Function at 0x140001940
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push r14
sub rsp, 0x38
mov r14, rcx
call fcn.14000bd74
test eax, eax
je 0x140001a7f
lea rbx, [0x1400683b0]
cmp rbx, 0xffffffffffffffff
je 0x140001997
cmp qword [0x1400683b0], 0
mov qword [0x14006ebf8], rbx
je 0x140001997
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov cl, 1
call qword [case.0x14001287a.0]
cmp qword [rbx + 0x48], 0
lea rbx, [rbx + 0x48]
jne 0x140001980
mov rbx, qword [0x140068580]
mov rcx, qword [0x140068588]
cmp rbx, rcx
jae 0x1400019d4
nop word [rax + rax]
mov rax, qword [rbx]
test rax, rax
je 0x1400019cb
mov rax, qword [rax + 0x38]
mov cl, 1
call qword [case.0x14001287a.0]
mov rcx, qword [0x140068588]
add rbx, 8
cmp rbx, rcx
jb 0x1400019b0
call fcn.14002fed8
cmp dword [rax], 2
jne 0x140001b77
call fcn.14002fee0
lea rdx, str._regserver
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call fcn.14002ffc4
test eax, eax
jne 0x140001a89
lea rbx, [0x140068440]
mov dword [rsp + 0x28], 0x6c
lea r9d, [rax + 3]
mov qword [rsp + 0x20], rbx
lea r8, str.AccessPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov r9d, 3
mov dword [rsp + 0x28], 0x6c
lea r8, str.LaunchPermission
mov qword [rsp + 0x20], rbx
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
xor r9d, r9d
lea rcx, [0x14006ebb0]
lea edx, [r9 + 0x64]
lea r8d, [r9 + 1]
call fcn.1400075e0
call fcn.140003470
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
call fcn.14002fee0
lea rdx, str._unregserver
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call fcn.14002ffc4
test eax, eax
jne 0x140001b77
lea r8, str.AccessPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
lea r8, str.LaunchPermission
mov rcx, 0xffffffff80000000
lea rdx, str.APPID8CF751CA_0717_4DE5_A79B_4145689C5FDB
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
xor r9d, r9d
lea rcx, [0x14006ebb0]
xor r8d, r8d
lea edx, [r9 + 0x64]
call fcn.1400075e0
mov rbx, qword [0x14006ebf8]
test rbx, rbx
je 0x140001b4e
cmp qword [rbx], 0
je 0x140001b4e
nop word [rax + rax]
mov rax, qword [rbx + 0x38]
call qword [case.0x14001287a.0]
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.1400029d0
test eax, eax
js 0x140001a7f
mov rax, qword [rbx + 8]
xor ecx, ecx
call qword [case.0x14001287a.0]
test eax, eax
js 0x140001a7f
add rbx, 0x48
cmp qword [rbx], 0
jne 0x140001b10
mov rax, qword [0x14006e9f8]
test rax, rax
je 0x140001b68
call qword [case.0x14001287a.0]
test eax, eax
js 0x140001a7f
call fcn.1400027f0
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
mov rbx, qword [0x14006ebf8]
mov qword [rsp + 0x60], rsi
xor esi, esi
mov qword [rsp + 0x30], rdi
mov edi, esi
test rbx, rbx
je 0x140001c21
cmp qword [rbx], rsi
je 0x140001c21
nop
test edi, edi
jne 0x140001cd7
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x58], rsi
test rax, rax
jne 0x140001bba
mov edi, esi
jmp 0x140001c10
mov rcx, qword [rbx + 0x18]
lea r8, [rsp + 0x58]
lea rdx, [0x14005b9b8]
call qword [case.0x14001287a.0]
mov edi, eax
test eax, eax
js 0x140001bf9
mov rdx, qword [rsp + 0x58]
lea rax, [rbx + 0x28]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov edi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001c10
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001287a.0]
add rbx, 0x48
cmp qword [rbx], rsi
jne 0x140001ba0
test edi, edi
jne 0x140001cd7
mov rdi, qword [0x140068580]
mov rcx, qword [0x140068588]
mov qword [rsp + 0x50], rbp
mov ebp, 1
cmp rdi, rcx
jae 0x140001cd2
test ebp, ebp
js 0x140001cd2
mov rbx, qword [rdi]
test rbx, rbx
je 0x140001cc5
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x58], rsi
test rax, rax
jne 0x140001c64
mov ebp, esi
jmp 0x140001cc5
mov rcx, qword [rbx + 0x18]
lea r8, [rsp + 0x58]
lea rdx, [0x14005b9b8]
call qword [case.0x14001287a.0]
mov ebp, eax
test eax, eax
js 0x140001ca7
mov rax, qword [rbx + 0x20]
mov r9d, 1
mov rdx, qword [rsp + 0x58]
add rax, 8
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebp, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001cbe
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001287a.0]
mov rcx, qword [0x140068588]
add rdi, 8
cmp rdi, rcx
jb 0x140001c42
mov rbp, qword [rsp + 0x50]
mov rcx, r14
call fcn.14000bf2c
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x140001d05
mov rcx, r14
call fcn.14000befc
test eax, eax
setne sil
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop rbx
ret
mov rsi, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x38
pop r14
pop rbx
ret