Function at 0x140033920
Capabilities:
Delete registry value
Impersonate user
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rax + 0x20], 1
mov dword [rax + 0x18], 0x20
xor r13d, r13d
mov qword [rsp + 0x38], r13
xor edx, edx
mov r8d, 0x103
lea rcx, [rax - 0x147]
call fcn.14007cd30
mov byte [rsp + 0x60], r13b
xor eax, eax
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
lea rcx, [rsp + 0x54]
lea r8, [0x140000000]
mov eax, dword [r8 + 0xb46a0]
mov dword [rcx], eax
movzx eax, byte [r8 + 0xb46a4]
mov byte [rcx + 4], al
mov ebx, r13d
mov dword [rsp + 0x30], ebx
mov r15, r13
mov qword [rsp + 0x40], 0xffffffff80000001
mov r14, r13
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x218], r13d
mov r12d, r13d
lea rdx, [rsp + 0xc0]
mov rax, qword [r8 + 0xb4688]
mov qword [rdx], rax
mov rax, qword [r8 + 0xb4690]
mov qword [rdx + 8], rax
mov eax, dword [r8 + 0xb4698]
mov dword [rdx + 0x10], eax
movzx eax, byte [r8 + 0xb469c]
mov byte [rdx + 0x14], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140033aa3
lea rax, [rsp + 0x220]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x228]
xor r8d, r8d
lea rdx, str.Command_Line_option_for_DAL
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140033a8f
lea r12d, [r13 + 1]
lea rcx, str.GetCommandLineOption__:_Bootup_registry_key_deleted_n
call fcn.14000cbb0
lea rdx, str.Command_Line_option_for_DAL
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
jne 0x140033cfc
mov ecx, 0x104
call fcn.14007de00
mov r15, rax
test rax, rax
je 0x140033d8d
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14007cd30
xor r11d, r11d
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r11
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], r11
mov qword [rsp + 0xa8], r11
mov qword [rsp + 0xb0], r11
mov qword [rsp + 0x48], r13
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.14002ece0
test eax, eax
jne 0x140033b30
lea rcx, str.ImpersonateTheUser__GetCurrentUserInfo_failed
call fcn.14000cbb0
mov r14, qword [rsp + 0x48]
jmp 0x140033beb
mov r14, qword [rsp + 0x48]
test r14, r14
jne 0x140033b4b
lea rcx, str.ImpersonateTheUser__GetCurrentUserInfo_returns_NULL_hToken
call fcn.14000cbb0
jmp 0x140033bf7
mov dword [rsp + 0x80], 0x38
mov qword [rsp + 0x88], r15
lea rdx, [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x140033b92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Fail_to_LoadUserProfile___d
call fcn.14000cbb0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140033beb
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140033bc5
lea rcx, str.ImpersonateLoggedOnUser_success_n
call fcn.14000cbb0
mov dword [rsp + 0x218], 1
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
jmp 0x140033bf7
lea rcx, str.Fail_to_impersonate
call fcn.14000cbb0
mov rdx, qword [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.GetCommandLineOption____ImpersonateTheUser_failed_n
call fcn.14000cbb0
mov dword [rsp + 0x30], r13d
lea rcx, str.GetCommandLineOption____Access_Registry_n
call fcn.14000cbb0
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
je 0x140033c88
lea rcx, str.GetCommandLineOption____impersonating_current_user_n
call fcn.14000cbb0
lea rdx, [rsp + 0x40]
mov ecx, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x140033c84
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x140033ce1
lea rax, [rsp + 0x220]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x228]
xor r8d, r8d
lea rdx, str.Command_Line_option_for_DAL
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140033cd6
lea r12d, [rax + 1]
lea rdx, str.Command_Line_option_for_DAL
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 0
je 0x140033cf3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
je 0x140033d99
mov ebx, 1
mov rdi, r13
nop
nop
nop
movsx r12d, byte [rsp + rdi + 0x54]
mov edx, r12d
lea rcx, [rsp + 0x60]
call fcn.14007eac4
test rax, rax
jne 0x140033d2d
mov ebx, r13d
jmp 0x140033d6c
lea rcx, [rax + 1]
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.14007ef20
test eax, eax
cmove ebx, r13d
mov cl, r12b
cmp r12b, 0x42
je 0x140033d69
cmp cl, 0x48
je 0x140033d64
cmp cl, 0x4a
je 0x140033d5f
cmp cl, 0x56
jne 0x140033d6c
mov dword [rsi + 8], eax
jmp 0x140033d6c
mov dword [rsi + 0x10], eax
jmp 0x140033d6c
mov dword [rsi + 4], eax
jmp 0x140033d6c
mov dword [rsi + 0xc], eax
add rdi, 1
cmp rdi, 4
jl 0x140033d10
jmp 0x140033da5
lea rcx, str.GetCommandLineOption____new_char__MAX_PATH__failed_n
call fcn.14000cbb0
lea rcx, str.failed_to_get_boot_up_option_n
call fcn.14000cbb0
cmp dword [rsp + 0x218], 0
je 0x140033ddf
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x140033dc5
lea rcx, str.__Failed_to_revert_
call fcn.14000cbb0
mov rdx, qword [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140033df0
mov rcx, r15
call fcn.14007ddf8
mov eax, ebx
jmp 0x140033df2
mov eax, ebx
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret