Function at 0x18001d620
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
lea rdx, [rbp - 0x31]
mov ecx, 0x2000000
call qword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
js 0x18004115a
lea rdx, [0x18008d598]
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp - 0x31]
lea r8, [rbp - 0x19]
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x49]
lea rax, [rbp - 0x41]
mov dword [rbp - 0x19], 0x30
xorps xmm0, xmm0
mov qword [rbp - 9], rax
mov edx, 0x20019
mov dword [rbp - 1], 0x40
movdqu xmmword [rbp + 7], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
lea rcx, [rbp - 0x41]
test eax, eax
js 0x1800411e9
lea rdx, [0x18008d594]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1f]
mov r8d, 2
mov dword [rsp + 0x20], 0x24
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
je 0x18001d751
lea r8, [rbp + 0x2b]
mov edx, 9
mov rcx, rdi
call fcn.18001d138
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [0x1800aa168]
test byte [rax], 4
je 0x18001d730
mov rcx, rdi
call fcn.18001dbb0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180033470
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
cmp eax, 0x80000005
je 0x18001d6f7
jmp 0x1800411a0
lea rcx, str.00000409
mov ebx, 9
sub rcx, rdi
lea rax, [rbx + 0x7ffffff5]
test rax, rax
je 0x18004118b
movzx eax, word [rcx + rdi]
test ax, ax
je 0x18004118b
mov word [rdi], ax
add rdi, 2
sub rbx, 1
jne 0x180041169
test rbx, rbx
lea rax, [rdi - 2]
cmovne rax, rdi
xor ecx, ecx
mov word [rax], cx
jmp 0x18001d730
lea rcx, str.00000409
mov ebx, 9
sub rcx, rdi
mov rdx, rdi
lea rax, [rbx + 0x7ffffff5]
test rax, rax
je 0x1800411d4
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1800411d4
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1800411b2
test rbx, rbx
lea rax, [rdx - 2]
cmovne rax, rdx
xor ecx, ecx
mov word [rax], cx
jmp 0x18001d708
lea rdx, str.Keyboard_Layout
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp - 0x31]
lea r8, [rbp - 0x19]
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x49]
lea rax, [rbp - 0x41]
mov dword [rbp - 0x19], 0x30
xorps xmm0, xmm0
mov qword [rbp - 9], rax
mov edx, 0xf003f
mov dword [rbp - 1], 0x40
movdqu xmmword [rbp + 7], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x18004127d
lea rcx, str.00000409
mov ebx, 9
sub rcx, rdi
lea rax, [rbx + 0x7ffffff5]
test rax, rax
je 0x18004118b
movzx eax, word [rcx + rdi]
test ax, ax
je 0x18004118b
mov word [rdi], ax
add rdi, 2
sub rbx, 1
jne 0x18004124e
jmp 0x18004118b
lea rdx, str.Active
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1f]
mov r8d, 2
mov dword [rsp + 0x20], 0x24
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x180041314
cmp eax, 0x80000005
je 0x180041314
lea rcx, str.00000409
mov ebx, 9
sub rcx, rdi
lea rax, [rbx + 0x7ffffff5]
test rax, rax
je 0x1800412fb
movzx eax, word [rcx + rdi]
test ax, ax
je 0x1800412fb
mov word [rdi], ax
add rdi, 2
sub rbx, 1
jne 0x1800412d9
test rbx, rbx
lea rax, [rdi - 2]
cmovne rax, rdi
xor ecx, ecx
mov word [rax], cx
mov rcx, qword [rbp - 0x49]
jmp 0x180041456
mov ebx, 9
lea r8, [rbp + 0x2b]
mov edx, ebx
mov rcx, rdi
call fcn.18001d138
mov rax, qword [0x1800aa168]
test byte [rax], 4
je 0x180041371
xor edx, edx
lea r8d, [rbx + 7]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_wcstoul]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x180041359
lea r8, str.E0010411
jmp 0x180041366
cmp ax, 0x12
jne 0x180041371
lea r8, str.E0010412
mov rdx, rbx
mov rcx, rdi
call fcn.18001d138
lea rdx, str.Preload
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp - 0x49]
lea r8, [rbp - 0x19]
xor ecx, ecx
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x41]
mov dword [rbp - 0x19], 0x30
mov qword [rbp - 9], rax
xorps xmm0, xmm0
lea rax, [rbp + 0x17]
mov dword [rbp - 1], 0x40
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], ecx
mov edx, 0x2000f
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
movdqu xmmword [rbp + 7], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
js 0x18004130b
lea rdx, [0x18008d594]
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, 0xffffffffffffffff
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1800413f2
mov rcx, qword [rbp - 0x21]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [rbp - 0x41]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x180041448
lea rdx, str.Active
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x18001d730