Function at 0x140011480
Capabilities:
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x700
mov qword [rax - 0x548], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov r15d, ecx
mov dword [rsp + 0x38], ecx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140011c58
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov ecx, r15d
call fcn.140022a80
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011866
cmp qword [rsp + 0x50], 0
je 0x140011866
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140011c63
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x14009a4b8]
lea rcx, [rsp + 0x48]
call fcn.14000ce70
test al, al
jne 0x140011575
lea rdx, [0x14009a4b8]
lea rcx, [rsp + 0x48]
call fcn.14000c670
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140011c6e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000ce70
test al, al
jne 0x1400115bc
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000c670
nop
mov dword [rsp + 0x70], 0x400
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x1e0]
call fcn.14005ab10
nop
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rax, [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rax
je 0x14001161f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, 0xffffffffffffffff
test ebx, ebx
jne 0x140011654
lea rcx, [rsp + 0x2f0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011635
mov r8d, eax
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.14000d350
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jl 0x140011724
lea rdx, [0x14009a4c8]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140011724
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140011724
mov r8d, dword [rbx - 0x10]
add r8d, 0xfffffff9
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x30]
call fcn.14000bcd0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400116fe
cmp dword [rbx + 0x10], 0
jl 0x1400116ef
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400116ef
call fcn.14000d260
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400116e4
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x1400116fe
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000d350
nop
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001171f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x30]
call fcn.14000b940
test al, al
je 0x14001182c
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140011c79
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.10..
lea rcx, [rsp + 0x78]
call fcn.14000ce70
test al, al
jne 0x140011784
lea rdx, str.10..
lea rcx, [rsp + 0x78]
call fcn.14000c670
nop
mov rdx, qword [rsp + 0x78]
lea r14, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp r14, rdi
je 0x1400117e6
cmp dword [rdi + 0x10], 0
jl 0x1400117d3
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x1400117d3
mov rcx, r14
call fcn.14000d260
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400117c8
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x30], rbx
jmp 0x1400117e6
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000d350
mov rbx, qword [rsp + 0x30]
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProxyOverride
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140011827
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011846
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001186d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001186d
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x148]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], r12w
mov r8d, 9
lea rdx, str.stemp.bat
lea rcx, [rsp + 0x148]
call fcn.14000e890
nop
mov qword [rsp + 0x178], r12
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], r12w
mov r8d, 6
lea rdx, [0x14009a3b8]
lea rcx, [rsp + 0x168]
call fcn.14000e890
nop
lea r9, [rsp + 0x148]
mov r8d, 0x91
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x60]
call fcn.14000dfc0
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x188], rax
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x90]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x138]
call fcn.14000bc20
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x140], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400119ab
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1a0], rcx
call fcn.14000d260
mov qword [rsp + 0x1a8], rax
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, str.system_settings_changed
lea rcx, [rsp + 0xc8]
call fcn.14000c8e0
nop
mov r8d, esi
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.14005c860
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0xd0]
call fcn.14000c8e0
mov rdi, rax
lea rdx, str.Necessary_changes_have_been_done.
lea rcx, [rsp + 0xd8]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0xe0]
call fcn.14000c8e0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r15d
call fcn.14005d360
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xe8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140011ad7
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140011ae0
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140011c84
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x58]
call fcn.14000ce70
test al, al
jne 0x140011b27
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x58]
call fcn.14000c670
nop
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140011b43
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011b54
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140011c8f
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb8], rax
mov edi, 2
mov dword [rsp + 0x40], edi
mov r9, qword [rsp + 0x58]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xb8]
call fcn.14000d050
mov rbx, qword [rsp + 0xb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011bcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011bec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011c0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140011c2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
int3