Function at 0x18000f634
Capabilities:
Delete registry key
Delete registry value
Persist via screensaver registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r12, rdx
mov rsi, rcx
lea r14d, [rbx + 8]
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x50], ebx
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x18000f9fe
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
lea r9d, [rbx + 2]
lea rdx, str.Control_PanelDesktop
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f9f4
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
lea rdx, str.Control_Panel
mov r9d, 0x10000
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f9ea
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
lea r15d, [rbx + 1]
mov r9d, r15d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f9d3
mov r8d, 0x200
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000f9c9
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
lea r13, str.SCRNSAVE.EXE
mov qword [rsp + 0x28], rax
mov rdx, r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f79e
mov r9d, dword [rbp + 0x50]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
test rax, rax
je 0x18000f994
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f9bb
mov eax, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x20]
mov r9d, r15d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x18000f7ab
mov rcx, qword [rbp - 0x20]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x18000f9bb
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
lea r13, str.ScreenSaveActive
mov qword [rsp + 0x28], rax
mov rdx, r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f848
mov r9d, dword [rbp + 0x50]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
test rax, rax
je 0x18000f994
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f9bb
mov eax, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x20]
mov r9d, r15d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x18000f855
mov rcx, qword [rbp - 0x20]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x18000f9bb
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
lea r13, str.ScreenSaverIsSecure
mov qword [rsp + 0x28], rax
mov rdx, r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f8f2
mov r9d, dword [rbp + 0x50]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
test rax, rax
je 0x18000f994
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f9bb
mov eax, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x20]
mov r9d, r15d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x18000f8ff
mov rcx, qword [rbp - 0x20]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x18000f9bb
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
lea r13, str.ScreenSaveTimeOut
mov qword [rsp + 0x28], rax
mov rdx, r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f9a7
mov r9d, dword [rbp + 0x50]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
test rax, rax
je 0x18000f994
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f9bb
mov eax, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x20]
mov r9d, r15d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x18000f9b4
lea rdx, str._HeapFree__NULL_n
mov ecx, 0xe1
call fcn.180030818
jmp 0x18000f9c9
mov rcx, qword [rbp - 0x20]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x18000f9bb
mov bl, r15b
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x18]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret