Function at 0x14005c550
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, dl
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rbp - 0x69], r12d
mov eax, dword [0x1401c3d80]
mov r8d, eax
imul r8d, eax
imul r8d, eax
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xb
jne 0x14005c5f5
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [rsi + 0x130]
mov qword [rbp - 0x31], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x160]
call fcn.14005d7e0
lea rcx, [rsi + 0x170]
call fcn.14005d7e0
mov dl, 1
mov rcx, rsi
call fcn.14005d100
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0x5c
mov rcx, qword [rsi + 0x1b0]
call fcn.1400d0438
or r14d, 0xffffffff
test rax, rax
jne 0x14005c659
mov eax, r14d
jmp 0x14005c663
sub rax, qword [rsi + 0x1b0]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x51]
lea rcx, [rsi + 0x1b0]
call fcn.1400274d0
nop
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005c787
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14005c787
mov edx, eax
lea rcx, [rbp + 7]
call fcn.140050f30
mov rbx, rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401bb9a8]
mov rdx, qword [0x1401bb9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rbp - 0x41]
call fcn.140003290
cmp qword [rbx + 0x18], 0x10
jb 0x14005c752
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140003290
lea r8, [0x14014c974]
lea rdx, [0x14014c978]
lea rcx, [rbp - 0x41]
call fcn.14000f7d0
nop
lea rdx, [0x1401867b8]
lea rcx, [rbp - 0x41]
call fcn.1400d5998
nop
test r13b, r13b
je 0x14005c7ca
lea r8, str._ver
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.14001a660
nop
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005c7c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov r15d, r12d
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
jmp 0x14005c7f3
xor r12d, r12d
mov dword [rbp - 0x49], 0x7ffe
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7ffe
or eax, ecx
jge 0x14005c820
mov edx, 0x7ffe
lea rcx, [rbp - 0x61]
call fcn.1400023b0
mov rbx, qword [rbp - 0x61]
cmp dword [rbx - 0xc], 0x7ffe
jl 0x14005cbb9
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x49]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400ce73c
test eax, eax
js 0x14005cbae
cmp eax, dword [rbx - 0xc]
jg 0x14005cbae
mov dword [rbx - 0x10], eax
movsxd rcx, eax
xor eax, eax
mov word [rbx + rcx*2], ax
cmp byte [0x1401c594d], al
jne 0x14005c8fe
movzx eax, byte [0x1401bed90]
xor al, 0x4a
movzx eax, al
mov word [0x1401bfae0], ax
movzx eax, byte [0x1401bed91]
xor al, 6
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysStringLen], ax
movzx eax, byte [0x1401bed92]
xor al, 0xa
movzx eax, al
mov word [0x1401bfae4], ax
movzx eax, byte [0x1401bed93]
xor al, 0x17
movzx eax, al
mov word [0x1401bfae6], ax
movzx eax, byte [0x1401bed94]
xor al, 0x11
movzx eax, al
mov word [0x1401bfae8], ax
mov byte [0x1401c594d], 1
lea r8, [0x1401bfae0]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
call fcn.14001a660
nop
or edi, 1
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14005c943
cmp dword [rbx - 0x10], 0
jl 0x14005c943
mov rcx, rbx
call fcn.1400ce90c
test rax, rax
je 0x14005c943
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x14005c9c7
call fcn.1400568c0
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x11]
call fcn.14001a660
nop
or edi, 2
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14005c985
cmp dword [rbx - 0x10], 0
jl 0x14005c985
mov rcx, rbx
call fcn.1400ce90c
test rax, rax
je 0x14005c985
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x14005c9c7
call fcn.140051f40
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.14001a660
nop
or edi, 4
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14005c9cc
cmp dword [rbx - 0x10], 0
jl 0x14005c9cc
mov rcx, rbx
call fcn.1400ce90c
test rax, rax
je 0x14005c9cc
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14005c9cc
mov sil, 1
jmp 0x14005c9cf
xor sil, sil
test dil, 4
je 0x14005c9ff
and edi, 0xfffffffb
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14005c9f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 2
je 0x14005ca2f
and edi, 0xfffffffd
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14005ca28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 1
je 0x14005ca5f
and edi, 0xfffffffe
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14005ca58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test sil, sil
je 0x14005ca78
xor esi, esi
mov r15d, esi
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14005ca7d
inc r15d
xor esi, esi
test r12d, r12d
je 0x14005c7f0
test r13b, r13b
je 0x14005cb3c
cmp byte [0x1401c596b], 0
jne 0x14005caeb
movzx eax, byte [0x1401bed90]
xor al, 0x4a
movzx eax, al
mov word [0x1401bf598], ax
movzx eax, byte [0x1401bed91]
xor al, 0x14
movzx eax, al
mov word [0x1401bf59a], ax
movzx eax, byte [0x1401bed92]
xor al, 0xe
movzx eax, al
mov word [0x1401bf59c], ax
movzx eax, byte [0x1401bed93]
xor al, 0x11
movzx eax, al
mov word [0x1401bf59e], ax
mov byte [0x1401c596b], 1
lea r8, [0x1401bf598]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.14001a660
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005cb38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x61]
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14005cb72
dec r8d
mov dword [0x1401c3d80], r8d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005cb92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005cbaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14005cbc4
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400cdac0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret