Function at 0x14004c7a4
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov r13b, dl
mov byte [rsp + 0x50], dl
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x54], r14d
lea rax, [rcx + 0x138]
mov qword [rbp - 0x78], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x168]
call fcn.14004dcd8
lea rcx, [rsi + 0x178]
call fcn.14004dcd8
mov dl, 1
mov rcx, rsi
call fcn.14004d61c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
lea ebx, [r14 + 7]
cmp r8d, 1
jne 0x14004c895
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401aad80]
test rax, rax
cmove ecx, ebx
mov dword [0x1401aad80], ecx
lea rbx, [rsi + 0x1b8]
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1400c0294
or r15, 0xffffffffffffffff
test rax, rax
jne 0x14004c8b7
mov eax, r15d
jmp 0x14004c8bd
sub rax, qword [rbx]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14002358c
nop
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 4
jne 0x14004c903
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r12d, 0x2001f
mov r9d, r12d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004ca91
mov edx, dword [0x1401aad80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub r8d, eax
cmp r8d, 3
jne 0x14004c9ac
mov rax, qword [str.scDKFACqyjRz]
mov qword [rbp - 0x60], rax
mov eax, dword [0x14013de90]
mov dword [rbp - 0x58], eax
mov al, byte [0x14013de94]
mov byte [rbp - 0x54], al
lea rax, [rbp - 0x60]
mov rcx, r15
inc rcx
cmp byte [rax + rcx], r14b
jne 0x14004c987
mov eax, 4
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
test eax, eax
je 0x14004ca93
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.140041ff8
mov rbx, rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], rax
lea rcx, [0x1401a29a8]
mov rdx, qword [0x1401a29a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x78], rax
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rsp + 0x78]
call fcn.140002fb8
lea r15d, [rsi + 0x10]
cmp qword [rbx + 0x18], r15
jb 0x14004ca5a
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140002fb8
lea r8, [0x140138614]
lea rdx, [0x140138618]
lea rcx, [rsp + 0x78]
call fcn.14000da50
nop
lea rdx, [0x14016d588]
lea rcx, [rsp + 0x78]
call fcn.1400c57f8
nop
xor esi, esi
test r13b, r13b
je 0x14004cae1
lea r8, str._ver
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.140019018
nop
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14004cadd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x54]
mov r14d, esi
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov r12d, 0x7ffe
mov dword [rsp + 0x70], r12d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14004cb2d
mov edx, r12d
lea rcx, [rsp + 0x58]
call fcn.140002210
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0xc], r12d
jl 0x14004d089
mov dword [rbx - 0x10], r12d
mov word [rbx + 0xfffc], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400be514
test eax, eax
js 0x14004d07e
cmp eax, dword [rbx - 0xc]
jg 0x14004d07e
mov dword [rbx - 0x10], eax
movsxd rcx, eax
mov word [rbx + rcx*2], si
call fcn.140042160
test al, al
jne 0x14004cbe3
mov rax, qword [str.7i0P3Dfv]
mov qword [rbp - 0x70], rax
mov al, byte [0x14013da78]
mov byte [rbp - 0x68], al
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp byte [rax + rcx], sil
jne 0x14004cbbe
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
cmp byte [0x1401acf42], sil
jne 0x14004cc8a
mov dword [rbp + 0xb8], 0x10004c
mov dword [rbp + 0xbc], 0x170008
mov dword [rbp + 0xc0], 7
mov rcx, rsi
lea r13, [0x1401a5da0]
lea rdx, [0x1401a66e0]
movzx eax, byte [rcx + r13]
xor ax, word [rbp + rcx*2 + 0xb8]
mov word [rdx + rcx*2], ax
inc rcx
cmp rcx, 5
jl 0x14004cc1f
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
mov eax, dword [0x1401acaf8]
mov ecx, 0x82e0253e
cmp r8d, 3
cmove eax, ecx
mov dword [0x1401acaf8], eax
mov byte [0x1401acf42], 1
mov r13b, byte [rsp + 0x50]
lea r8, [0x1401a66e0]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x50]
call fcn.140019018
nop
or edi, 1
mov dword [rsp + 0x54], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004ccd3
cmp dword [rbx - 0x10], esi
jl 0x14004ccd3
mov rcx, rbx
call fcn.1400be6e4
test rax, rax
je 0x14004ccd3
sub rax, rbx
sar rax, 1
or rcx, 0xffffffffffffffff
cmp eax, ecx
jne 0x14004cea1
cmp byte [0x1401acf28], sil
jne 0x14004cda1
mov dword [rbp + 0xc8], 0x12004c
mov dword [rbp + 0xcc], 0xc001b
mov dword [rbp + 0xd0], 0xb
mov rcx, rsi
lea r13, [0x1401a5da0]
lea rdx, [0x1401a6378]
movzx eax, byte [rcx + r13]
xor ax, word [rbp + rcx*2 + 0xc8]
mov word [rdx + rcx*2], ax
inc rcx
cmp rcx, 5
jl 0x14004cd0f
mov byte [0x1401acf28], 1
mov ecx, dword [0x1401aad80]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 0x8000000f
mov r13b, byte [rsp + 0x50]
jge 0x14004cd4f
dec eax
or eax, 0xfffffff0
inc eax
mov edx, 7
cmp eax, edx
jne 0x14004cda1
mov r8d, esi
mov r9d, 0x8c08c08d
mov r10d, 0xf3
jmp 0x14004cd7d
mov eax, ecx
or eax, 0xfffffff1
add ecx, eax
inc r8d
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14004cd9a
mov eax, r9d
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x75
mov eax, ecx
sub eax, edx
cmp eax, r10d
jne 0x14004cd69
mov dword [0x1401aad80], r8d
lea r8, [0x1401a6378]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140019018
nop
or edi, 2
mov dword [rsp + 0x54], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004cdea
cmp dword [rbx - 0x10], esi
jl 0x14004cdea
mov rcx, rbx
call fcn.1400be6e4
test rax, rax
je 0x14004cdea
sub rax, rbx
sar rax, 1
or rcx, 0xffffffffffffffff
cmp eax, ecx
jne 0x14004cea1
cmp byte [0x1401acf4f], sil
jne 0x14004ce5c
mov dword [rbp + 0xb0], 0x4c
mov dword [rbp + 0xb4], 6
mov rcx, rsi
lea r13, [0x1401a5da0]
lea rdx, [0x1401a69c8]
movzx eax, byte [rcx + r13]
xor ax, word [rbp + rcx*2 + 0xb0]
mov word [rdx + rcx*2], ax
inc rcx
cmp rcx, 3
jl 0x14004ce18
mov byte [0x1401acf4f], 1
call fcn.1400421dc
test al, al
mov r13b, byte [rsp + 0x50]
jne 0x14004ce5c
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea r8, [0x1401a69c8]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x48]
call fcn.140019018
nop
or edi, 4
mov dword [rsp + 0x54], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004cea6
cmp dword [rbx - 0x10], esi
jl 0x14004cea6
mov rcx, rbx
call fcn.1400be6e4
or rcx, 0xffffffffffffffff
test rax, rax
je 0x14004ceaa
sub rax, rbx
sar rax, 1
cmp eax, ecx
je 0x14004ceaa
mov sil, 1
jmp 0x14004ceaa
or rcx, 0xffffffffffffffff
test dil, 4
je 0x14004cede
and edi, 0xfffffffb
mov dword [rsp + 0x54], edi
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x14004ced5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x54]
mov rbx, qword [rsp + 0x58]
test dil, 2
je 0x14004cf23
and edi, 0xfffffffd
mov dword [rsp + 0x54], edi
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x14004cf18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov edi, dword [rsp + 0x54]
jmp 0x14004cf23
mov rbx, qword [rsp + 0x58]
mov edi, dword [rsp + 0x54]
jmp 0x14004cf27
or rcx, 0xffffffffffffffff
test dil, 1
je 0x14004cf5b
and edi, 0xfffffffe
mov dword [rsp + 0x54], edi
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x14004cf52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x54]
mov rbx, qword [rsp + 0x58]
test sil, sil
je 0x14004cf75
xor esi, esi
mov r14d, esi
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14004cf7a
inc r14d
xor esi, esi
test r12d, r12d
mov r12d, 0x7ffe
je 0x14004cb04
test r13b, r13b
je 0x14004cfef
call fcn.140042af0
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.140019018
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14004cfe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
jmp 0x14004cff3
or rdi, 0xffffffffffffffff
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
mov eax, 0xb
cmp ecx, eax
jne 0x14004d034
dec r8d
mov dword [0x1401aad80], r8d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14004d05b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14004d07a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004d094
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80070057
call fcn.140001874
nop
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret