Function at 0x140025ab0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov r15, r8
mov r14, rdx
mov r12, rcx
test rcx, rcx
je 0x140025c84
call fcn.14002dca4
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140025b0d
mov ecx, 0x80004005
call fcn.140001900
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x7f], rbx
call fcn.14002dca4
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140025b3e
mov ecx, 0x80004005
call fcn.140001900
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
test r14, r14
jne 0x140025d8d
lea rcx, [rbp - 1]
call fcn.1400417fc
nop
call fcn.14002dca4
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140025b82
mov ecx, 0x80004005
call fcn.140001900
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rax, [0x14020a550]
test rax, 0xffffffffffff0000
jne 0x140025bc2
movzx edi, ax
mov ecx, edi
call fcn.1400402fc
test rax, rax
je 0x140025bd5
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400054e0
jmp 0x140025bd5
mov r8d, 1
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400016b0
nop
mov rdx, r12
lea rcx, [rbp - 0x11]
call fcn.140005640
nop
lea r8, [rbp - 1]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call fcn.140024a10
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140025c17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140025c35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0xf]
cmp rdx, 2
jge 0x140025c8b
lea rcx, [rbp - 1]
call fcn.140041b90
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140025c68
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140025c84
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140025eb5
lea rcx, [rdx - 1]
test rcx, rcx
js 0x140025d87
cmp rcx, rdx
jge 0x140025d87
mov rax, qword [rbp + 7]
mov r9, qword [rax + rcx*8]
lea rcx, [r9 - 0x18]
mov rbx, qword [rbp + 0x7f]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140025d0b
cmp dword [rdi + 0x10], 0
jl 0x140025cf3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140025cf3
call fcn.140001840
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140025ce9
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rbp + 0x7f], rbx
jmp 0x140025d07
mov r8d, dword [r9 - 0x10]
mov rdx, r9
lea rcx, [rbp + 0x7f]
call fcn.1400016b0
mov rbx, qword [rbp + 0x7f]
mov rdx, qword [rbp + 0xf]
mov r12d, r13d
mov rdi, r13
lea rax, [rdx - 1]
test rax, rax
jle 0x140025d7c
nop word [rax + rax]
test r12d, r12d
jle 0x140025d3f
mov r8d, 1
lea rdx, [0x14020a550]
lea rcx, [rbp - 0x29]
call fcn.140005330
mov rdx, qword [rbp + 0xf]
test rdi, rdi
js 0x140025d76
cmp rdi, rdx
jge 0x140025d76
mov rax, qword [rbp + 7]
mov rdx, qword [rax + rdi*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x29]
call fcn.140005330
inc r12d
inc rdi
mov rdx, qword [rbp + 0xf]
lea rcx, [rdx - 1]
movsxd rax, r12d
cmp rax, rcx
jl 0x140025d20
jmp 0x140025d7c
call fcn.14002eedc
nop
lea rcx, [rbp - 1]
call fcn.140041b90
jmp 0x140025daf
call fcn.14002eedc
nop
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rbp - 0x29]
call fcn.1400016b0
mov qword [rbp - 0x21], r13
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [rbp - 0x29]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140025e15
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140025e10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140025c68
test r14, r14
jne 0x140025e29
mov rdx, rbx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140025e69
test r15, r15
jne 0x140025e3d
mov rdx, r14
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140025e69
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete r13b
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140025e96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140025eb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret