Function at 0x140073240
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, qword [0x14023b0d0]
xor r13d, r13d
test cl, cl
je 0x140073465
nop
test rbx, rbx
jne 0x14007328f
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
jmp 0x1400732cd
mov rdx, qword [0x1402418e8]
lea rcx, [rbx + 0x12]
mov rsi, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], r13w
test rsi, rsi
je 0x1400732cd
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.140188690
xor eax, eax
lock cmpxchg qword [0x1402447c8], r13
mov rbx, rax
je 0x1400732e3
lock inc dword [rax - 8]
jmp 0x140073306
mov rcx, qword [0x140241948]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rbx, rax
xor eax, eax
lock cmpxchg qword [0x1402447c8], rbx
jne 0x140073306
lock inc dword [rbx - 8]
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetBaseDirectory
mov rsi, rax
mov r12d, 0xffffffff
test rdi, rdi
je 0x140073332
lea rcx, [rdi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140073332
call fcn.1400fbcc0
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetBaseName
mov rdi, rax
test rbx, rbx
je 0x14007335b
lea rcx, [rbx - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14007335b
call fcn.1400fbcc0
mov r9, qword [rdi + 8]
lea r8, [0x1401b84cc]
mov rdx, qword [rsi + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r14, rax
lea rcx, [rdi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14007338d
call fcn.1400fbcc0
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400733a5
nop
call fcn.1400fbcc0
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x17]
mov dword [rsp + 0x28], r13d
mov r9, r14
mov edx, 0x20006
mov dword [rsp + 0x20], 0x80
mov r8, 0xfffffffffffffffd
call sym.ProcessHacker.exe_PhCreateKey
mov ebx, eax
test eax, eax
js 0x140073459
mov rcx, qword [0x14023b5c8]
movabs rax, 0x1111011100111000
mov qword [rbp + 0x1f], rax
mov word [rbp - 0x39], cx
lea eax, [rcx + 2]
mov word [rbp - 0x37], ax
mov rax, qword [str.MitigationOptions]
mov qword [rbp - 0x31], rax
cmp rcx, 0xfffe
jbe 0x140073425
mov rcx, qword [rbp + 0x17]
mov ebx, 0xc0000106
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r14 - 0x10]
jmp 0x14007376a
mov rcx, qword [rbp + 0x17]
lea rax, [rbp + 0x1f]
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x39]
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x17]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, ds:[r14 - 0x10]
jmp 0x14007376a
test rbx, rbx
jne 0x140073474
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
jmp 0x1400734b4
mov rdx, qword [0x1402418e8]
lea rcx, [rbx + 0x12]
mov rsi, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], r13w
test rsi, rsi
je 0x1400734b4
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.140188690
xor eax, eax
lock cmpxchg qword [0x1402447c8], r13
mov rbx, rax
je 0x1400734ca
lock inc dword [rax - 8]
jmp 0x1400734ec
mov rcx, qword [0x140241948]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rbx, rax
xor eax, eax
lock cmpxchg qword [0x1402447c8], rbx
jne 0x1400734ec
lock inc dword [rbx - 8]
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetBaseDirectory
mov rsi, rax
mov r12d, 0xffffffff
test rdi, rdi
je 0x14007351b
lea rcx, [rdi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14007351b
call fcn.1400fbcc0
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetBaseName
mov r14, rax
test rbx, rbx
je 0x140073545
lea rcx, [rbx - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140073545
nop
call fcn.1400fbcc0
mov r9, qword [r14 + 8]
lea r8, [0x1401b84cc]
mov rdx, qword [rsi + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rdi, rax
mov qword [rbp - 0x41], rax
lea rcx, [r14 - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14007357b
call fcn.1400fbcc0
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140073591
call fcn.1400fbcc0
movzx eax, word [rdi]
mov word [rbp - 0x29], ax
add ax, 2
cmp qword [rdi], 0xfffe
mov word [rbp - 0x27], ax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x21], rax
jbe 0x1400735bb
mov ebx, 0xc0000106
jmp 0x140073766
lea rax, [rbp - 0x49]
mov r8d, 0x80
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x29]
mov rcx, 0xfffffffffffffffd
call fcn.14011ab40
mov ebx, eax
test eax, eax
js 0x140073626
lea r8, [rbp - 0x19]
mov edx, 0x10000
lea rcx, [rbp + 0x17]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword ds:[rbp - 0x49]
mov ebx, eax
test rcx, rcx
je 0x14007360b
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140073626
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword ds:[rbp + 0x17]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, 0xc0000034
jne 0x140073633
mov ebx, r13d
jmp 0x14007363b
test ebx, ebx
js 0x140073766
movups xmm0, xmmword [rdi]
mov r8b, 1
lea rdx, [0x14023b0e0]
mov rcx, rdi
movups xmmword [rbp - 0x59], xmm0
call sym.ProcessHacker.exe_PhFindStringInStringRef
cmp rax, 0xffffffffffffffff
je 0x140073766
mov rsi, qword ds:[rbp - 0x59]
lea r14, [rax + rax]
mov rdi, qword [rbp - 0x51]
sub rsi, r14
sub rsi, qword [0x14023b0e0]
mov rdx, qword [0x1402418e8]
mov qword [rsp + 0x100], r15
lea r15, [r14 + rdi]
add r15, qword [0x14023b0e0]
lea rbx, [r14 + rsi]
add rbx, qword [0x14023b5b8]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, r14
mov qword [rbp - 0x59], rax
mov rdx, rdi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.140188690
mov r8, qword [0x14023b5b8]
add rbx, r14
mov rdx, qword [str.SoftwareWOW6432Node_]
mov rcx, rbx
call fcn.140188690
add rbx, qword [0x14023b5b8]
mov r8, rsi
mov rcx, rbx
mov rdx, r15
call fcn.140188690
mov rcx, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x59]
mov r15, qword [rsp + 0x100]
mov rdi, rbx
test rcx, rcx
je 0x14007372a
add rcx, 0xfffffffffffffff0
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007372a
call fcn.1400fbcc0
mov r9, rbx
mov dword [rsp + 0x20], 0x80
mov edx, 0x10000
lea rcx, [rbp + 0x17]
mov r8, 0xfffffffffffffffd
call sym.ProcessHacker.exe_PhOpenKey
mov ebx, eax
test eax, eax
js 0x140073766
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rbp + 0x17]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14007377b
call fcn.1400fbcc0
cmp ebx, 0xc0000034
cmovne r13d, ebx
mov eax, r13d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret