Function at 0x140057830
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov qword [rsp + 0x148], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov r14, rdx
call fcn.140063708
mov rdx, rax
xor r15d, r15d
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140057881
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400578b3
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa0], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400578e8
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x90], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005791d
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140057952
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140057984
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400579b6
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400579e8
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x88], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140057a1d
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x98], rax
call fcn.140063708
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140057a52
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xf8], r15
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekSpkProtection
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140057aa9
mov rbx, qword [rsp + 0xf8]
mov qword [rsp + 0x58], rbx
jmp 0x140057b0c
mov qword [rsp + 0x108], r15
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARERealtekSpkProtection
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400588b4
mov rbx, qword [rsp + 0x108]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x1a0], 0x3b
mov qword [rsp + 0x100], r15
mov r13d, r15d
mov rax, qword [r14]
cmp dword [rax - 8], 1
jle 0x140057b36
mov edx, dword [rax - 0x10]
mov rcx, r14
call fcn.1400019d0
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x1a0]
mov rcx, qword [r14]
call fcn.140092040
mov rbp, rax
mov r12d, r15d
or rsi, 0xffffffffffffffff
test rax, rax
je 0x140058663
lea r14, [0x140000000]
lea edi, [rsi + 2]
nop
nop
lea rdx, [0x1400cac28]
mov rcx, rbp
call fcn.140091f90
test eax, eax
je case.default.0x140057bb6
lea rdx, [0x1400cac2c]
mov rcx, rbp
call fcn.140091f90
test eax, eax
je case.default.0x140057bb6
cmp r12d, 6
ja case.default.0x140057bb6
movsxd rax, r12d
mov ecx, dword [r14 + rax*4 + 0x58a4c]
add rcx, r14
jmp rcx
test rbp, rbp
jne 0x140057bc2
mov ecx, r15d
jmp 0x140057bd4
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.140001bd0
mov rdx, qword [rsp + 0x78]
mov edi, dword [rdx - 0x10]
cmp edi, 4
jle 0x140057c9b
mov r8d, 4
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x78]
call fcn.1400106e0
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140057c42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8d, [rdi - 4]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call fcn.1400188c0
nop
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140057c94
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
jmp 0x140057cd7
mov rbx, qword [rsp + 0x58]
jmp 0x140057cd7
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call fcn.140001ae0
xor eax, eax
mov rcx, rsi
lea rdi, [0x1400c4360]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1400c4360]
lea rcx, [rsp + 0xa0]
call fcn.140001bd0
mov rcx, qword [rsp + 0x90]
cmp dword [rcx - 8], 1
jle 0x140057cfd
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x90]
call fcn.1400019d0
mov rcx, qword [rsp + 0x90]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov ebp, eax
mov rcx, qword [rsp + 0xa0]
cmp dword [rcx - 8], 1
jle 0x140057d30
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0xa0]
call fcn.1400019d0
mov rcx, qword [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov edi, eax
mov dword [rsp + 0x1a8], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400cac30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.R0_L_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x14005844c
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x140057dc6
mov ecx, r15d
jmp 0x140057dd8
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.140001bd0
mov rdx, qword [rsp + 0x80]
mov edi, dword [rdx - 0x10]
cmp edi, 4
jle 0x140057ea5
mov r8d, 4
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x80]
call fcn.1400106e0
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140057e4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8d, [rdi - 4]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x80]
call fcn.1400188c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140057e9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
jmp 0x140057ede
mov rbx, qword [rsp + 0x58]
jmp 0x140057ede
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.140001ae0
xor eax, eax
mov rcx, rsi
lea rdi, [0x1400c4360]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1400c4360]
lea rcx, [rsp + 0x68]
call fcn.140001bd0
mov rcx, qword [rsp + 0x70]
cmp dword [rcx - 8], 1
jle 0x140057efb
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400019d0
mov rcx, qword [rsp + 0x70]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov edi, eax
mov rcx, qword [rsp + 0x68]
cmp dword [rcx - 8], 1
jle 0x140057f25
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400019d0
mov rcx, qword [rsp + 0x68]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.R0_R_MSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.R0_R_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140058445
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x140057fb9
mov ecx, r15d
jmp 0x140057fcb
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.140001bd0
mov rdx, qword [rsp + 0x60]
mov edi, dword [rdx - 0x10]
cmp edi, 4
jle 0x140058092
mov r8d, 4
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x60]
call fcn.1400106e0
nop
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058039
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8d, [rdi - 4]
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x60]
call fcn.1400188c0
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005808b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
jmp 0x1400580ce
mov rbx, qword [rsp + 0x58]
jmp 0x1400580ce
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140001ae0
xor eax, eax
mov rcx, rsi
lea rdi, [0x1400c4360]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1400c4360]
lea rcx, [rsp + 0x88]
call fcn.140001bd0
mov rcx, qword [rsp + 0x98]
cmp dword [rcx - 8], 1
jle 0x1400580f4
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x98]
call fcn.1400019d0
mov rcx, qword [rsp + 0x98]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov edi, eax
mov rcx, qword [rsp + 0x88]
cmp dword [rcx - 8], 1
jle 0x140058127
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.1400019d0
mov rcx, qword [rsp + 0x88]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140090a10
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TS_MSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xc0], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TS_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x14005843e
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x1400581bb
mov ecx, r15d
jmp 0x1400581cd
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140001bd0
mov rdx, qword [rsp + 0x50]
cmp dword [rdx - 8], 1
jle 0x1400581f5
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400019d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.140090a10
mov edi, eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RSA0_R0_L
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140058437
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x14005825b
mov ecx, r15d
jmp 0x14005826d
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140001bd0
mov rdx, qword [rsp + 0x50]
cmp dword [rdx - 8], 1
jle 0x140058295
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400019d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.140090a10
mov edi, eax
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RSA0_R0_R
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140058430
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x1400582fb
mov ecx, r15d
jmp 0x14005830d
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140001bd0
mov rdx, qword [rsp + 0x50]
cmp dword [rdx - 8], 1
jle 0x140058335
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400019d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.140090a10
mov edi, eax
mov dword [rsp + 0xb8], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RSA1_R0_L
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x140058429
mov edi, 1
mov r13d, edi
jmp case.default.0x140057bb6
test rbp, rbp
jne 0x14005839b
mov ecx, r15d
jmp 0x1400583ad
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140001bd0
mov rdx, qword [rsp + 0x50]
cmp dword [rdx - 8], 1
jle 0x1400583d5
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400019d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.140090a10
mov edi, eax
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RSA1_R0_R
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
mov edi, 1
cmovne r13d, edi
jmp case.default.0x140057bb6
mov edi, 1
jmp case.default.0x140057bb6
mov edi, 1
jmp case.default.0x140057bb6
mov edi, 1
jmp case.default.0x140057bb6
mov edi, 1
jmp case.default.0x140057bb6
mov edi, 1
jmp case.default.0x140057bb6
mov edi, 1
add r12d, 1
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
call fcn.140092040
mov rbp, rax
test rax, rax
jne 0x140057b70
cmp r12d, 7
mov r14, qword [rsp + 0x198]
jl 0x140058663
test r13d, r13d
je 0x1400584c2
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 4]
xor r8d, r8d
lea rdx, str.R0_FROM_WMI
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400584d8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x1400584e7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058508
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005852c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058550
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058571
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058592
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400585b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400585d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400585fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005861f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058640
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14005865c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
jmp 0x140058a31
lea rdx, [0x1400cac30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_L_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_R_MSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_R_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.TS_MSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.TS_LSB
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA0_R0_L
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA0_R0_R
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA1_R0_L
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA1_R0_R
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_FROM_WMI
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x140058729
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x140058738
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058759
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005877d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400587a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400587c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400587e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058804
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058828
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005884c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058870
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058891
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400588ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140058a31
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400588d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400588fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058920
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058941
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058962
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058983
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400589a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400589cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400589ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140058a10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140058a2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 2
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret