Function at 0x14009e288
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x458]
sub rsp, 0x558
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov eax, r8d
mov qword [rsp + 0x78], rdx
mov rbx, r9
mov dword [rsp + 0x60], eax
and eax, 1
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x5c], eax
mov r13, rdx
neg eax
mov rsi, rcx
lea rax, [rsp + 0x48]
sbb r9d, r9d
mov qword [rsp + 0x20], rax
and r9d, 0x10006
xor r8d, r8d
add r9d, 0x20019
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x14009e63d
lea rdx, [0x140300bb8]
mov rcx, rbx
mov r8, rdx
lea r9, [rsp + 0x68]
mov r14d, r15d
call qword [sym.imp.api_ms_win_shcore_comhelpers_l1_1_0.dll_IUnknown_QueryService]
nop dword [rax + rax]
test byte [0x14037dc81], 0x40
je 0x14009e346
mov r8, r13
lea rdx, [0x140300bd8]
call fcn.14004251c
mov edi, r15d
mov r12d, 0x104
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x230]
mov dword [rsp + 0x54], Ordinal_86
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x80]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x28], rax
mov edx, edi
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
cmp eax, 0xea
je 0x14009e636
test eax, eax
je 0x14009e50b
cmp eax, 0x103
mov ebx, 1
cmovne ebx, r15d
mov dword [rsp + 0x64], ebx
test r14, r14
je 0x14009e4a5
mov edi, 0x200
lea rcx, [rbp + 0x20]
mov r8d, edi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r12, 0xffffffff80000002
cmp rsi, r12
jne 0x14009e41c
or eax, 0xffffffff
mov dword [rsp + 0x20], 1
mov r9d, eax
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov edx, eax
mov r8, r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x1401739f7
movsxd r12, dword [r14]
test r12, r12
jle 0x14009e49d
mov ebx, dword [rsp + 0x5c]
xor esi, esi
mov r13, qword [rsp + 0x70]
mov rax, qword [r14 + 8]
mov rdi, qword [rax + r15*8]
test ebx, ebx
jne 0x140173a3c
cmp word [rbp + 0x20], si
jne 0x140173a6b
xor eax, eax
mov r9d, dword [rsp + 0x60]
lea rsi, [rdi + 0x208]
mov qword [rsp + 0x28], rax
lea r8, [rdi + 0x410]
mov rdx, rsi
mov qword [rsp + 0x20], r13
mov rcx, rdi
call fcn.14009d824
test ebx, ebx
jne 0x140173b08
xor esi, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
inc r15
cmp r15, r12
jl 0x14009e42f
mov ebx, dword [rsp + 0x64]
mov r13, qword [rsp + 0x78]
mov rcx, r14
call fcn.140063460
test byte [0x14037dc81], 0x40
je 0x14009e4bd
mov r8, r13
lea rdx, [0x140300bc8]
call fcn.14004251c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14009e4e5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006c37f.0]
mov eax, ebx
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x558
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, dword [rsp + 0x40]
lea eax, [rdx - 1]
cmp eax, 1
ja 0x14009e636
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14009e542
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov rax, qword [rax + 0x20]
call qword [case.0x14006c37f.0]
test eax, eax
je 0x14009e636
mov edx, dword [rsp + 0x40]
cmp edx, 2
jne 0x14009e589
lea r8, [rbp + 0x230]
mov rdx, r12
lea rcx, [rbp + 0x20]
call fcn.14003dd20
test eax, eax
js 0x14009e636
mov r8d, r12d
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_SHExpandEnvironmentStringsW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x14009e636
mov ecx, reloc.SHELL32.dll_Shell_MergeMenus
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
jne 0x1401739d2
mov edx, 0x618
mov ecx, Shell_MergeMenus
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14009e636
mov r8, r13
mov rdx, r12
mov rcx, rax
call fcn.14003dd20
test eax, eax
js 0x14009e636
lea rcx, [rbx + 0x208]
mov rdx, r12
lea r8, [rbp - 0x80]
call fcn.14003dd20
test eax, eax
js 0x14009e636
lea rcx, [rbx + 0x410]
mov rdx, r12
lea r8, [rbp + 0x230]
call fcn.14003dd20
test eax, eax
js 0x14009e636
test r14, r14
jne 0x14009e61d
lea ecx, [r14 + 5]
call fcn.140035320
mov r14, rax
test rax, rax
je 0x1401739e2
mov r8, rbx
mov edx, 0x7fffffff
mov rcx, r14
call fcn.140037314
cmp eax, 0xffffffff
je 0x1401739e2
inc edi
jmp 0x14009e34f
mov ebx, r15d
jmp 0x14009e4e5
cmp word [rbp - 0x80], 0x2a
jne 0x14009e636
jmp 0x14009e5a2
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
jmp 0x14009e636
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x30], rax
lea r8, str.FirstRequiresUserInput
lea rax, [rbp + 0x20]
mov r9d, 0x20000002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBE
mov rcx, r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
nop
jmp 0x14009e41c
lea rdx, [rdi + 0x208]
cmp word [rdx], 0x21
je 0x14009e43f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009e47d
jmp 0x14009e43f
or eax, 0xffffffff
mov dword [rsp + 0x20], 1
mov r9d, eax
lea rcx, [rdi + 0x208]
mov edx, eax
lea r8, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
jne 0x14009e449
lea edx, [rax - 1]
xor ecx, ecx
mov r8d, edx
lea r9, str.ShellDesktopSwitchEvent
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140173adc
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea r8, str.FirstRequiresUserInput
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
xor eax, eax
mov word [rbp + 0x20], ax
jmp 0x14009e44b
cmp word [rsi], 0x21
jne 0x14009e47b
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
nop
jmp 0x14009e47b