Function at 0x140061240
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, dl
mov rsi, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rbp - 0x69], r15d
lea rax, [rcx + 0x130]
mov qword [rbp - 0x31], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x160]
call fcn.1400627d0
lea rcx, [rsi + 0x170]
call fcn.1400627d0
mov dl, 1
mov rcx, rsi
call fcn.140061e50
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [r15 + 0x5c]
mov rcx, qword [rsi + 0x1b0]
call fcn.1400d6158
or r14, 0xffffffffffffffff
test rax, rax
jne 0x1400612ed
mov eax, r14d
jmp 0x1400612f7
sub rax, qword [rsi + 0x1b0]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x51]
lea rcx, [rsi + 0x1b0]
call fcn.14002bb50
nop
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006141b
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14006141b
mov edx, eax
lea rcx, [rbp + 7]
call fcn.1400550b0
mov rbx, rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
lea rcx, str.__r_
mov rdx, qword [str.__r_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rbp - 0x41]
call fcn.1400034f0
cmp qword [rbx + 0x18], 0x10
jb 0x1400613e6
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400034f0
lea r8, [0x140162598]
lea rdx, [0x14016259c]
lea rcx, [rbp - 0x41]
call fcn.14000fa60
nop
lea rdx, [0x140198300]
lea rcx, [rbp - 0x41]
call fcn.1400db6b8
nop
test r13b, r13b
je 0x14006145e
lea r8, [0x14015fd38]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14001b320
nop
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006145b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
xor esi, esi
mov r15d, esi
call fcn.140055600
test al, al
jne 0x14006148c
lea ecx, [rsi + 4]
call fcn.1400d3fa0
mov rbx, rax
call fcn.1400d41a0
mov dword [rbx], eax
mov dword [0x1401d5d60], eax
mov rcx, rbx
call fcn.1400d37c0
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
nop word [rax + rax]
mov dword [rbp - 0x49], 0x7ffe
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7ffe
or eax, ecx
jge 0x1400614dd
mov edx, 0x7ffe
lea rcx, [rbp - 0x61]
call fcn.140002560
mov rbx, qword [rbp - 0x61]
cmp dword [rbx - 0xc], 0x7ffe
jl 0x140061884
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x49]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4464
test eax, eax
js 0x140061879
cmp eax, dword [rbx - 0xc]
jg 0x140061879
mov dword [rbx - 0x10], eax
movsxd rcx, eax
mov word [rbx + rcx*2], si
call fcn.140058110
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
call fcn.14001b320
nop
or edi, 1
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140061590
cmp dword [rbx - 0x10], 0
jl 0x140061590
mov rcx, rbx
call fcn.1400d4634
test rax, rax
je 0x140061590
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140061614
call fcn.14005ac00
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x11]
call fcn.14001b320
nop
or edi, 2
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400615d2
cmp dword [rbx - 0x10], 0
jl 0x1400615d2
mov rcx, rbx
call fcn.1400d4634
test rax, rax
je 0x1400615d2
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140061614
call fcn.1400562f0
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.14001b320
nop
or edi, 4
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140061619
cmp dword [rbx - 0x10], 0
jl 0x140061619
mov rcx, rbx
call fcn.1400d4634
test rax, rax
je 0x140061619
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140061619
mov sil, 1
jmp 0x14006161c
xor sil, sil
test dil, 4
je 0x14006164c
and edi, 0xfffffffb
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140061645
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 2
je 0x14006167c
and edi, 0xfffffffd
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140061675
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 1
je 0x1400616ac
and edi, 0xfffffffe
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400616a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test sil, sil
je 0x1400616c5
xor esi, esi
mov r15d, esi
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400616ca
inc r15d
xor esi, esi
test r12d, r12d
je 0x1400614b0
test r13b, r13b
je 0x140061789
cmp byte [0x1401d7a03], 0
jne 0x140061738
movzx eax, byte [0x1401d0d90]
xor al, 0x48
movzx eax, al
mov word [0x1401d19a0], ax
movzx eax, byte [0x1401d0d91]
xor al, 0x13
movzx eax, al
mov word [0x1401d19a2], ax
movzx eax, byte [0x1401d0d92]
xor al, 0xb
movzx eax, al
mov word [0x1401d19a4], ax
movzx eax, byte [0x1401d0d93]
xor al, 0x13
movzx eax, al
mov word [0x1401d19a6], ax
mov byte [0x1401d7a03], 1
lea r8, [0x1401d19a0]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.14001b320
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140061785
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x61]
mov ecx, dword [0x1401d5d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x10
jne 0x1400617d6
call fcn.1400d41a0
mov ecx, dword [0x1401d5d60]
cmp ecx, eax
jne 0x1400617d6
dec ecx
mov dword [0x1401d5d60], ecx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401d5d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xd
jne 0x140061848
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006185d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140061875
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14006188f
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400d37e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret