Function at 0x1400db140
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x70], rax
movzx r15d, r8b
mov byte [rsp + 0x31], r8b
mov r14, rdx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x78], ebx
mov dil, 1
mov byte [rsp + 0x30], dil
call fcn.1400d66a0
mov r13, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x78], rcx
cmp r13, rcx
je 0x1400db8b6
movabs r9, 0x7ffffffffffffffe
movabs r10, 0x7fffffffffffffff
nop
cmp byte [r13 + 0x10], 0
je 0x1400db3f3
mov ecx, dword [r13]
mov r8, qword [0x140688228]
mov rax, qword [r8 + 8]
mov rdx, r8
cmp byte [rax + 0x19], 0
jne 0x1400db1fa
cmp dword [rax + 0x20], ecx
jge 0x1400db1ee
mov rax, qword [rax + 0x10]
jmp 0x1400db1f4
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400db1e3
cmp byte [rdx + 0x19], 0
jne 0x1400db205
cmp ecx, dword [rdx + 0x20]
jge 0x1400db208
mov rdx, r8
or r12d, 4
cmp rdx, r8
jne 0x1400db22c
mov qword [rbp - 0x30], rbx
mov rsi, rbx
mov qword [rbp - 0x20], rbx
mov r8d, 7
mov qword [rbp - 0x18], r8
mov word [rbp - 0x30], bx
jmp 0x1400db255
add rdx, 0x28
lea rcx, [rbp - 0x30]
call fcn.1400733c0
mov r8, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
movabs r9, 0x7ffffffffffffffe
movabs r10, 0x7fffffffffffffff
mov rcx, qword [r13 + 8]
mov edi, ebx
mov rax, qword [r14]
and rax, rcx
je 0x1400db273
mov rax, qword [r14 + 8]
and rax, rcx
sete dil
xor edi, 1
inc edi
test r15b, r15b
jne 0x1400db45c
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
lea r15, [rbp - 0x30]
cmp r8, 8
cmovae r15, qword [rbp - 0x30]
cmp rsi, 8
jae 0x1400db2c5
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], 7
jmp 0x1400db308
mov r14, rsi
or r14, 7
cmp r14, r9
cmova r14, r9
lea rcx, [r14 + 1]
cmp rcx, r10
ja 0x1400db8f3
lfence
add rcx, rcx
call fcn.140073800
mov qword [rsp + 0x58], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.14035bc80
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x58]
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rdx, qword [rsi]
lea rcx, [rbp + 0x30]
call fcn.1400acf70
or r12d, 8
lea rcx, [rsp + 0x58]
call fcn.140073b90
mov rcx, qword [rbp + 0x50]
cmp dword [rbp + 0x68], 0
je 0x1400db40b
test rcx, rcx
je 0x1400db38a
mov rdx, qword [rbp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db379
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db8ed
call fcn.140359090
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x30]
call fcn.140073b90
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400db3d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db3cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db8e7
call fcn.140359090
movzx edi, byte [rsp + 0x30]
movabs r10, 0x7fffffffffffffff
movabs r9, 0x7ffffffffffffffe
movzx r15d, byte [rsp + 0x31]
add r13, 0x18
cmp r13, qword [rsp + 0x78]
je 0x1400db8b6
mov r14, qword [rbp - 0x80]
jmp 0x1400db1c0
test rcx, rcx
je 0x1400db44d
mov rdx, qword [rbp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db43c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db8ed
call fcn.140359090
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x30]
call fcn.140073b90
mov r8, qword [rbp - 0x18]
jmp 0x1400db461
mov rsi, qword [rsp + 0x50]
mov rax, qword [r13 + 8]
cmp rax, qword [0x140676be8]
jne 0x1400db56f
test edi, edi
jne 0x1400db56f
lea rdx, [rbp - 0x30]
cmp r8, 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
je 0x1400db86c
cmp eax, 2
je 0x1400db86c
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x1400db514
test byte [rcx + 0x1c], 1
je 0x1400db514
cmp byte [rcx + 0x19], 4
jb 0x1400db514
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x70]
call fcn.1400733c0
or r12d, 0x11
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r9, qword [rbp - 0x30]
mov rax, qword [str.0cg_]
mov edx, 0x19
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rcx
lea r8, [0x1405f7168]
mov rcx, qword [rax + 0x10]
call fcn.140084db0
test r12b, 1
je 0x1400db562
and r12d, 0xfffffffe
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400db55e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db8f9
call fcn.140359090
mov word [rbp - 0x70], bx
xor dil, dil
mov byte [rsp + 0x30], dil
jmp 0x1400db871
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
test edi, edi
je 0x1400db590
cmp edi, 1
je 0x1400db602
cmp edi, 2
je 0x1400db592
mov edi, ebx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov qword [rsp + 0x48], rbx
mov ecx, 4
call fcn.1403590cc
mov qword [rsp + 0x38], rax
lea rcx, [rax + 4]
mov qword [rsp + 0x48], rcx
xor edx, edx
mov dword [rax], edx
mov qword [rsp + 0x40], rcx
or r12d, 0x20
mov rax, qword [rsp + 0x38]
mov dword [rax], edi
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
mov rsi, qword [rbp - 0x20]
lea r14, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r14, qword [rbp - 0x30]
cmp rsi, 8
jae 0x1400db609
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], 7
jmp 0x1400db65e
mov edi, 1
jmp 0x1400db592
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400db8e1
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp - 0x10], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14035bc80
mov qword [rbp + 8], rdi
mov qword [rbp], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
cmp r14, r15
je 0x1400db6ba
mov rdi, r15
sub rdi, r14
mov rcx, rdi
call fcn.140073800
mov rsi, rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
add rax, rdi
mov qword [rbp + 0x20], rax
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.14035bc80
sub rsi, r14
add rsi, r15
mov qword [rbp + 0x18], rsi
mov r14, qword [rsp + 0x38]
mov r9d, 4
mov dword [rbp + 0x28], r9d
test r14, r14
je 0x1400db710
mov rdx, qword [rsp + 0x48]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x1400db6f6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db8ff
mov rcx, r14
call fcn.140359090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov r9d, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
sub rcx, rax
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
je 0x1400db816
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x1400db7be
test byte [rcx + 0x1c], 1
je 0x1400db7be
cmp byte [rcx + 0x19], 4
jb 0x1400db7be
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x50]
call fcn.1400733c0
or r12d, 0x42
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r9, qword [rbp - 0x30]
mov rax, qword [str.0cg_]
mov edx, 0x1a
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rcx
lea r8, [0x1405f7168]
mov rcx, qword [rax + 0x10]
call fcn.140084db0
test r12b, 2
je 0x1400db80c
and r12d, 0xfffffffd
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400db808
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db905
call fcn.140359090
mov word [rbp - 0x50], bx
xor dil, dil
mov byte [rsp + 0x30], dil
jmp 0x1400db81b
movzx edi, byte [rsp + 0x30]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400db861
mov rdx, qword [rbp + 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db90b
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
lea rcx, [rbp - 0x10]
call fcn.140073b90
jmp 0x1400db871
movzx edi, byte [rsp + 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400db3d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400db8ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db911
call fcn.140359090
jmp 0x1400db3d9
movzx eax, dil
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140073980
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140073980
int3
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3