Function at 0x14001ef90
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x2c8]
sub rsp, 0x3b0
mov rax, qword [0x1400cc0b8]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor edi, edi
mov ebx, 0x1fe
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.14006f000
mov r8d, ebx
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
lea r8d, [rdi + 6]
lea rdx, [0x1400b19f8]
lea rcx, [rbp + 8]
call fcn.140009374
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r8d, [rdi + 0xe]
lea rdx, str.XenosProfile64
lea rcx, [rsp + 0x48]
call fcn.140009374
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
lea r8d, [rdi + 0x1e]
lea rdx, str.Xenos_64_bit_injection_profile
lea rcx, [rbp - 0x18]
call fcn.140009374
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0xa0]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], di
jne 0x14001f07c
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
mov r8d, 0xa
lea rdx, str.___load__1
lea rcx, [rsp + 0x68]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rdi
mov r13d, 7
mov qword [rax + 0x18], r13
mov word [rax], di
mov r14d, 0x1000
mov rdx, qword [rbp - 0x80]
lea esi, [r13 + 1]
cmp rdx, rsi
jb 0x14001f124
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, r14
jb 0x14001f11f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f938
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp + 0xa0]
mov r8, rbx
inc r8
cmp word [rax + r8*2], di
jne 0x14001f150
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x78]
call fcn.140009374
nop
mov r8d, 9
lea rdx, str.___run__1
lea rcx, [rbp - 0x78]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov word [rax], di
mov rdx, qword [rbp - 0x60]
cmp rdx, rsi
jb 0x14001f1e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r14
jb 0x14001f1e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f93e
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], di
lea r9, [rbp + 0x92]
mov r8d, 0x87
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001f203
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x92]
cmp r9, rax
jne 0x14001f265
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
jmp 0x14001f280
lea r8, [rbp + 0x92]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea rax, [rbp + 0xa0]
inc rbx
cmp word [rax + rbx*2], di
jne 0x14001f296
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x28]
call fcn.140009374
nop
mov r8d, 2
lea rdx, [0x1400afdc4]
lea rcx, [rbp + 0x28]
call fcn.140009ff0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
mov word [rax], di
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x48]
call fcn.14001fc30
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, rsi
jb 0x14001f332
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r14
jb 0x14001f32c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f944
call fcn.14006c550
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, rsi
jb 0x14001f36d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, r14
jb 0x14001f368
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f94a
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], di
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x14001f3ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, r14
jb 0x14001f3b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f950
call fcn.14006c550
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae rdx, qword [rsp + 0x48]
mov r13, 0xffffffff80000000
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [rsp + 0x58]
add eax, eax
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], rsi
cmovae rdx, qword [rbp + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r8d, [rbx + 0xe]
lea rdx, str.Application_xml
lea rcx, [rsp + 0x68]
call fcn.140009374
mov eax, dword [rsp + 0x78]
add eax, eax
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], rsi
cmovae rcx, qword [rsp + 0x68]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], rsi
cmovae rdx, qword [rbp + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
lea r8, str.Content_Type
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x14001f4ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, r14
jb 0x14001f4b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f956
call fcn.14006c550
mov eax, dword [rbp - 8]
add eax, eax
lea rcx, [rbp - 0x18]
cmp qword [rbp], rsi
cmovae rcx, qword [rbp - 0x18]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae rdx, qword [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 3
lea rdx, [0x1400b1ad8]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
mov rcx, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 6
jb 0x14001f95c
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], 6
lea rax, str._shell
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x78]
call fcn.14001de74
mov eax, dword [rsp + 0x78]
add eax, eax
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], rsi
cmovae rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], rsi
cmovae rdx, qword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp - 0x78]
call fcn.140007668
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x14001f5f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, r14
jb 0x14001f5ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f962
call fcn.14006c550
mov rax, rbx
mov rcx, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 0x13
jb 0x14001f968
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0x13
lea rax, str._shellEditcommand
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x78]
call fcn.14001de74
mov eax, dword [rbp - 0x28]
add eax, eax
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], rsi
cmovae rcx, qword [rbp - 0x38]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], rsi
cmovae rdx, qword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp - 0x78]
call fcn.140007668
mov rax, rbx
mov rcx, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 0x12
jb 0x14001f96e
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0x12
lea rax, str._shellRuncommand
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x78]
call fcn.14001de74
mov eax, dword [rbp - 0x48]
add eax, eax
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], rsi
cmovae rcx, qword [rbp - 0x58]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], rsi
cmovae rdx, qword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp - 0x78]
call fcn.140007668
mov rax, qword [rsp + 0x58]
sub rbx, rax
cmp rbx, 0xc
jb 0x14001f974
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0xc
lea rcx, str.DefaultIcon
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x78]
call fcn.14001de74
mov eax, dword [rbp + 0x58]
add eax, eax
lea r8, [rbp + 0x48]
cmp qword [rbp + 0x60], rsi
cmovae r8, qword [rbp + 0x48]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], rsi
cmovae rdx, qword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp - 0x78]
call fcn.140007668
nop
lea rcx, [rbp + 0x48]
call fcn.140007668
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, rsi
jb 0x14001f7d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, r14
jb 0x14001f7d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f97a
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], di
mov rdx, qword [rbp - 0x20]
cmp rdx, rsi
jb 0x14001f822
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, r14
jb 0x14001f81d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f980
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], di
mov rdx, qword [rbp]
cmp rdx, rsi
jb 0x14001f86e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, r14
jb 0x14001f869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f986
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], di
mov rdx, qword [rsp + 0x60]
cmp rdx, rsi
jb 0x14001f8bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, r14
jb 0x14001f8b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f98c
call fcn.14006c550
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdx, qword [rbp + 0x20]
cmp rdx, rsi
jb 0x14001f906
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, r14
jb 0x14001f901
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f932
call fcn.14006c550
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14006c530
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
int3
call fcn.14007d788
nop
call fcn.1400012b0
nop
call fcn.14007d788
int3
call fcn.1400012b0
int3
call fcn.1400012b0
int3
call fcn.1400012b0
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
int3