Function at 0x140004e50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rsp - 0x1f70]
mov eax, 0x2070
call fcn.140008fc0
sub rsp, rax
mov rax, qword [0x14000e008]
xor rax, rsp
mov qword [rbp + 0x1f60], rax
mov rbx, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000521d
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400051e2
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r13d, r13d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x140004f20
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400064a0
nop
mov r11, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140004f48
mov rbx, qword [rbx]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
cmp r11, rdi
ja 0x14000516c
mov rax, rdi
sub rax, r11
test r11, r11
jne 0x140004f7a
mov rax, r13
jmp 0x140005008
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop dword [rax + rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov rdx, r13
je 0x140004fba
cmp word [rax], r10w
je 0x140004fb7
cmp rcx, 1
je 0x140004fba
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140004fa4
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000516c
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140004ff8
mov r9, rax
sub r9, rbx
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x14000513a
add rdx, 2
sub r8, 1
jne 0x140004fe0
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000516c
inc r11
cmp rdi, rax
jb 0x140005280
mov rcx, rdi
sub rcx, rax
cmp rcx, r11
cmovb r11, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rdi, r11
mov r8, rdi
sub r8, rax
lea r8, [r8*2 + 2]
lea rdx, [rcx + r11*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x40]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x58]
cmp r8, 8
cmovae rax, rdx
cmp word [rax], 0x3b
jne 0x1400050ae
mov eax, 1
cmp rdi, rax
cmovb rax, rdi
lea rcx, [rsp + 0x40]
cmp r8, 8
cmovae rcx, rdx
sub rdi, rax
lea r8, [rdi*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rdi
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x40]
cmp r8, 8
cmovae rax, rdx
lea rcx, [rdi - 1]
cmp word [rax + rcx*2], 0x3b
jne 0x1400050f5
cmp rdi, rcx
jb 0x140005280
lea rax, [rsp + 0x40]
cmp r8, 8
cmovae rax, rdx
mov qword [rsp + 0x50], rcx
mov word [rax + rcx*2], r13w
mov r8, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
lea eax, [rdi*2 + 2]
lea rcx, [rsp + 0x40]
cmp r8, 8
cmovae rcx, rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140005143
lea rdx, str.Successfully_removed_DLL_path_from_system_PATH.
jmp 0x140005173
add rax, 2
jmp 0x140004f90
lea rdx, str.Failed_to_set_new_PATH_variable:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005bc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
jmp 0x14000517f
lea rdx, str.The_specified_DLL_path_was_not_found_in_the_system_PATH.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140005bc0
lea rdx, [0x140005d90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140005210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400051d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008160
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005254
lea rdx, str.Failed_to_read_PATH_variable:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005bc0
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140005d90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005254
lea rdx, str.Failed_to_open_registry:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005bc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140005d90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1f60]
xor rcx, rsp
call fcn.140008140
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.140005840
nop
int3