Function at 0x14009d5c8
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x458]
sub rsp, 0x558
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov eax, r8d
mov qword [rsp + 0x78], rdx
mov rbx, r9
mov dword [rsp + 0x60], eax
and eax, 1
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x5c], eax
mov r13, rdx
neg eax
mov rsi, rcx
lea rax, [rsp + 0x48]
sbb r9d, r9d
mov qword [rsp + 0x20], rax
and r9d, 0x10006
xor r8d, r8d
add r9d, 0x20019
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x14009d97d
lea rdx, [0x14030dc78]
mov rcx, rbx
mov r8, rdx
lea r9, [rsp + 0x68]
mov r14d, r15d
call qword [sym.imp.api_ms_win_shcore_comhelpers_l1_1_0.dll_IUnknown_QueryService]
nop dword [rax + rax]
test byte [0x14038bd81], 0x40
je 0x14009d686
mov r8, r13
lea rdx, [0x14030dc98]
call fcn.14004186c
mov edi, r15d
mov r12d, 0x104
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x230]
mov dword [rsp + 0x54], Ordinal_86
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x80]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x28], rax
mov edx, edi
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
cmp eax, 0xea
je 0x14009d976
test eax, eax
je 0x14009d84b
cmp eax, 0x103
mov ebx, 1
cmovne ebx, r15d
mov dword [rsp + 0x64], ebx
test r14, r14
je 0x14009d7e5
mov edi, 0x200
lea rcx, [rbp + 0x20]
mov r8d, edi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r12, 0xffffffff80000002
cmp rsi, r12
jne 0x14009d75c
or eax, 0xffffffff
mov dword [rsp + 0x20], 1
mov r9d, eax
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov edx, eax
mov r8, r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x140180a13
movsxd r12, dword [r14]
test r12, r12
jle 0x14009d7dd
mov ebx, dword [rsp + 0x5c]
xor esi, esi
mov r13, qword [rsp + 0x70]
mov rax, qword [r14 + 8]
mov rdi, qword [rax + r15*8]
test ebx, ebx
jne 0x140180a58
cmp word [rbp + 0x20], si
jne 0x140180a87
xor eax, eax
mov r9d, dword [rsp + 0x60]
lea rsi, [rdi + 0x208]
mov qword [rsp + 0x28], rax
lea r8, [rdi + 0x410]
mov rdx, rsi
mov qword [rsp + 0x20], r13
mov rcx, rdi
call fcn.14009cb64
test ebx, ebx
jne 0x140180b24
xor esi, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
inc r15
cmp r15, r12
jl 0x14009d76f
mov ebx, dword [rsp + 0x64]
mov r13, qword [rsp + 0x78]
mov rcx, r14
call fcn.140062810
test byte [0x14038bd81], 0x40
je 0x14009d7fd
mov r8, r13
lea rdx, [0x14030dc88]
call fcn.14004186c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14009d825
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006b68f.0]
mov eax, ebx
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x558
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, dword [rsp + 0x40]
lea eax, [rdx - 1]
cmp eax, 1
ja 0x14009d976
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14009d882
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov rax, qword [rax + 0x20]
call qword [case.0x14006b68f.0]
test eax, eax
je 0x14009d976
mov edx, dword [rsp + 0x40]
cmp edx, 2
jne 0x14009d8c9
lea r8, [rbp + 0x230]
mov rdx, r12
lea rcx, [rbp + 0x20]
call fcn.14003d070
test eax, eax
js 0x14009d976
mov r8d, r12d
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_SHExpandEnvironmentStringsW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x14009d976
mov ecx, reloc.SHELL32.dll_Shell_MergeMenus
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
jne 0x1401809ee
mov edx, 0x618
mov ecx, Shell_MergeMenus
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14009d976
mov r8, r13
mov rdx, r12
mov rcx, rax
call fcn.14003d070
test eax, eax
js 0x14009d976
lea rcx, [rbx + 0x208]
mov rdx, r12
lea r8, [rbp - 0x80]
call fcn.14003d070
test eax, eax
js 0x14009d976
lea rcx, [rbx + 0x410]
mov rdx, r12
lea r8, [rbp + 0x230]
call fcn.14003d070
test eax, eax
js 0x14009d976
test r14, r14
jne 0x14009d95d
lea ecx, [r14 + 5]
call fcn.140034670
mov r14, rax
test rax, rax
je 0x1401809fe
mov r8, rbx
mov edx, 0x7fffffff
mov rcx, r14
call fcn.140036664
cmp eax, 0xffffffff
je 0x1401809fe
inc edi
jmp 0x14009d68f
mov ebx, r15d
jmp 0x14009d825
cmp word [rbp - 0x80], 0x2a
jne 0x14009d976
jmp 0x14009d8e2
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
jmp 0x14009d976
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x30], rax
lea r8, str.FirstRequiresUserInput
lea rax, [rbp + 0x20]
mov r9d, 0x20000002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBE
mov rcx, r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
nop
jmp 0x14009d75c
lea rdx, [rdi + 0x208]
cmp word [rdx], 0x21
je 0x14009d77f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009d7bd
jmp 0x14009d77f
or eax, 0xffffffff
mov dword [rsp + 0x20], 1
mov r9d, eax
lea rcx, [rdi + 0x208]
mov edx, eax
lea r8, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
jne 0x14009d789
lea edx, [rax - 1]
xor ecx, ecx
mov r8d, edx
lea r9, str.ShellDesktopSwitchEvent
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140180af8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea r8, str.FirstRequiresUserInput
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
xor eax, eax
mov word [rbp + 0x20], ax
jmp 0x14009d78b
cmp word [rsi], 0x21
jne 0x14009d7bb
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
nop
jmp 0x14009d7bb