Function at 0x6c645dd0
Capabilities:
Check for peb beingdebugged flag
Delete registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov r12, rcx
cmp edx, 0x110
je 0x6c645e20
cmp edx, 0x111
je 0x6c645ff0
cmp edx, 0x4e
je 0x6c645fb0
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x965
call qword [sym.imp.user32.dll_GetDlgItem]
lea rdx, [rsp + 0x60]
mov r13, rax
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowRect]
mov eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x60]
xor r8d, r8d
lea r9, [rsp + 0x70]
mov edx, 0x1061
mov rcx, r13
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x78], eax
mov rsi, qword [sym.imp.user32.dll_SendMessageW]
call rsi
mov dword [rsp + 0x20], 0
mov r9d, 4
mov r8d, 5
mov edx, 0x10
mov ecx, 0x10
call qword [sym.imp.comctl32.dll_ImageList_Create]
mov rbx, rax
test rax, rax
je 0x6c645ef7
mov rcx, qword [0x6c663008]
mov edx, 0xcc
call qword [sym.imp.user32.dll_LoadBitmapW]
mov r8d, 0xff00ff
mov rcx, rbx
mov r14, rax
mov rdx, rax
call qword [sym.imp.comctl32.dll_ImageList_AddMasked]
mov rcx, r14
call qword [sym.imp.gdi32.dll_DeleteObject]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.comctl32.dll_ImageList_SetBkColor]
mov edx, 0x1003
mov rcx, r13
mov r9, rbx
mov r8d, 2
call rsi
mov r8, rbx
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov edx, 2
mov rcx, r13
call sym.add_known_usages_to_list
call sym.get_cert_mgr_usages
mov rsi, rax
test rax, rax
je 0x6c645e03
mov rdi, qword [sym.imp.ucrtbase.dll_strchr]
mov edx, 0x2c
mov rcx, rax
mov r14, rsi
call rdi
cmp byte [rsi], 0
mov rbx, rax
jne 0x6c645f6d
jmp 0x6c645f8d
mov byte [rbx], 0
mov rdx, r14
mov rcx, r13
call sym.find_oid_in_list
cmp rax, 0xffffffffffffffff
je 0x6c645f56
mov edx, eax
mov rcx, r12
call sym.toggle_usage
lea r14, [rbx + 1]
mov edx, 0x2c
mov rcx, r14
call rdi
cmp byte [rbx + 1], 0
je 0x6c645f8d
mov rbx, rax
test rbx, rbx
jne 0x6c645f38
mov rdx, r14
mov rcx, r13
call sym.find_oid_in_list
cmp rax, 0xffffffffffffffff
je 0x6c645f8d
mov edx, eax
mov rcx, r12
call sym.toggle_usage
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x6c645e03
cmp dword [r9 + 0x10], 0xfffffffe
jne 0x6c645e03
mov edx, dword [r9 + 0x18]
call sym.toggle_usage
mov rcx, r12
call qword [sym.imp.user32.dll_GetParent]
xor r9d, r9d
mov r8, r12
mov edx, 0x468
mov rcx, rax
call qword [sym.imp.user32.dll_SendMessageW]
jmp 0x6c645e03
cmp r8, 1
je 0x6c646030
cmp r8, 2
jne 0x6c645e03
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rax
call qword [sym.imp.comctl32.dll_ImageList_Destroy]
mov edx, 2
mov rcx, r12
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x6c645e03
mov edx, 0x965
call qword [sym.imp.user32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rdi, qword [sym.imp.user32.dll_SendMessageW]
mov rsi, rax
mov rcx, rax
call rdi
mov dword [rsp + 0x70], 0xc
mov dword [rsp + 0x78], 0
mov ebp, eax
mov dword [rsp + 0x80], 0xf000
test eax, eax
jle 0x6c64625d
lea r13, [rsp + 0x70]
xor ebx, ebx
xor r15d, r15d
jmp 0x6c64609d
add r15d, 1
cmp ebp, r15d
je 0x6c646140
xor r8d, r8d
mov dword [rsp + 0x74], r15d
mov r9, r13
mov edx, 0x104b
mov rcx, rsi
call rdi
test rax, rax
je 0x6c646090
mov eax, dword [rsp + 0x7c]
shr eax, 0xc
cmp eax, 1
jne 0x6c646090
mov r14, qword [rsp + 0x98]
test rbx, rbx
je 0x6c646220
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ucrtbase.dll_strlen]
mov rdx, qword [rsp + 0x58]
mov r8, rbx
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
lea r9, [rdx + rax + 2]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov rbx, rax
test rax, rax
je 0x6c646256
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_strlen]
add rax, rbx
mov byte [rax], 0x2c
lea rcx, [rax + 1]
mov rdx, qword [r14 + 8]
call qword [sym.imp.ucrtbase.dll_strcpy]
jmp 0x6c646090
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rdx, [0x6c655760]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x6c6461d1
mov r13, qword [rsp + 0x60]
test rbx, rbx
je 0x6c6462b2
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, r13
add eax, 1
mov r9d, 1
lea rdx, str.Purpose
mov dword [rsp + 0x28], eax
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rax
call qword [sym.imp.comctl32.dll_ImageList_Destroy]
mov edx, 1
mov rcx, r12
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x6c645e03
mov rcx, qword [r14 + 8]
call qword [sym.imp.ucrtbase.dll_strlen]
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
lea r8, [rax + 1]
mov rcx, qword [rdx + 0x30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rax
test rax, rax
jne 0x6c646131
xor ebx, ebx
jmp 0x6c646090
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x40], 0
lea rdx, [0x6c655760]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x6c6461d1
mov r13, qword [rsp + 0x60]
lea rdx, str.Purpose
mov rcx, r13
xor ebx, ebx
call qword [sym.imp.advapi32.dll_RegDeleteValueA]
jmp 0x6c6461c6