Function at 0x140011290
Capabilities:
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x700
mov qword [rax - 0x548], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov r15d, ecx
mov dword [rsp + 0x38], ecx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140011a68
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov ecx, r15d
call fcn.140022890
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011676
cmp qword [rsp + 0x50], 0
je 0x140011676
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140011a73
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x14009a4a8]
lea rcx, [rsp + 0x48]
call fcn.14000cc80
test al, al
jne 0x140011385
lea rdx, [0x14009a4a8]
lea rcx, [rsp + 0x48]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140011a7e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000cc80
test al, al
jne 0x1400113cc
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000c480
nop
mov dword [rsp + 0x70], 0x400
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x1e0]
call fcn.14005a920
nop
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rax, [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rax
je 0x14001142f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, 0xffffffffffffffff
test ebx, ebx
jne 0x140011464
lea rcx, [rsp + 0x2f0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011445
mov r8d, eax
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.14000d160
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jl 0x140011534
lea rdx, [0x14009a4b8]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140011534
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140011534
mov r8d, dword [rbx - 0x10]
add r8d, 0xfffffff9
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x30]
call fcn.14000bae0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001150e
cmp dword [rbx + 0x10], 0
jl 0x1400114ff
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400114ff
call fcn.14000d070
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400114f4
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14001150e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000d160
nop
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001152f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000b750
test al, al
je 0x14001163c
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140011a89
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.10..
lea rcx, [rsp + 0x78]
call fcn.14000cc80
test al, al
jne 0x140011594
lea rdx, str.10..
lea rcx, [rsp + 0x78]
call fcn.14000c480
nop
mov rdx, qword [rsp + 0x78]
lea r14, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp r14, rdi
je 0x1400115f6
cmp dword [rdi + 0x10], 0
jl 0x1400115e3
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x1400115e3
mov rcx, r14
call fcn.14000d070
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400115d8
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x30], rbx
jmp 0x1400115f6
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000d160
mov rbx, qword [rsp + 0x30]
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProxyOverride
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140011637
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011656
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001167d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001167d
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x148]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], r12w
mov r8d, 9
lea rdx, str.stemp.bat
lea rcx, [rsp + 0x148]
call fcn.14000e6a0
nop
mov qword [rsp + 0x178], r12
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], r12w
mov r8d, 6
lea rdx, [0x14009a3a8]
lea rcx, [rsp + 0x168]
call fcn.14000e6a0
nop
lea r9, [rsp + 0x148]
mov r8d, 0x91
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x60]
call fcn.14000ddd0
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x188], rax
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x90]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x138]
call fcn.14000ba30
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x140], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400117bb
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1a0], rcx
call fcn.14000d070
mov qword [rsp + 0x1a8], rax
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, str.system_settings_changed
lea rcx, [rsp + 0xc8]
call fcn.14000c6f0
nop
mov r8d, esi
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0xd0]
call fcn.14000c6f0
mov rdi, rax
lea rdx, str.Necessary_changes_have_been_done.
lea rcx, [rsp + 0xd8]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0xe0]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r15d
call fcn.14005d170
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xe8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400118e7
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1400118f0
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140011a94
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x58]
call fcn.14000cc80
test al, al
jne 0x140011937
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x58]
call fcn.14000c480
nop
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140011953
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011964
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140011a9f
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb8], rax
mov edi, 2
mov dword [rsp + 0x40], edi
mov r9, qword [rsp + 0x58]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xb8]
call fcn.14000ce60
mov rbx, qword [rsp + 0xb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400119dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400119fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011a1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140011a3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.1400691f0
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3