Function at 0x34b376d60
Capabilities:
Check for peb beingdebugged flag
Delete registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov r12, rcx
cmp edx, 0x110
je 0x34b376db0
cmp edx, 0x111
je 0x34b376f80
cmp edx, 0x4e
je 0x34b376f40
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x965
call qword [sym.imp.user32.dll_GetDlgItem]
lea rdx, [rsp + 0x60]
mov r13, rax
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowRect]
mov eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x60]
xor r8d, r8d
lea r9, [rsp + 0x70]
mov edx, 0x1061
mov rcx, r13
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x78], eax
mov rsi, qword [sym.imp.user32.dll_SendMessageW]
call rsi
mov dword [rsp + 0x20], 0
mov r9d, 4
mov r8d, 5
mov edx, 0x10
mov ecx, 0x10
call qword [sym.imp.comctl32.dll_ImageList_Create]
mov rbx, rax
test rax, rax
je 0x34b376e87
mov rcx, qword [0x34b393008]
mov edx, 0xcc
call qword [sym.imp.user32.dll_LoadBitmapW]
mov r8d, 0xff00ff
mov rcx, rbx
mov r14, rax
mov rdx, rax
call qword [sym.imp.comctl32.dll_ImageList_AddMasked]
mov rcx, r14
call qword [sym.imp.gdi32.dll_DeleteObject]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.comctl32.dll_ImageList_SetBkColor]
mov edx, 0x1003
mov rcx, r13
mov r9, rbx
mov r8d, 2
call rsi
mov r8, rbx
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov edx, 2
mov rcx, r13
call sym.add_known_usages_to_list
call sym.get_cert_mgr_usages
mov rsi, rax
test rax, rax
je 0x34b376d93
mov rdi, qword [sym.imp.ucrtbase.dll_strchr]
mov edx, 0x2c
mov rcx, rax
mov r14, rsi
call rdi
cmp byte [rsi], 0
mov rbx, rax
jne 0x34b376efd
jmp 0x34b376f1d
mov byte [rbx], 0
mov rdx, r14
mov rcx, r13
call sym.find_oid_in_list
cmp rax, 0xffffffffffffffff
je 0x34b376ee6
mov edx, eax
mov rcx, r12
call sym.toggle_usage
lea r14, [rbx + 1]
mov edx, 0x2c
mov rcx, r14
call rdi
cmp byte [rbx + 1], 0
je 0x34b376f1d
mov rbx, rax
test rbx, rbx
jne 0x34b376ec8
mov rdx, r14
mov rcx, r13
call sym.find_oid_in_list
cmp rax, 0xffffffffffffffff
je 0x34b376f1d
mov edx, eax
mov rcx, r12
call sym.toggle_usage
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x34b376d93
cmp dword [r9 + 0x10], 0xfffffffe
jne 0x34b376d93
mov edx, dword [r9 + 0x18]
call sym.toggle_usage
mov rcx, r12
call qword [sym.imp.user32.dll_GetParent]
xor r9d, r9d
mov r8, r12
mov edx, 0x468
mov rcx, rax
call qword [sym.imp.user32.dll_SendMessageW]
jmp 0x34b376d93
cmp r8, 1
je 0x34b376fc0
cmp r8, 2
jne 0x34b376d93
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rax
call qword [sym.imp.comctl32.dll_ImageList_Destroy]
mov edx, 2
mov rcx, r12
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x34b376d93
mov edx, 0x965
call qword [sym.imp.user32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rdi, qword [sym.imp.user32.dll_SendMessageW]
mov rsi, rax
mov rcx, rax
call rdi
mov dword [rsp + 0x70], 0xc
mov dword [rsp + 0x78], 0
mov ebp, eax
mov dword [rsp + 0x80], 0xf000
test eax, eax
jle 0x34b3771e5
lea r13, [rsp + 0x70]
xor ebx, ebx
xor r14d, r14d
jmp 0x34b37702c
inc r14d
cmp ebp, r14d
je 0x34b3770d0
xor r8d, r8d
mov dword [rsp + 0x74], r14d
mov r9, r13
mov edx, 0x104b
mov rcx, rsi
call rdi
test rax, rax
je 0x34b377020
mov eax, dword [rsp + 0x7c]
shr eax, 0xc
cmp eax, 1
jne 0x34b377020
mov r15, qword [rsp + 0x98]
test rbx, rbx
je 0x34b3771a8
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rcx, qword [r15 + 8]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ucrtbase.dll_strlen]
mov r8, rbx
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rsp + 0x58]
lea r9, [rdx + rax + 2]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov rbx, rax
test rax, rax
je 0x34b3771de
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_strlen]
add rax, rbx
mov byte [rax], 0x2c
lea rcx, [rax + 1]
mov rdx, qword [r15 + 8]
call qword [sym.imp.ucrtbase.dll_strcpy]
jmp 0x34b377020
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rdx, [0x34b385760]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x34b37715d
test rbx, rbx
je 0x34b377235
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
inc eax
mov r9d, 1
lea rdx, str.Purpose
mov dword [rsp + 0x28], eax
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rax
call qword [sym.imp.comctl32.dll_ImageList_Destroy]
mov edx, 1
mov rcx, r12
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x34b376d93
mov rcx, qword [r15 + 8]
call qword [sym.imp.ucrtbase.dll_strlen]
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
lea r8, [rax + 1]
mov rcx, qword [rdx + 0x30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rax
test rax, rax
jne 0x34b3770c0
xor ebx, ebx
jmp 0x34b377020
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x40], 0
lea rdx, [0x34b385760]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x34b37715d
mov rcx, qword [rsp + 0x60]
lea rdx, str.Purpose
xor ebx, ebx
call qword [sym.imp.advapi32.dll_RegDeleteValueA]
jmp 0x34b377152