Function at 0x14000b750
Capabilities:
Delete registry key
Delete registry value
Get common file path
Read .ini file
Set registry value

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x140043468]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
lea rcx, [rbp + 0x392]
xor r13d, r13d
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x390], r13w
call fcn.14001dd20
lea r8d, [r13 + 0x23]
lea rdx, [rbp + 0x390]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x14000be1e
lea r8, str.AtherosAtherosServiceConfig.ini
lea rcx, [rbp + 0x390]
mov edx, 0x104
call fcn.14001aecc
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x60], r13d
mov word [rsp + 0x70], r13w
call fcn.14001dd20
lea r11, [rbp + 0x390]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rdx, str.regOpType
lea rcx, str.AthService
xor r8d, r8d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rsp + 0x70]
lea rdx, str.regPath
mov ebx, eax
lea rax, [rbp + 0x390]
lea rcx, str.AthService
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000be1e
test ebx, ebx
je 0x14000be1e
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x8e8], rdi
call fcn.14001b778
lea r8d, [r13 + 0x11]
lea rdx, str.HKEY_CLASSES_ROOT
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x60], eax
call fcn.14001aae0
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000b8a4
mov rdi, 0xffffffff80000000
mov r9d, 0xf2
lea r8, [rbp - 0x6c]
jmp 0x14000b930
lea rdx, str.HKEY_CURRENT_USER
mov r8d, 0x11
call fcn.14001aae0
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000b8d2
mov rdi, 0xffffffff80000001
mov r9d, 0xf2
lea r8, [rbp - 0x6c]
jmp 0x14000b930
lea rdx, str.HKEY_LOCAL_MACHINE
mov r8d, 0x12
call fcn.14001aae0
lea rcx, [rsp + 0x70]
test eax, eax
jne 0x14000b900
mov rdi, 0xffffffff80000002
mov r9d, 0xf1
lea r8, [rbp - 0x6a]
jmp 0x14000b930
lea rdx, str.HKEY_USERS
mov r8d, 0xa
call fcn.14001aae0
test eax, eax
jne 0x14000be01
mov rdi, 0xffffffff80000003
mov r9d, 0xf9
lea r8, [rbp - 0x7a]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.14001b85c
mov r8d, dword [rsp + 0x60]
mov qword [rsp + 0x8f0], r12
mov eax, r8d
test r8d, r8d
je 0x14000bce4
dec eax
je 0x14000bc2a
dec eax
je 0x14000bbb8
dec eax
je 0x14000b97f
lea rdx, str.Unknown_operation_type__0x_x
mov ecx, 2
call fcn.14001a330
xor eax, eax
jmp 0x14000bbff
lea rcx, [rbp + 0x182]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x180], r13w
call fcn.14001dd20
lea rcx, [rbp + 0x5a2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x5a0], r13w
call fcn.14001dd20
lea rax, [rbp + 0x390]
lea r9, [rbp + 0x180]
mov qword [rsp + 0x28], rax
lea rdx, str.regValue
lea rcx, str.AthService
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
mov dword [rsp + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x14000ba08
lea rdx, str.Unknown_registry_value
lea ecx, [rax + 2]
call fcn.14001a330
xor eax, eax
jmp 0x14000bbff
lea rax, [rbp + 0x390]
lea r9, [rsp + 0x50]
lea rdx, str.regType
mov qword [rsp + 0x28], rax
lea rcx, str.AthService
xor r8d, r8d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x14000ba52
lea rdx, str.Unknown_registry_type
lea ecx, [rax + 2]
call fcn.14001a330
xor eax, eax
jmp 0x14000bbff
lea rcx, [rsp + 0x50]
call fcn.14001b778
lea r9, [rbp + 0x5a0]
lea rdx, str.regData
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x390]
lea rcx, str.AthService
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r12d, eax
test eax, eax
je 0x14000bbfa
lea rax, [rsp + 0x64]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rcx, rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000bbfa
mov eax, dword [rsp + 0x50]
dec eax
je 0x14000bb7a
sub eax, 2
je 0x14000bb12
dec eax
jne 0x14000bb80
lea rcx, [rbp + 0x5a0]
call fcn.14001b778
mov r12d, 4
mov dword [rbp + 0x5a0], eax
jmp 0x14000bb80
test r12d, r12d
je 0x14000bb80
mov qword [rsp + 0x8e0], rsi
lea rbx, [rbp + 0x5a0]
lea rdi, [rbp + 0x5a0]
mov rsi, r12
xor eax, eax
lea r8, [rsp + 0x6c]
lea rdx, [0x140036dd8]
mov word [rsp + 0x6a], ax
movzx eax, word [rdi]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], ax
mov dword [rsp + 0x6c], r13d
call fcn.14001b740
movzx r11d, byte [rsp + 0x6c]
inc rbx
add rdi, 2
dec rsi
mov byte [rbx - 1], r11b
jne 0x14000bb30
mov rsi, qword [rsp + 0x8e0]
jmp 0x14000bb80
mov r12d, 0x104
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x5a0]
lea rdx, [rbp + 0x180]
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000bbfa
lea rax, [rsp + 0x64]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rcx, rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bdf1
mov eax, 1
mov r12, qword [rsp + 0x8f0]
mov rdi, qword [rsp + 0x8e8]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14001a650
add rsp, 0x8c0
pop r13
pop rbx
pop rbp
ret
lea rcx, [rbp + 0x182]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x180], r13w
call fcn.14001dd20
lea r11, [rbp + 0x390]
mov qword [rsp + 0x28], r11
lea r9, [rbp + 0x180]
lea rdx, str.regValue
lea rcx, str.AthService
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bbfa
lea rax, [rsp + 0x64]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rcx, rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000bbfa
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000bbfa
lea rcx, [rbp + 0x182]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x180], r13w
call fcn.14001dd20
lea rcx, [rsp + 0x70]
mov edx, 0x5c
call fcn.14001b488
mov rbx, rax
test rax, rax
jne 0x14000bd33
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov r8d, 0x300
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x14000bbfa
mov edx, 0x5c
mov rcx, rax
call fcn.14001b488
test rax, rax
je 0x14000bd66
nop word [rax + rax]
lea rbx, [rax + 2]
mov edx, 0x5c
mov rcx, rbx
call fcn.14001b488
test rax, rax
jne 0x14000bd50
lea rcx, [rbp + 0x180]
sub rcx, rbx
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14000bd70
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14000bbfa
lea rax, [rsp + 0x64]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rcx, rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000bbfa
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x180]
xor r9d, r9d
mov r8d, 0x300
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000bbfa
lea r8, [rsp + 0x70]
lea rdx, str.Unknown_registry_path___s
mov ecx, 2
call fcn.14001a330
xor eax, eax
jmp 0x14000bc07
xor eax, eax
jmp 0x14000bc0f