Function at 0x1400ae600
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r13d, r13d
mov dword [rsp + 0x68], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
xor edx, edx
xor ecx, ecx
call fcn.1401d3b80
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], r13
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x128], xmm0
mov word [rbp + 0x118], r13w
mov dword [rbp + 0x138], 2
mov rcx, rax
call fcn.140109c20
cmp eax, 2
jne 0x1400ae6d8
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400ae6d1
test byte [rcx + 0x1c], 1
je 0x1400ae6d1
cmp byte [rcx + 0x19], 2
jb 0x1400ae6d1
lea edx, [r13 + 0xa]
lea r8, [0x1405f5a88]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
xor bl, bl
jmp 0x1400af161
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
call fcn.1401d3600
mov edi, 0x200
mov ebx, edi
mov esi, 0x100
cmp eax, 0xc
cmove ebx, esi
or ebx, 0xf003f
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov r8d, 0x21
lea rdx, str.SOFTWARESophosTelemetryPlugins
lea rcx, [rsp + 0x70]
call fcn.1400739a0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x14060af30]
movdqu xmmword [rbp + 0xf8], xmm1
mov word [rbp + 0xe8], r13w
mov dword [rbp + 0x108], 2
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0xe8]
call fcn.1400739a0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400ae7fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ae7f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1c2
call fcn.140359090
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
jne 0x1400ae872
lea rax, str.0cg_
mov rdx, qword [str.0cg_]
cmp rdx, rax
je 0x1400ae86b
test byte [rdx + 0x1c], 1
je 0x1400ae86b
cmp byte [rdx + 0x19], 2
jb 0x1400ae86b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
mov edx, 0xb
mov dword [rsp + 0x20], eax
lea r9, str.SOFTWARESophosTelemetryPlugins
lea r8, [0x1405f5a88]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
mov rcx, qword [rbp + 0xe0]
xor bl, bl
jmp 0x1400af142
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
call fcn.1401d3600
cmp eax, 0xc
cmove edi, esi
or edi, 0xf003f
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov r8d, 3
lea rdx, [0x1405f5bc8]
lea rcx, [rbp - 0x70]
call fcn.1400739a0
nop
mov rbx, qword [rbp + 0xe0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [0x14060af30]
movdqu xmmword [rbp + 0xc8], xmm1
mov word [rbp + 0xb8], r13w
mov dword [rbp + 0xd8], 2
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
lea rcx, [rbp + 0xb8]
call fcn.1400739a0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400ae99d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ae998
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1c8
call fcn.140359090
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov r8d, 4
lea rdx, str.File
lea rcx, [rbp + 0x10]
call fcn.1400739a0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x68], rax
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0x140]
call fcn.1400acf70
mov dword [rsp + 0x68], 1
lea rcx, [rbp + 0x10]
call fcn.140073b90
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x140]
call fcn.1400ace60
mov rbx, qword [rax + 0x10]
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1400aea79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aea74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1ce
call fcn.140359090
test rbx, rbx
jne 0x1400af0b2
call fcn.1401d4720
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r13w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400aeaa3
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1400739a0
nop
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1400aeb01
lea rdi, [rcx + 0xf]
mov qword [rbp + 0x60], rdi
lea rbx, [rbp + 0x50]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x50]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1e
lea rdx, str._telemetry.json
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x1400aeb22
lfence
mov qword [rsp + 0x20], 0xf
lea r9, str._telemetry.json
mov edx, 0xf
lea rcx, [rbp + 0x50]
call fcn.1400735a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov r9, qword [rbp + 0x60]
lea rdi, [r9*2 + 2]
movdqu xmmword [rsp + 0x50], xmm0
mov r8, r13
mov qword [rsp + 0x60], r13
movabs r12, 0x7fffffffffffffff
test rdi, rdi
je 0x1400aeba4
cmp rdi, r12
ja 0x1400af1d4
lfence
mov rcx, rdi
call fcn.140073800
mov qword [rsp + 0x50], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x60], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14035c350
mov qword [rsp + 0x58], rbx
mov r9, qword [rbp + 0x60]
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x68], 3
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
lea rbx, [rcx + r9*2]
lea rsi, [rbp + 0x50]
cmovae rsi, qword [rbp + 0x50]
sub rbx, rsi
mov rdi, qword [rsp + 0x50]
sub r8, rdi
cmp rbx, r8
jbe 0x1400aebec
lfence
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400b6180
mov rdi, qword [rsp + 0x50]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14035bc80
lea rax, [rbx + rdi]
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
mov r8d, 4
lea rdx, str.File
lea rcx, [rbp - 0x50]
call fcn.1400739a0
nop
mov qword [rbp + 0x70], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x80], xmm0
lea rsi, [rbp - 0x50]
mov r14, qword [rbp - 0x50]
mov r15, qword [rbp - 0x38]
cmp r15, 8
cmovae rsi, r14
mov rdi, qword [rbp - 0x40]
cmp rdi, 8
jae 0x1400aec77
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 7
jmp 0x1400aecd5
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, r12
ja 0x1400af1da
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp + 0x70], rax
mov rbx, qword [rbp - 0x40]
lea r8, [rbx*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rdi
mov r15, qword [rbp - 0x38]
mov r14, qword [rbp - 0x50]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
cmp rsi, r12
je 0x1400aed40
mov rbx, r12
sub rbx, rsi
mov rcx, rbx
call fcn.140073800
mov rdi, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea rcx, [rax + rbx]
mov qword [rbp + 0xa0], rcx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
sub rdi, rsi
add rdi, r12
mov qword [rbp + 0x98], rdi
mov rsi, qword [rsp + 0x50]
mov dword [rbp + 0xa8], 1
cmp r15, 8
jb 0x1400aed8a
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400aed7d
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1e0
mov rcx, r14
call fcn.140359090
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x1400aedd2
mov rdx, qword [rsp + 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400aedbc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1e6
mov rcx, rsi
call fcn.140359090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0x90]
sub rcx, rax
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rdx, qword [rbp + 0x70]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0xa8]
xor r8d, r8d
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400aef13
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400aee70
test byte [rcx + 0x1c], 1
je 0x1400aee70
cmp byte [rcx + 0x19], 2
jb 0x1400aee70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae r9, qword [rbp + 0x50]
mov rcx, qword [str.0cg_]
mov edx, 0xc
mov dword [rsp + 0x20], eax
lea r8, [0x1405f5a88]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
nop
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400aeec2
mov rdx, qword [rbp + 0xa0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aeeab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1f8
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
lea rcx, [rbp + 0x70]
call fcn.140073b90
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1400aef0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aef07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1fe
call fcn.140359090
xor bl, bl
jmp 0x1400af0b4
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov r8d, 4
lea rdx, [0x1405e4988]
lea rcx, [rbp - 0x30]
call fcn.1400739a0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400aef94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aef8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1ec
call fcn.140359090
mov qword [rbp - 0x10], r13
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov r8d, 3
lea rdx, [0x1405f5be0]
lea rcx, [rbp - 0x10]
call fcn.1400739a0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400af016
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400af010
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1f2
call fcn.140359090
nop
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400af068
mov rdx, qword [rbp + 0xa0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400af051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1f8
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
lea rcx, [rbp + 0x70]
call fcn.140073b90
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1400af0b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400af0ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1fe
call fcn.140359090
mov bl, 1
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400af109
mov rdx, qword [rbp + 0x170]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400af0ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400af1bc
call fcn.140359090
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], r13
lea rcx, [rbp + 0x140]
call fcn.140073b90
nop
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x1400af12f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xb0], r13
lea rcx, [rbp + 0xb8]
call fcn.140073b90
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x1400af154
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xe0], r13
lea rcx, [rbp + 0xe8]
call fcn.140073b90
nop
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x1400af17d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x110], r13
lea rcx, [rbp + 0x118]
call fcn.140073b90
movzx eax, bl
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.1400710c0
nop
call fcn.140073980
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3