Function at 0x14004a90c
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp], rax
mov r12b, dl
mov byte [rsp + 0x54], dl
mov rdi, rcx
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x50], r14d
lea rax, [rcx + 0x138]
mov qword [rbp - 0x78], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0x168]
call fcn.14004bcd4
lea rcx, [rdi + 0x178]
call fcn.14004bcd4
mov dl, 1
mov rcx, rdi
call fcn.14004b56c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rbx, [rdi + 0x1b8]
lea edx, [r14 + 0x5c]
mov rcx, qword [rbx]
call fcn.1400bdad4
or r15d, 0xffffffff
test rax, rax
jne 0x14004a9c0
mov eax, r15d
jmp 0x14004a9c6
sub rax, qword [rbx]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140022e68
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r13d, 0x2001f
mov r9d, r13d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004aae9
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004aae9
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.140040d80
mov rbx, rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x78], rax
lea rcx, [0x14019b9a8]
mov rdx, qword [0x14019b9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], rax
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.error_in_clearRegKeysOfInject:
lea rcx, [rsp + 0x70]
call fcn.140002f54
cmp qword [rbx + 0x18], 0x10
jb 0x14004aab1
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140002f54
lea r8, [0x1401317a4]
lea rdx, [0x1401317a8]
lea rcx, [rsp + 0x70]
call fcn.14000d6b8
nop
lea rdx, [0x1401664c8]
lea rcx, [rsp + 0x70]
call fcn.1400c2fa8
nop
test r12b, r12b
je 0x14004ab37
lea r8, str._ver
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140018bf8
nop
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14004ab33
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x50]
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 7
jne 0x14004abb3
mov ecx, r14d
mov r9d, 0x99d722db
mov r10d, 0xd5
jmp 0x14004ab8a
mov eax, r8d
or eax, 0xffffffe6
add r8d, eax
inc ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x14004abad
mov eax, r9d
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd5
mov eax, r8d
sub eax, edx
cmp eax, r10d
jne 0x14004ab74
mov dword [0x1401a3d80], ecx
mov r15d, r14d
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edi, 0x7ffe
mov dword [rbp - 0x80], edi
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004abfa
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14000239c
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0xc], edi
jl 0x14004b094
mov dword [rbx - 0x10], edi
mov word [rbx + 0xfffc], r14w
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x80]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r13d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bbd4c
test eax, eax
js 0x14004b089
cmp eax, dword [rbx - 0xc]
jg 0x14004b089
mov dword [rbx - 0x10], eax
movsxd rcx, eax
mov word [rbx + rcx*2], r14w
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xc
jne 0x14004acb8
mov ecx, 4
call fcn.1400bb888
mov rdi, rax
call fcn.1400bba88
mov dword [rdi], eax
mov dword [0x1401a3d80], eax
mov rcx, rdi
call fcn.1400bb0b4
mov r8d, dword [0x1401a3d80]
cmp byte [0x1401a58bb], r14b
jne 0x14004ad74
imul r8d, r8d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xe
jne 0x14004ad25
lea ecx, [r8 + 0x1a]
call fcn.1400ba748
mov r14, rax
xor edi, edi
call fcn.1400bba88
add eax, dword [0x1401a3d80]
mov dword [r14 + rdi*4], eax
inc rdi
cmp rdi, 0xa
jl 0x14004acf8
mov ecx, dword [r14 + 0x24]
mov dword [0x1401a3d80], ecx
mov rcx, r14
call fcn.1400bc20c
xor r14d, r14d
mov dword [rbp - 0x20], 0xd004e
mov dword [rbp - 0x1c], 0x1e000f
mov dword [rbp - 0x18], 0x13
mov rcx, r14
mov edi, 5
lea r12, [0x14019ed90]
lea rdx, [0x14019f418]
movzx eax, byte [rcx + r12]
xor ax, word [rbp + rcx*2 - 0x20]
mov word [rdx + rcx*2], ax
inc rcx
cmp rcx, rdi
jl 0x14004ad50
mov byte [0x1401a58bb], 1
mov r12b, byte [rsp + 0x54]
jmp 0x14004ad79
mov edi, 5
lea r8, [0x14019f418]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.140018bf8
nop
or esi, 1
mov dword [rsp + 0x50], esi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004adc0
cmp dword [rbx - 0x10], r14d
jl 0x14004adc0
mov rcx, rbx
call fcn.1400bbf1c
test rax, rax
je 0x14004adc0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x14004ae98
cmp byte [0x1401a58b4], r14b
jne 0x14004ae11
mov dword [rbp - 0x10], 0xf004e
mov dword [rbp - 0xc], 0x5001c
mov dword [rbp - 8], 0x1f
mov rcx, r14
lea r12, [0x14019ed90]
lea rdx, [0x14019fc68]
movzx eax, byte [rcx + r12]
xor ax, word [rbp + rcx*2 - 0x10]
mov word [rdx + rcx*2], ax
inc rcx
cmp rcx, rdi
jl 0x14004adef
mov byte [0x1401a58b4], 1
mov r12b, byte [rsp + 0x54]
lea r8, [0x14019fc68]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140018bf8
nop
or esi, 2
mov dword [rsp + 0x50], esi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004ae54
cmp dword [rbx - 0x10], r14d
jl 0x14004ae54
mov rcx, rbx
call fcn.1400bbf1c
test rax, rax
je 0x14004ae54
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x14004ae98
call fcn.140041960
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.140018bf8
nop
or esi, 4
mov dword [rsp + 0x50], esi
mov rdx, qword [rax]
test rdx, rdx
je 0x14004ae9d
cmp dword [rbx - 0x10], r14d
jl 0x14004ae9d
mov rcx, rbx
call fcn.1400bbf1c
test rax, rax
je 0x14004ae9d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14004ae9d
mov dil, 1
jmp 0x14004aea0
mov dil, r14b
test sil, 4
je 0x14004aece
and esi, 0xfffffffb
mov dword [rsp + 0x50], esi
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004aec5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test sil, 2
je 0x14004aefc
and esi, 0xfffffffd
mov dword [rsp + 0x50], esi
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004aef3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test sil, 1
je 0x14004af2a
and esi, 0xfffffffe
mov dword [rsp + 0x50], esi
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004af21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test dil, dil
je 0x14004af42
mov r15d, r14d
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14004af45
inc r15d
test r13d, r13d
mov edi, 0x7ffe
je 0x14004abd5
test r12b, r12b
je 0x14004afbc
call fcn.1400417b8
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x58]
call fcn.140018bf8
nop
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14004afb5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
jmp 0x14004afc0
or r15d, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 2
jne 0x14004b047
mov r10d, 0xb7
mov ecx, r14d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x14004b040
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r14d
mov rdi, rsi
test eax, eax
jle 0x14004b038
mov edx, r9d
mov r11d, eax
add r10d, edx
dec edx
dec r11
jne 0x14004b02e
add r9d, ecx
dec rdi
jne 0x14004b024
inc ecx
cmp ecx, r10d
jl 0x14004b00e
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14004b064
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14004b085
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004b09f
mov ecx, 0x80070057
call fcn.14000187c
int3
mov ecx, 0x80070057
call fcn.14000187c
nop
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret