Function at 0x140062b10
Capabilities:
Delete registry value
Get disk size
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, dl
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rbp - 0x69], r12d
lea rax, [rcx + 0x130]
mov qword [rbp - 0x31], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x160]
call fcn.140063df0
lea rcx, [rsi + 0x170]
call fcn.140063df0
mov dl, 1
mov rcx, rsi
call fcn.140063740
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [r12 + 0x5c]
mov rcx, qword [rsi + 0x1b0]
call fcn.1400d7948
or r15, 0xffffffffffffffff
test rax, rax
jne 0x140062bbe
mov eax, r15d
jmp 0x140062bc8
sub rax, qword [rsi + 0x1b0]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x51]
lea rcx, [rsi + 0x1b0]
call fcn.14002b820
nop
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140062d6a
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140062cec
mov edx, eax
lea rcx, [rbp + 7]
call fcn.140056a30
mov rbx, rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
lea rcx, str.D_r_
mov rdx, qword [str.D_r_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rbp - 0x41]
call fcn.140003940
cmp qword [rbx + 0x18], 0x10
jb 0x140062cb7
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140003940
lea r8, [0x14016362c]
lea rdx, [0x140163630]
lea rcx, [rbp - 0x41]
call fcn.14000fca0
nop
lea rdx, [0x1401997e8]
lea rcx, [rbp - 0x41]
call fcn.1400dccd8
nop
mov esi, dword [0x1401d6d80]
lea ecx, [rsi + 2]
lea eax, [rsi + 1]
imul ecx, eax
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 2
jne 0x140062d6a
mov r8d, 0x94
mov r11d, r12d
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
nop dword [rax]
test ebx, ebx
jle 0x140062d62
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r12d
mov r10, rbx
test eax, eax
jle 0x140062d5a
mov ecx, r9d
mov edx, eax
nop
add r8d, ecx
dec ecx
dec rdx
jne 0x140062d50
add r9d, r11d
dec r10
jne 0x140062d45
inc r11d
cmp r11d, r8d
jl 0x140062d30
test r13b, r13b
je 0x140062dad
lea r8, [0x140160e50]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14001b580
nop
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140062daa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov r14d, r12d
call fcn.140056dd0
test al, al
jne 0x140062dce
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
mov eax, dword [0x1401d6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
mov eax, dword [0x1401d85c8]
mov edx, 0x6c9fe324
cmp ecx, 4
cmove eax, edx
mov dword [0x1401d85c8], eax
jmp 0x140062e33
xor r12d, r12d
mov dword [rbp - 0x49], 0x7ffe
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7ffe
or eax, ecx
jge 0x140062e60
mov edx, 0x7ffe
lea rcx, [rbp - 0x61]
call fcn.140002760
mov rbx, qword [rbp - 0x61]
cmp dword [rbx - 0xc], 0x7ffe
jl 0x1400631c1
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x49]
mov r8, rbx
mov edx, r14d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d5a84
test eax, eax
js 0x1400631b6
cmp eax, dword [rbx - 0xc]
jg 0x1400631b6
mov dword [rbx - 0x10], eax
movsxd rcx, eax
xor eax, eax
mov word [rbx + rcx*2], ax
cmp byte [0x1401d89cb], al
jne 0x140062f3e
movzx eax, byte [0x1401d1da0]
xor al, 0x47
movzx eax, al
mov word [0x1401d2420], ax
movzx eax, byte [0x1401d1da1]
xor al, 0x11
movzx eax, al
mov word [0x1401d2422], ax
movzx eax, byte [0x1401d1da2]
xor al, 0xc
movzx eax, al
mov word [0x1401d2424], ax
movzx eax, byte [0x1401d1da3]
xor al, 0x15
movzx eax, al
mov word [0x1401d2426], ax
movzx eax, byte [0x1401d1da4]
xor al, 0xe
movzx eax, al
mov word [0x1401d2428], ax
mov byte [0x1401d89cb], 1
lea r8, [0x1401d2420]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
call fcn.14001b580
nop
or edi, 1
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140062f83
cmp dword [rbx - 0x10], 0
jl 0x140062f83
mov rcx, rbx
call fcn.1400d5c54
test rax, rax
je 0x140062f83
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140063007
call fcn.14005c640
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x11]
call fcn.14001b580
nop
or edi, 2
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140062fc5
cmp dword [rbx - 0x10], 0
jl 0x140062fc5
mov rcx, rbx
call fcn.1400d5c54
test rax, rax
je 0x140062fc5
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140063007
call fcn.140057b80
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.14001b580
nop
or edi, 4
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14006300c
cmp dword [rbx - 0x10], 0
jl 0x14006300c
mov rcx, rbx
call fcn.1400d5c54
test rax, rax
je 0x14006300c
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14006300c
mov sil, 1
jmp 0x14006300f
xor sil, sil
test dil, 4
je 0x14006303a
and edi, 0xfffffffb
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140063033
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 2
je 0x140063065
and edi, 0xfffffffd
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006305e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 1
je 0x140063090
and edi, 0xfffffffe
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140063089
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test sil, sil
je 0x1400630a9
xor esi, esi
mov r14d, esi
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400630ae
inc r14d
xor esi, esi
test r12d, r12d
je 0x140062e30
test r13b, r13b
je 0x14006310e
call fcn.1400577b0
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.14001b580
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006310a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x61]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401d6d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xa
jne 0x140063185
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006319a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400631b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400631cc
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400d4e00
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret