Function at 0x140161b44
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xd0
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 7], rax
mov rax, qword [rbp + 0x77]
mov r15, qword [rbp + 0x7f]
mov r13d, r9d
mov r12b, r8b
mov sil, dl
mov rdi, rcx
mov qword [rbp - 0x31], rax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140161bba
test byte [rcx + 0x1c], 0x20
je 0x140161bba
cmp byte [rcx + 0x19], 4
jb 0x140161bba
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400168e8]
mov edx, 0x2d
call fcn.14001dd24
xor ebx, ebx
test r15, r15
jne 0x140161bd9
lea r8, [0x140016738]
lea rcx, [0x140016650]
mov edx, 0x2a5
call fcn.1400a8be8
mov r14, rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rbx
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x41], ebx
mov dword [rbp - 0x59], ebx
mov qword [rbp - 0x51], rbx
mov ebx, CoRevokeClassObject
lea rcx, [rbp - 0x19]
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x29]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rbp - 0x19]
lea rcx, [0x140005780]
call fcn.1400b6bb8
mov ebx, eax
test eax, eax
js 0x140161f8d
lea rdx, [rbp - 0x29]
lea rcx, [0x1400057a8]
call fcn.1400b6bb8
mov ebx, eax
test eax, eax
js 0x140161f8d
lea r8, [rbp - 0x49]
lea rdx, [0x1400167e0]
mov rcx, rdi
call fcn.1400a9ab8
mov r14, qword [rbp - 0x49]
xor edi, edi
mov ebx, eax
test eax, eax
js 0x140161f8f
lea rdx, [0x140016828]
mov r8, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x140161cbc
lea rax, [rbp - 0x69]
mov ebx, 0xf003f
lea rdx, [0x140016828]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x59], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140161ccf
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140161f8f
test sil, sil
jne 0x140161d7e
mov rcx, qword [rbp - 0x69]
lea rax, [rbp - 0x39]
lea rdx, [0x140016760]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140161d43
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x140161d85
test byte [rcx + 0x1c], 0x20
je 0x140161d85
cmp byte [rcx + 0x19], 3
jb 0x140161d85
mov edx, 0x2e
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
lea r8, [0x1400168e8]
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
call fcn.14001de24
jmp 0x140161d85
mov rcx, qword [rbp - 0x39]
lea rdx, [0x1400167c0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140161d7e
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x140161d85
test byte [rcx + 0x1c], 0x20
je 0x140161d85
cmp byte [rcx + 0x19], 3
jb 0x140161d85
mov edx, 0x2f
jmp 0x140161d20
lea rsi, [0x14017d3a8]
mov rcx, qword [rbp - 0x69]
lea rax, [rbp - 0x41]
lea rdx, [0x140016690]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x61]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140161dfb
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140161f8f
test byte [rcx + 0x1c], 0x20
je 0x140161f8f
cmp byte [rcx + 0x19], 2
jb 0x140161f8f
mov edx, 0x30
jmp 0x140161f2f
mov rcx, qword [rbp - 0x61]
lea rdx, [0x140016870]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140161e51
cmp eax, 2
je 0x140161e51
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140161f8f
test byte [rcx + 0x1c], 0x20
je 0x140161f8f
cmp byte [rcx + 0x19], 2
jb 0x140161f8f
mov edx, 0x31
jmp 0x140161f2f
mov r9, qword [rbp - 0x61]
mov r8, qword [rbp - 0x31]
mov edx, r13d
mov cl, r12b
call fcn.140162328
mov ebx, eax
test eax, eax
jns 0x140161e9b
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140161f8f
test byte [rcx + 0x1c], 0x20
je 0x140161f8f
cmp byte [rcx + 0x19], 2
jb 0x140161f8f
mov edx, 0x32
mov r9d, eax
jmp 0x140161f32
lea rcx, [rbp - 9]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x140161ebb
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x140161ec5
mov ebx, 0x80004005
jmp 0x140161f8f
mov rcx, qword [rbp - 0x51]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140161ecd
lea eax, [rax*2 + 2]
lea rdx, [0x140016870]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x61]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140161f44
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140161f8f
test byte [rcx + 0x1c], 0x20
je 0x140161f8f
cmp byte [rcx + 0x19], 2
jb 0x140161f8f
mov edx, 0x33
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400168e8]
call fcn.14001de24
jmp 0x140161f8f
mov rdx, qword [rbp - 0x69]
mov r8b, 1
mov rcx, r15
call fcn.140160b50
mov ebx, eax
test eax, eax
jns 0x140161f8f
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140161f89
test byte [rcx + 0x1c], 1
je 0x140161f89
cmp byte [rcx + 0x19], 2
jb 0x140161f89
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400168e8]
mov edx, UnregisterTraceGuids
mov r9d, eax
call fcn.14001de24
mov ebx, edi
jmp 0x140161f8f
xor edi, edi
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x59], edi
je 0x140161fc6
lea rdx, [0x140016828]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
cmp dword [rbp - 0x19], edi
je 0x140161fea
lea rcx, [rbp - 0x19]
call fcn.1400b6c74
test eax, eax
jns 0x140161fea
xor r9d, r9d
xor r8d, r8d
mov ecx, eax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [rbp - 0x29], edi
je 0x14016200e
lea rcx, [rbp - 0x29]
call fcn.1400b6c74
test eax, eax
jns 0x14016200e
xor r9d, r9d
xor r8d, r8d
mov ecx, eax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea rcx, [rbp - 0x51]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp - 0x51], rdi
test r14, r14
je 0x14016202a
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14016205e
test byte [rcx + 0x1c], 0x20
je 0x14016205e
cmp byte [rcx + 0x19], 4
jb 0x14016205e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400168e8]
mov edx, UnregisterTraceGuids
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret