Function at 0x1400536d0
Capabilities:
Delete registry value
Get disk size
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, dl
mov r14, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rbp - 0x69], r12d
lea rax, [rcx + 0x130]
mov qword [rbp - 0x31], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [r14 + 0x160]
call fcn.1400548f0
lea rcx, [r14 + 0x170]
call fcn.1400548f0
mov dl, 1
mov rcx, r14
call fcn.140054220
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1401a9d80]
imul ecx, ecx
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x140053798
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edx, 0x5c
mov rcx, qword [r14 + 0x1b0]
call fcn.1400c6258
or esi, 0xffffffff
test rax, rax
jne 0x1400537b5
mov eax, esi
jmp 0x1400537bf
sub rax, qword [r14 + 0x1b0]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x51]
lea rcx, [r14 + 0x1b0]
call fcn.140024ac0
nop
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [r14 + 0x1b0]
mov rcx, qword [r14 + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400538e3
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r14 + 0x1b0]
mov rcx, qword [r14 + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400538e3
mov edx, eax
lea rcx, [rbp + 7]
call fcn.140049f40
mov rbx, rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401a19a8]
mov rdx, qword [0x1401a19a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rbp - 0x41]
call fcn.140003150
cmp qword [rbx + 0x18], 0x10
jb 0x1400538ae
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140003150
lea r8, [0x140133894]
lea rdx, [0x140133898]
lea rcx, [rbp - 0x41]
call fcn.14000e9b0
nop
lea rdx, [0x14016cad8]
lea rcx, [rbp - 0x41]
call fcn.1400cb848
nop
test r13b, r13b
je 0x140053926
lea r8, str._ver
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.140019610
nop
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053923
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov r15d, r12d
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
jmp 0x140053953
xor r12d, r12d
mov dword [rbp - 0x49], 0x7ffe
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7ffe
or eax, ecx
jge 0x140053980
mov edx, 0x7ffe
lea rcx, [rbp - 0x61]
call fcn.140002330
mov rbx, qword [rbp - 0x61]
cmp dword [rbx - 0xc], 0x7ffe
jl 0x140053ce4
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x49]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400c44a0
test eax, eax
js 0x140053cd9
cmp eax, dword [rbx - 0xc]
jg 0x140053cd9
mov dword [rbx - 0x10], eax
movsxd rcx, eax
xor eax, eax
mov word [rbx + rcx*2], ax
call fcn.14004be60
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
call fcn.140019610
nop
or edi, 1
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140053a36
cmp dword [rbx - 0x10], 0
jl 0x140053a36
mov rcx, rbx
call fcn.1400c4670
test rax, rax
je 0x140053a36
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140053b28
cmp byte [0x1401aa91e], 0
jne 0x140053aa5
movzx eax, byte [0x1401a4d90]
xor al, 0x5d
movzx eax, al
mov word [0x1401a5c78], ax
movzx eax, byte [0x1401a4d91]
xor al, 0xa
movzx eax, al
mov word [0x1401a5c7a], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x1b
movzx eax, al
mov word [0x1401a5c7c], ax
movzx eax, byte [0x1401a4d93]
xor al, 0x1a
movzx eax, al
mov word [0x1401a5c7e], ax
movzx eax, byte [0x1401a4d94]
xor al, 0x18
movzx eax, al
mov word [0x1401a5c80], ax
mov byte [0x1401aa91e], 1
lea r8, [0x1401a5c78]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x11]
call fcn.140019610
nop
or edi, 2
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140053ae6
cmp dword [rbx - 0x10], 0
jl 0x140053ae6
mov rcx, rbx
call fcn.1400c4670
test rax, rax
je 0x140053ae6
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140053b28
call fcn.14004a9e0
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.140019610
nop
or edi, 4
mov dword [rbp - 0x69], edi
mov rdx, qword [rax]
test rdx, rdx
je 0x140053b2d
cmp dword [rbx - 0x10], 0
jl 0x140053b2d
mov rcx, rbx
call fcn.1400c4670
test rax, rax
je 0x140053b2d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140053b2d
mov r14b, 1
jmp 0x140053b30
xor r14b, r14b
test dil, 4
je 0x140053b5f
and edi, 0xfffffffb
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140053b58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 2
je 0x140053b8e
and edi, 0xfffffffd
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140053b87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test dil, 1
je 0x140053bbd
and edi, 0xfffffffe
mov dword [rbp - 0x69], edi
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140053bb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x69]
mov rbx, qword [rbp - 0x61]
test r14b, r14b
je 0x140053bd7
xor r14d, r14d
mov r15d, r14d
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140053bdd
inc r15d
xor r14d, r14d
test r12d, r12d
je 0x140053950
test r13b, r13b
je 0x140053c9d
cmp byte [0x1401aa91c], 0
jne 0x140053c4b
movzx eax, byte [0x1401a4d90]
xor al, 0x5d
movzx eax, al
mov word [0x1401a5680], ax
movzx eax, byte [0x1401a4d91]
xor al, 0x1a
movzx eax, al
mov word [0x1401a5682], ax
movzx eax, byte [0x1401a4d92]
xor al, 0xc
movzx eax, al
mov word [0x1401a5684], ax
movzx eax, byte [0x1401a4d93]
xor al, 7
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantInit], ax
mov byte [0x1401aa91c], 1
lea r8, [0x1401a5680]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.140019610
nop
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x61]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053cbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053cd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140053cef
mov ecx, 0x80070057
call fcn.140001930
int3
mov ecx, 0x80070057
call fcn.140001930
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c3970
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret