Function at 0x140073ca0
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2228]
mov eax, 0x2328
call fcn.140094fe0
sub rsp, rax
mov rax, qword [0x1400cf010]
xor rax, rsp
mov qword [rbp + 0x2210], rax
mov dword [rsp + 0x70], r9d
mov qword [rsp + 0x68], r8
mov r15, rdx
mov r14, rcx
xor esi, esi
mov r12d, esi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov qword [rbp - 0x78], rsi
call fcn.140072b10
mov ebx, eax
test eax, eax
js 0x140074d3a
cmp word [r15], 0x7d
je 0x140074d3a
mov r13d, 1
lea rdx, str.Delete
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
sete sil
lea rdx, str.ForceRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140073d46
test esi, esi
je 0x140073fdc
mov rbx, r15
nop dword [rax]
mov rdi, qword [r14]
movzx ecx, word [rdi]
mov edx, ecx
sub edx, 9
je 0x140073d6c
sub edx, r13d
je 0x140073d6c
sub edx, 3
je 0x140073d6c
cmp edx, 0x13
jne 0x140073d7a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140073d50
xor eax, eax
cmp ax, cx
je 0x140074d33
mov eax, 0x27
cmp ax, cx
jne 0x140073e72
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
xor edi, edi
cmp di, ax
je 0x140073e52
mov ecx, 0x27
cmp cx, ax
jne 0x140073dd1
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
mov ecx, 0x27
cmp cx, word [rax]
jne 0x140073e52
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140073ded
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074d33
test edx, edx
jle 0x140073e43
sub rdi, rbx
mov ecx, edx
nop word [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x140073e30
mov r8, qword [r14]
movzx eax, word [r8]
xor edi, edi
cmp di, ax
jne 0x140073db0
mov rax, qword [r14]
cmp di, word [rax]
je 0x140074d33
mov word [rbx], di
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140073efe
movzx ecx, cx
sub ecx, 9
je 0x140073ef9
sub ecx, r13d
je 0x140073ef9
sub ecx, 3
je 0x140073ef9
cmp ecx, 0x13
je 0x140073ef9
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074d33
test edx, edx
jle 0x140073ee3
sub rdi, rbx
mov ecx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x140073ed0
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
xor ecx, ecx
cmp cx, ax
je 0x140073ef9
movzx ecx, ax
jmp 0x140073e72
xor edi, edi
mov word [rbx], di
cmp dword [rsp + 0x70], 0
je 0x140073fdc
mov qword [rbp - 0x68], rdi
mov dword [rbp - 0x60], edi
mov qword [rbp - 0x58], rdi
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x140073f42
cmp ax, 0x5c
je 0x140073f39
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140073f20
jmp 0x140073f42
test rcx, rcx
jne 0x140074cc9
lea rbx, str.p_a_v_
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140073f99
add rbx, 8
lea rax, str.0_b_v_
cmp rbx, rax
jl 0x140073f50
mov rdi, qword [rsp + 0x68]
mov qword [rbp - 0x68], rdi
xor ebx, ebx
mov dword [rbp - 0x60], ebx
mov qword [rbp - 0x58], rbx
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140072130
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x60], ebx
mov qword [rbp - 0x58], rbx
test esi, esi
je 0x140073fd5
mov rdx, r15
mov rcx, r14
call fcn.140072b10
mov ebx, eax
test eax, eax
js 0x140074cd5
mov rdx, r15
mov rcx, r14
call fcn.140073290
mov ebx, eax
xor esi, esi
mov dword [rbp - 0x60], esi
test eax, eax
js 0x140074d3a
mov edi, dword [rsp + 0x70]
jmp 0x1400748c6
xor esi, esi
mov dword [rbp - 0x60], esi
jmp 0x140073fde
xor esi, esi
lea rdx, str.NoRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140074189
mov r13d, esi
mov rbx, r15
nop dword [rax]
mov rdi, qword [r14]
movzx ecx, word [rdi]
mov edx, ecx
sub edx, 9
je 0x14007401c
sub edx, 1
je 0x14007401c
sub edx, 3
je 0x14007401c
cmp edx, 0x13
jne 0x14007402a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140074000
cmp si, cx
je 0x140074cce
mov eax, 0x27
cmp ax, cx
jne 0x140074111
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x1400740f1
nop dword [rax]
mov edi, 0x27
cmp di, ax
jne 0x140074078
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x1400740f1
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140074094
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074cce
test edx, edx
jle 0x1400740e4
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400740d0
mov r8, qword [r14]
movzx eax, word [r8]
cmp si, ax
jne 0x140074060
mov rax, qword [r14]
cmp si, word [rax]
je 0x140074cce
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140074189
movzx ecx, cx
sub ecx, 9
je 0x140074186
sub ecx, 1
je 0x140074186
sub ecx, 3
je 0x140074186
cmp ecx, 0x13
je 0x140074186
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074cce
test edx, edx
jle 0x140074175
sub rdi, rbx
mov ecx, edx
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140074161
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
je 0x140074186
movzx ecx, ax
jmp 0x140074111
mov word [rbx], si
lea rdx, [0x1400a8328]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400745b6
lea rbx, [rbp + 0x210]
nop dword [rax + rax]
mov rdi, qword [r14]
movzx ecx, word [rdi]
mov edx, ecx
sub edx, 9
je 0x1400741cc
sub edx, 1
je 0x1400741cc
sub edx, 3
je 0x1400741cc
cmp edx, 0x13
jne 0x1400741da
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x1400741b0
cmp si, cx
je 0x140074cce
mov eax, 0x27
cmp ax, cx
jne 0x1400742b7
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x14007429d
nop dword [rax]
mov edi, 0x27
cmp di, ax
jne 0x140074228
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x14007429d
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140074244
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
mov rcx, rax
sub rcx, rdi
sar rcx, 1
lea rax, [rcx + 1]
lea rax, [rbx + rax*2]
lea r8, [rbp + 0x2210]
cmp rax, r8
jae 0x140074cce
test ecx, ecx
jle 0x140074291
sub rdi, rbx
mov ecx, ecx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140074280
movzx eax, word [rdx]
cmp si, ax
jne 0x140074210
mov rcx, qword [r14]
cmp si, word [rcx]
je 0x140074cce
mov word [rbx], si
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140074335
movzx ecx, cx
sub ecx, 9
je 0x140074332
sub ecx, 1
je 0x140074332
sub ecx, 3
je 0x140074332
cmp ecx, 0x13
je 0x140074332
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [rbp + 0x2210]
cmp rcx, rax
jae 0x140074cce
test edx, edx
jle 0x140074321
sub rdi, rbx
mov ecx, edx
nop word [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140074310
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
je 0x140074332
movzx ecx, ax
jmp 0x1400742b7
mov word [rbx], si
mov rbx, r15
nop dword [rax + rax]
mov rdi, qword [r14]
movzx ecx, word [rdi]
mov edx, ecx
sub edx, 9
je 0x14007435c
sub edx, 1
je 0x14007435c
sub edx, 3
je 0x14007435c
cmp edx, 0x13
jne 0x14007436a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140074340
cmp si, cx
je 0x140074cce
mov eax, 0x27
cmp ax, cx
jne 0x140074450
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x140074431
nop dword [rax]
mov edi, 0x27
cmp di, ax
jne 0x1400743b8
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x140074431
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x1400743d4
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074cce
test edx, edx
jle 0x140074424
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140074410
mov r8, qword [r14]
movzx eax, word [r8]
cmp si, ax
jne 0x1400743a0
mov rax, qword [r14]
cmp si, word [rax]
je 0x140074cce
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x1400744c8
movzx ecx, cx
sub ecx, 9
je 0x1400744c5
sub ecx, 1
je 0x1400744c5
sub ecx, 3
je 0x1400744c5
cmp ecx, 0x13
je 0x1400744c5
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140074cce
test edx, edx
jle 0x1400744b4
sub rdi, rbx
mov ecx, edx
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400744a0
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
je 0x1400744c5
movzx ecx, ax
jmp 0x140074450
mov word [rbx], si
cmp word [r15], 0x3d
jne 0x140074cce
mov edi, dword [rsp + 0x70]
test edi, edi
je 0x140074521
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
mov r9, r15
lea r8, [rbp + 0x210]
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.140072ce0
mov ebx, eax
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
mov dword [rbp - 0x48], esi
jmp 0x1400748be
cmp dword [rbp + 0x2290], 0
jne 0x1400745a6
test r13d, r13d
je 0x1400745a6
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x30], esi
mov qword [rbp - 0x28], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140074cfc
mov dword [rbp - 0x30], esi
mov rdi, qword [rsp + 0x60]
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x30], esi
lea rdx, [rbp + 0x210]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x140074cdc
test rdi, rdi
je 0x1400745a3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x30], esi
mov rdx, r15
mov rcx, r14
call fcn.140073290
jmp 0x140073cf9
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x1400745e4
cmp ax, 0x5c
je 0x1400745db
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x1400745c2
jmp 0x1400745e4
test rcx, rcx
jne 0x140074cce
mov edi, dword [rsp + 0x70]
test edi, edi
je 0x14007491f
mov qword [rsp + 0x60], rsi
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14007466c
cmp qword [rbx], 0
je 0x14007465f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400746be
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140074665
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x14007468d
cmp dword [rbx + 8], 0
jne 0x14007466c
mov eax, 1
jmp 0x14007468d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400746be
mov eax, esi
test r12, r12
je 0x1400746a6
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], esi
test eax, eax
je 0x140074888
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x140074736
cmp qword [rbx], 0
je 0x140074729
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140074788
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14007472f
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x140074757
cmp dword [rbx + 8], 0
jne 0x140074736
mov eax, 1
jmp 0x140074757
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140074788
mov eax, esi
test r12, r12
je 0x140074770
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], esi
test eax, eax
je 0x140074888
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x14007481b
cmp qword [rbx], 0
je 0x14007480e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140074d0a
lea rdx, str.RegCreateKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140074814
mov qword [rsp + 0x50], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x140074853
cmp dword [rbx + 8], 0
jne 0x14007481b
mov eax, 1
jmp 0x140074853
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140074d0f
mov eax, esi
test r12, r12
je 0x140074870
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], esi
test eax, eax
jne 0x140074d0f
mov rdx, r15
mov rcx, r14
call fcn.140072b10
mov ebx, eax
test eax, eax
js 0x140074d3a
cmp word [r15], 0x3d
jne 0x1400748c6
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140072ce0
mov ebx, eax
mov r12, qword [rsp + 0x78]
test eax, eax
js 0x140074d3a
cmp word [r15], 0x7b
jne 0x140073d03
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x1400748e0
cmp rax, 1
jne 0x140073d03
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.140073ca0
mov ebx, eax
test eax, eax
js 0x140074d3a
mov rdx, r15
mov rcx, r14
jmp 0x140073cf4
mov eax, dword [rbp + 0x2290]
test eax, eax
jne 0x140074a09
mov qword [rsp + 0x60], rsi
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x1400749b3
cmp qword [rbx], 0
je 0x1400749a6
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140074961
lea edi, [rax + 1]
mov eax, dword [rbp + 0x2290]
jmp 0x140074a0e
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400749ac
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x1400749d4
cmp dword [rbx + 8], 0
jne 0x1400749b3
mov edi, 1
jmp 0x1400749d6
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x140074a01
mov edi, esi
test r12, r12
je 0x1400749f1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], esi
mov eax, dword [rbp + 0x2290]
jmp 0x140074a0e
mov edi, 2
mov esi, 1
test edi, edi
cmove esi, eax
mov r9, 0xffffffffffffffff
mov r8, r15
mov edx, 0x104
lea rcx, [rbp]
call fcn.140083070
test eax, eax
je 0x140074a58
cmp eax, 0xc
je 0x140074d75
cmp eax, 0x16
je 0x140074d8b
cmp eax, 0x22
je 0x140074d8b
cmp eax, 0x50
jne 0x140074d80
mov rdx, r15
mov rcx, r14
call fcn.140072b10
mov ebx, eax
test eax, eax
js 0x140074d38
mov rdx, r15
mov rcx, r14
call fcn.140073290
mov ebx, eax
test eax, eax
js 0x140074d38
cmp word [r15], 0x7b
jne 0x140074ad9
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x140074a90
cmp rax, 1
jne 0x140074ad9
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.140073ca0
mov ebx, eax
test eax, eax
jns 0x140074ac4
test esi, esi
je 0x140074d38
mov rdx, r15
mov rcx, r14
call fcn.140072b10
mov ebx, eax
test eax, eax
js 0x140074d38
cmp edi, 2
je 0x140074aef
test edi, edi
je 0x140074af6
cmp dword [rbp + 0x2290], 0
je 0x140074d1a
xor esi, esi
jmp 0x140073d03
xor esi, esi
cmp dword [rbp + 0x2290], esi
je 0x140074ba6
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140074ba6
cmp dword [rsp + 0x60], esi
jbe 0x140074ba6
lea rdi, str.p_a_v_
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140073d03
add rdi, 8
lea rax, str.0_b_v_
cmp rdi, rax
jl 0x140074b60
test r13d, r13d
je 0x140073d03
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call fcn.140072130
mov r12, qword [rsp + 0x78]
jmp 0x140073d03
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
test eax, eax
jne 0x140074bf6
cmp dword [rsp + 0x60], eax
seta dil
mov eax, esi
test r12, r12
je 0x140074c0e
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, rsi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
test eax, eax
jne 0x140074d0f
test r13d, r13d
je 0x140073d03
test edi, edi
jne 0x140073d03
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
mov rdi, qword [rsp + 0x68]
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
cmp byte [0x1400d59e0], al
jne 0x140074c8f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140074c7f
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d59d8], rax
mov byte [0x1400d59e0], 1
jmp 0x140074c96
mov rax, qword [0x1400d59d8]
mov byte [0x1400d59e0], 1
jmp 0x140074c96
mov rax, qword [0x1400d59d8]
lea rdx, [rbp]
mov rcx, rdi
test rax, rax
je 0x140074cac
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x140074cb2
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
test eax, eax
jne 0x140074d25
mov dword [rbp - 0x18], esi
jmp 0x140073d03
xor esi, esi
mov dword [rbp - 0x60], esi
mov ebx, 0x80020009
jmp 0x140074d3a
xor esi, esi
mov dword [rbp - 0x60], esi
jmp 0x140074d3a
mov ecx, eax
call fcn.140071e40
mov ebx, eax
test rdi, rdi
je 0x140074cf7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x30], esi
jmp 0x140074d3a
mov ecx, eax
call fcn.140071e40
mov ebx, eax
mov dword [rbp - 0x30], esi
jmp 0x140074d3a
mov eax, 1
mov ecx, eax
call fcn.140071e40
mov ebx, eax
jmp 0x140074d3a
mov ecx, edi
call fcn.140071e40
mov ebx, eax
jmp 0x140074d38
mov ecx, eax
call fcn.140071e40
mov ebx, eax
mov dword [rbp - 0x18], esi
jmp 0x140074d3a
mov ebx, 0x80020009
xor esi, esi
test r12, r12
je 0x140074d4d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov eax, ebx
mov rcx, qword [rbp + 0x2210]
xor rcx, rsp
call fcn.14007c550
add rsp, 0x2328
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140035220
int3
mov ecx, 0x80004005
call fcn.140035220
int3
mov ecx, 0x80070057
call fcn.140035220
int3