Function at 0x140001930
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x38
mov rbp, rcx
call fcn.14000bd1c
test eax, eax
je 0x140001a6f
lea rbx, [0x140066480]
cmp rbx, 0xffffffffffffffff
je 0x140001987
cmp qword [0x140066480], 0
mov qword [0x14006ccd8], rbx
je 0x140001987
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov cl, 1
call qword [case.0x1400126da.0]
cmp qword [rbx + 0x48], 0
lea rbx, [rbx + 0x48]
jne 0x140001970
mov rbx, qword [0x140066650]
mov rcx, qword [0x140066658]
cmp rbx, rcx
jae 0x1400019c4
nop word [rax + rax]
mov rax, qword [rbx]
test rax, rax
je 0x1400019bb
mov rax, qword [rax + 0x38]
mov cl, 1
call qword [case.0x1400126da.0]
mov rcx, qword [0x140066658]
add rbx, 8
cmp rbx, rcx
jb 0x1400019a0
call fcn.14002f528
cmp dword [rax], 2
jne 0x140001b5c
call fcn.14002f530
lea rdx, str._regserver
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call fcn.14002f628
test eax, eax
jne 0x140001a78
lea rbx, [0x140066510]
mov dword [rsp + 0x28], 0x6c
lea r9d, [rax + 3]
mov qword [rsp + 0x20], rbx
lea r8, str.AccessPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov r9d, 3
mov dword [rsp + 0x28], 0x6c
lea r8, str.LaunchPermission
mov qword [rsp + 0x20], rbx
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
xor r9d, r9d
lea rcx, [0x14006cc90]
lea edx, [r9 + 0x64]
lea r8d, [r9 + 1]
call fcn.140007470
call fcn.140003440
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
call fcn.14002f530
lea rdx, str._unregserver
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call fcn.14002f628
test eax, eax
jne 0x140001b5c
lea r8, str.AccessPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
lea r8, str.LaunchPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
xor r9d, r9d
lea rcx, [0x14006cc90]
xor r8d, r8d
lea edx, [r9 + 0x64]
call fcn.140007470
mov rbx, qword [0x14006ccd8]
test rbx, rbx
je 0x140001b34
cmp qword [rbx], 0
je 0x140001b34
mov rax, qword [rbx + 0x38]
call qword [case.0x1400126da.0]
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.1400029a0
test eax, eax
js 0x140001a6f
mov rax, qword [rbx + 8]
xor ecx, ecx
call qword [case.0x1400126da.0]
test eax, eax
js 0x140001a6f
add rbx, 0x48
cmp qword [rbx], 0
jne 0x140001af6
mov rax, qword [0x14006cad8]
test rax, rax
je 0x140001b4e
call qword [case.0x1400126da.0]
test eax, eax
js 0x140001a6f
call fcn.1400027c0
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
mov rbx, qword [0x14006ccd8]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov edi, r14d
test rbx, rbx
je 0x140001c07
cmp qword [rbx], rdi
je 0x140001c07
test edi, edi
jne 0x140001cbe
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x58], r14
test rax, rax
jne 0x140001ba0
mov edi, r14d
jmp 0x140001bf6
mov rcx, qword [rbx + 0x18]
lea r8, [rsp + 0x58]
lea rdx, [0x14005a1e8]
call qword [case.0x1400126da.0]
mov edi, eax
test eax, eax
js 0x140001bdf
mov rdx, qword [rsp + 0x58]
lea rax, [rbx + 0x28]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov edi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001bf6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400126da.0]
add rbx, 0x48
cmp qword [rbx], r14
jne 0x140001b85
test edi, edi
jne 0x140001cbe
mov rdi, qword [0x140066650]
mov rcx, qword [0x140066658]
mov qword [rsp + 0x50], rsi
mov esi, 1
cmp rdi, rcx
jae 0x140001cb9
test esi, esi
js 0x140001cb9
mov rbx, qword [rdi]
test rbx, rbx
je 0x140001cac
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x58], r14
test rax, rax
jne 0x140001c4b
mov esi, r14d
jmp 0x140001cac
mov rcx, qword [rbx + 0x18]
lea r8, [rsp + 0x58]
lea rdx, [0x14005a1e8]
call qword [case.0x1400126da.0]
mov esi, eax
test eax, eax
js 0x140001c8e
mov rax, qword [rbx + 0x20]
mov r9d, 1
mov rdx, qword [rsp + 0x58]
add rax, 8
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov esi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001ca5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400126da.0]
mov rcx, qword [0x140066658]
add rdi, 8
cmp rdi, rcx
jb 0x140001c28
mov rsi, qword [rsp + 0x50]
mov rcx, rbp
call fcn.14000bec8
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x140001ce4
mov rcx, rbp
call fcn.14000be98
test eax, eax
je 0x140001a6f
mov eax, 1
add rsp, 0x38
pop rbp
pop rbx
ret