcn.1400c3664
test rax, rax
je 0x140052c6d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140052cf7
cmp byte [0x1401aa980], 0
jne 0x140052cb6
movzx eax, byte [0x1401a4d90]
xor al, 0x59
movzx eax, al
mov word [0x1401a5450], ax
movzx eax, byte [0x1401a4d91]
xor al, 0x1d
movzx eax, al
mov word [0x1401a5452], ax
movzx eax, byte [0x1401a4d92]
xor al, 0xa
movzx eax, al
mov word [0x1401a5454], ax
mov byte [0x1401aa980], 1
lea r8, [0x1401a5450]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.140019af0
nop
or edi, 4
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140052cfc
cmp dword [rbx - 0x10], 0
jl 0x140052cfc
mov rcx, rbx
call fcn.1400c3664
test rax, rax
je 0x140052cfc
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140052cfc
mov sil, 1
jmp 0x140052cff
xor sil, sil
test dil, 4
je 0x140052d2f
and edi, 0xfffffffb
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140052d28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 2
je 0x140052d5f
and edi, 0xfffffffd
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140052d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 1
je 0x140052d8f
and edi, 0xfffffffe
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140052d88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test sil, sil
je 0x140052da8
xor esi, esi
mov r15d, esi
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140052dad
inc r15d
xor esi, esi
test r12d, r12d
je 0x140052a70
test r13b, r13b
je 0x140052e67
cmp byte [0x1401aa990], 0
jne 0x140052e16
movzx eax, byte [0x1401a4d90]
xor al, 0x59
movzx eax, al
mov word [0x1401a55e0], ax
movzx eax, byte [0x1401a4d91]
xor al, 0x1f
movzx eax, al
mov word [0x1401a55e2], ax
movzx eax, byte [0x1401a4d92]
mov word [0x1401a55e4], ax
movzx eax, byte [0x1401a4d93]
xor al, 0x14
movzx eax, al
mov word [0x1401a55e6], ax
mov byte [0x1401aa990], 1
lea r8, [0x1401a55e0]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.140019af0
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052e63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x61]
mov r9d, dword [0x1401a9d80]
lea r8d, [r9 + 2]
lea eax, [r9 + 1]
imul r8d, eax
imul r8d, r9d
mov eax, 0x6bca1af3
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 0xb
jne 0x140052eda
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x141
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400c1e58
mov rcx, rax
call fcn.1400c2f38
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052efa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052f12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140052f2c
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c2810
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret