Function at 0x14000fc88
Capabilities:
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xdb0
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0xda0], rax
mov r14, rcx
lea r8, str.CFileUninstaller::DeleteFilesInStartup__
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
mov ecx, 8
call fcn.140061238
xor r15d, r15d
cmp rax, r15
je 0x14000fcff
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
jmp 0x14000fd02
mov rax, r15
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.140005ed4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov r9d, 0x20019
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.14000bc38
mov ebp, 0x104
mov r12d, reloc.OLEAUT32.dll_SafeArrayDestroy
lea r13d, [r12 - 0xe]
cmp eax, r15d
jne 0x14000ffa5
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Common_Startup
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x14000fecc
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rcx, [rsp + 0x160]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0xa8]
lea r9, [rsp + 0x38]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000739c
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0x80]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rbx
cmp qword [rsp + 0x58], 0x10
jb 0x14000fe2a
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
lea r9, [rsp + 0x160]
lea r8, str._sHewlett_Packard
mov rdx, rbp
lea rcx, [rsp + 0x270]
call fcn.14009841c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rcx, [rsp + 0x270]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x38]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0xa8]
lea r9, [rsp + 0x38]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000739c
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0x80]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rbx
cmp qword [rsp + 0x58], 0x10
jb 0x14000fecc
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Common_Desktop
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x14000ff89
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rcx, [rsp + 0x160]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0xa8]
lea r9, [rsp + 0x38]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000739c
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0x80]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rdx, qword [rbx + 8]
mov qword [rdx], rbx
cmp qword [rsp + 0x58], 0x10
jb 0x14000ff89
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
cmp rsi, r15
je 0x14000ff9e
mov rcx, rsi
call fcn.14004e608
mov rsi, r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
jmp 0x14000ffaa
mov rsi, qword [rsp + 0x60]
mov ebp, r15d
mov r9d, 0x103
lea r8, [rsp + 0x380]
xor edx, edx
mov r13, 0xffffffff80000003
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r15d
jne 0x1400101ce
lea r9, [rsp + 0x380]
lea r8, str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, 0x800
lea rcx, [rsp + 0x5a0]
call fcn.14009841c
mov r9d, 0x20019
lea r8, [rsp + 0x5a0]
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.14000bc38
cmp eax, r15d
jne 0x1400101a5
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Startup
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x140010189
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rcx, [rsp + 0x160]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0xa8]
lea r9, [rsp + 0x38]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000739c
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rbx
cmp qword [rsp + 0x58], 0x10
jb 0x1400100e3
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
lea r9, [rsp + 0x160]
lea r8, str._sHewlett_Packard
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.14009841c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rcx, [rsp + 0x270]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x38]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0xa8]
lea r9, [rsp + 0x38]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000739c
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rbx
cmp qword [rsp + 0x58], 0x10
jb 0x140010189
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
cmp rsi, r15
je 0x14001019e
mov rcx, rsi
call fcn.14004e608
mov rsi, r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
jmp 0x1400101aa
mov rsi, qword [rsp + 0x60]
inc ebp
mov r9d, 0x103
lea r8, [rsp + 0x380]
mov edx, ebp
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r15d
je 0x14000ffd6
mov ecx, 8
call fcn.140061238
cmp rax, r15
je 0x1400101ea
lea rcx, [rsp + 0xb8]
mov qword [rax], rcx
jmp 0x1400101ed
mov rax, r15
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xb8]
call fcn.140005ed4
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], r15
lea r8, [r14 + 0x10]
lea rdx, str.Scrubber.
lea rcx, [rsp + 0x130]
call fcn.14000d2d8
nop
lea r8, [0x1400c6360]
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.14000e9d8
nop
lea r8, str.Startup
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000e9d8
nop
cmp qword [rax + 0x20], 0x10
jb 0x140010265
mov rdx, qword [rax + 8]
jmp 0x140010269
lea rdx, [rax + 8]
lea r9, [rsp + 0xb8]
xor r8d, r8d
mov rcx, qword [r14 + 0x4e0]
call fcn.14003e968
nop
cmp qword [rsp + 0x58], 0x10
jb 0x140010293
mov rcx, qword [rsp + 0x40]
call fcn.14006127c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
cmp qword [rsp + 0x120], 0x10
jb 0x1400102ba
mov rcx, qword [rsp + 0x108]
call fcn.14006127c
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x118], r15
mov byte [rsp + 0x108], r15b
cmp qword [rsp + 0x150], 0x10
jb 0x1400102ea
mov rcx, qword [rsp + 0x138]
call fcn.14006127c
mov byte [rsp + 0x490], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x491]
call fcn.1400988d0
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rdi]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
cmp rbp, r15
je 0x140010343
cmp rbp, rax
je 0x140010348
call fcn.14009861c
cmp rbx, rdi
je 0x14001053d
cmp rbp, r15
jne 0x140010360
call fcn.14009861c
mov r11, r15
jmp 0x140010364
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x28]
jne 0x14001036f
call fcn.14009861c
cmp qword [rbx + 0x30], 0x10
jb 0x14001037c
mov r9, qword [rbx + 0x18]
jmp 0x140010380
lea r9, [rbx + 0x18]
lea r8, str.Deleting_files_from_directory__s_n
mov edx, 1
lea rcx, [0x14010f570]
call fcn.140001000
mov r13, qword [rsp + 0xe0]
mov rax, qword [r13]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xf0], xmm0
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
cmp r12, r15
je 0x1400103de
cmp r12, rax
je 0x1400103e3
call fcn.14009861c
cmp rdi, r13
je 0x140010507
cmp r12, r15
jne 0x1400103fb
call fcn.14009861c
mov r11, r15
jmp 0x1400103ff
mov r11, qword [r12]
cmp rdi, qword [r11 + 0x28]
jne 0x14001040a
call fcn.14009861c
cmp qword [rdi + 0x30], 0x10
jb 0x140010417
mov r13, qword [rdi + 0x18]
jmp 0x14001041b
lea r13, [rdi + 0x18]
cmp rbp, r15
jne 0x14001042a
call fcn.14009861c
mov r11, r15
jmp 0x14001042e
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x28]
jne 0x140010439
call fcn.14009861c
cmp qword [rbx + 0x30], 0x10
jb 0x140010446
mov r9, qword [rbx + 0x18]
jmp 0x14001044a
lea r9, [rbx + 0x18]
mov qword [rsp + 0x20], r13
lea r8, [0x1400c63b8]
mov edx, 0x104
lea rcx, [rsp + 0x490]
call fcn.14009841c
cmp rbp, r15
jne 0x140010477
call fcn.14009861c
mov r11, r15
jmp 0x14001047b
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x28]
jne 0x140010486
call fcn.14009861c
cmp qword [rbx + 0x30], 0x10
jb 0x140010493
mov r13, qword [rbx + 0x18]
jmp 0x140010497
lea r13, [rbx + 0x18]
cmp r12, r15
jne 0x1400104a6
call fcn.14009861c
mov r11, r15
jmp 0x1400104aa
mov r11, qword [r12]
cmp rdi, qword [r11 + 0x28]
jne 0x1400104b5
call fcn.14009861c
cmp qword [rdi + 0x30], 0x10
jb 0x1400104c2
mov rdx, qword [rdi + 0x18]
jmp 0x1400104c6
lea rdx, [rdi + 0x18]
mov r8, r13
mov rcx, r14
call fcn.140041e68
cmp r12, r15
jne 0x1400104e0
call fcn.14009861c
mov r11, r15
jmp 0x1400104e4
mov r11, qword [r12]
cmp rdi, qword [r11 + 0x28]
jne 0x1400104ef
call fcn.14009861c
mov rdi, qword [rdi]
mov r13, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xb8]
jmp 0x1400103d4
cmp rbp, r15
jne 0x140010516
call fcn.14009861c
mov r11, r15
jmp 0x14001051a
mov r11, qword [rbp]
cmp rbx, qword [r11 + 0x28]
jne 0x140010525
call fcn.14009861c
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x80]
jmp 0x140010339
lea r8, str.CFileUninstaller::DeleteFilesInStartup__
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
lea rcx, [rsp + 0xb8]
call fcn.140007328
mov rcx, qword [rsp + 0xe0]
call fcn.14006127c
mov qword [rsp + 0xe0], r15
mov rcx, qword [rsp + 0xb8]
call fcn.14006127c
nop
cmp rsi, r15
je 0x140010594
mov rcx, rsi
call fcn.14004e608
nop
lea rcx, [rsp + 0x80]
call fcn.140007328
mov rcx, qword [rsp + 0xa8]
call fcn.14006127c
mov qword [rsp + 0xa8], r15
mov rcx, qword [rsp + 0x80]
call fcn.14006127c
xor eax, eax
mov rcx, qword [rsp + 0xda0]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0xdb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret