Function at 0x100002ae4
Capabilities:
Delete registry key
Generate random numbers via rtlgenrandom
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and qword [r11 - 0x68], 0
lea rax, [r11 - 0x68]
mov rbx, rcx
mov edi, 0x2001f
mov r14, 0xffffffff80000002
lea rdx, [0x100001380]
xor r8d, r8d
mov r9d, edi
mov rcx, r14
mov qword [rsp + 0x20], rax
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100002b53
xor al, al
jmp 0x100002fa5
xor r10d, r10d
lea r15, [0x100000000]
lea r12d, [r10 + 0x10]
movzx eax, byte [r10 + r15 + 0x6120]
inc r10
cmp r10, r12
mov r8b, byte [rax + rbx]
mov byte [rsp + r10 + 0x7f], r8b
jl 0x100002b61
lea rax, [rsp + 0x68]
lea rdx, [0x100001380]
mov r9d, edi
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100002c0a
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1000013cc]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1000013d4]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1000013dc]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1000013e0]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
mov edx, r12d
mov byte [rsp + 0x98], 0
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100002f92
lea r8, [rsp + 0x90]
xor r9d, r9d
movzx ecx, byte [rsp + r9 + 0x80]
inc r9
mov rax, rcx
and ecx, 0xf
shr rax, 4
mov al, byte [rax + r15 + 0x6130]
mov byte [r8], al
mov al, byte [rcx + r15 + 0x6130]
add r8, 2
cmp r9, 4
mov byte [r8 - 1], al
jl 0x100002c32
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000013e0]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100002f92
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov r14d, 3
lea rdx, [0x1000013e4]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbx, [rsp + 0x90]
xor edi, edi
lea rcx, [rsp + 0x70]
mov edx, r12d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100002f92
movzx ecx, byte [rsp + rdi + 0x84]
inc rdi
mov rax, rcx
and ecx, 0xf
shr rax, 4
mov al, byte [rax + r15 + 0x6130]
mov byte [rbx], al
mov al, byte [rcx + r15 + 0x6130]
add rbx, 2
cmp rdi, 4
mov byte [rbx - 1], al
jl 0x100002cfa
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov edi, 0x20006
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x1000013d4]
xor r8d, r8d
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100002dbe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
lea rdx, [0x1000013f0]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
mov edx, r12d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100002f92
lea r8, [rsp + 0x90]
xor r9d, r9d
movzx ecx, byte [rsp + r9 + 0x88]
inc r9
mov rax, rcx
and ecx, 0xf
shr rax, 4
mov al, byte [rax + r15 + 0x6130]
mov byte [r8], al
mov al, byte [rcx + r15 + 0x6130]
add r8, 2
cmp r9, 4
mov byte [r8 - 1], al
jl 0x100002dde
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000013dc]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100002e8e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
lea rdx, [0x100001400]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x80]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100002f92
lea rcx, [rsp + 0x70]
mov edx, r12d
lea rbx, [rsp + 0x90]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100002f92
xor r8d, r8d
movzx ecx, byte [rsp + r8 + 0x8c]
inc r8
mov rax, rcx
and ecx, 0xf
shr rax, 4
mov al, byte [rax + r15 + 0x6130]
mov byte [rbx], al
mov al, byte [rcx + r15 + 0x6130]
add rbx, 2
cmp r8, 4
mov byte [rbx - 1], al
jl 0x100002ec8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000013cc]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100002f8f
lea rcx, [rsp + 0x80]
mov edx, r12d
call sub.ADVAPI32.dll_SystemFunction036
mov rcx, qword [rsp + 0x50]
test al, al
jne 0x100002f62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100002f92
lea rax, [rsp + 0x70]
lea rdx, [0x100001410]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov sil, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100002fa2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, sil
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1000038f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret