Function at 0x1400c3a40
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
xor edx, edx
mov cl, 1
call fcn.1401d3b80
mov r14, rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], r13
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
mov dword [rbp + 0x58], 2
test rax, rax
jne 0x1400c3b09
lea rcx, str.0cg_
mov rax, qword [str.0cg_]
cmp rax, rcx
je 0x1400c3b01
test byte [rax + 0x1c], 1
je 0x1400c3b01
cmp byte [rax + 0x19], 2
jb 0x1400c3b01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea edx, [r13 + 0x1f]
mov r9d, eax
lea r8, [0x1405f62c8]
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
xor r12b, r12b
jmp 0x1400c44bb
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov qword [rbp - 0x38], r13
movabs rcx, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
cmp qword [rbx + 0x10], 0
jbe 0x1400c3fff
mov r12, qword [rbx + 8]
mov qword [rsp + 0x70], r12
mov rbx, qword [r12]
cmp rbx, r12
je 0x1400c3fff
mov r14d, r13d
nop dword [rax]
lea r13, [rbx + 0x10]
xor eax, eax
mov qword [rbp + 0x10], rax
mov esi, eax
mov qword [rbp + 0x20], rax
mov r15d, 7
mov qword [rbp + 0x28], r15
mov word [rbp + 0x10], ax
or r14d, 1
mov dword [rsp + 0x30], r14d
test r13, r13
je 0x1400c3e5f
lea ecx, [r15 + 0x7b]
call fcn.140368330
mov rdi, rax
test rax, rax
je 0x1400c3e48
xor eax, eax
mov r8d, eax
lea rdx, [r13 + 2]
lea r9d, [rsi + 2]
lea r10, str.0123456789abcdef
nop dword [rax]
movzx ecx, byte [rdx - 2]
shr rcx, 4
movzx eax, word [r10 + rcx*2]
mov word [rdi + r8*2], ax
movzx eax, byte [rdx - 2]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 2], ax
movzx eax, byte [rdx - 1]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 4], ax
movzx eax, byte [rdx - 1]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 6], ax
movzx eax, byte [rdx]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 8], ax
movzx eax, byte [rdx]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0xa], ax
movzx eax, byte [rdx + 1]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0xc], ax
movzx eax, byte [rdx + 1]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0xe], ax
movzx eax, byte [rdx + 2]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x10], ax
movzx eax, byte [rdx + 2]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x12], ax
movzx eax, byte [rdx + 3]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x14], ax
movzx eax, byte [rdx + 3]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x16], ax
movzx eax, byte [rdx + 4]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x18], ax
movzx eax, byte [rdx + 4]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x1a], ax
movzx eax, byte [rdx + 5]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x1c], ax
movzx eax, byte [rdx + 5]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x1e], ax
movzx eax, byte [rdx + 6]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x20], ax
movzx eax, byte [rdx + 6]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x22], ax
movzx eax, byte [rdx + 7]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x24], ax
movzx eax, byte [rdx + 7]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x26], ax
movzx eax, byte [rdx + 8]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x28], ax
movzx eax, byte [rdx + 8]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x2a], ax
movzx eax, byte [rdx + 9]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x2c], ax
movzx eax, byte [rdx + 9]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x2e], ax
movzx eax, byte [rdx + 0xa]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x30], ax
movzx eax, byte [rdx + 0xa]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x32], ax
movzx eax, byte [rdx + 0xb]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x34], ax
movzx eax, byte [rdx + 0xb]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x36], ax
movzx eax, byte [rdx + 0xc]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x38], ax
movzx eax, byte [rdx + 0xc]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x3a], ax
movzx eax, byte [rdx + 0xd]
shr rax, 4
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x3c], ax
movzx eax, byte [rdx + 0xd]
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [rdi + r8*2 + 0x3e], ax
lea r8, [r8 + 0x20]
lea rdx, [rdx + 0x10]
sub r9, 1
jne 0x1400c3bb0
xor r13d, r13d
mov word [rdi + r8*2], r13w
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdi + r8*2], si
jne 0x1400c3e20
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400739a0
mov rcx, rdi
call fcn.1403683a0
mov r15, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x20]
jmp 0x1400c3e4b
xor r13d, r13d
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
mov rdi, qword [rbp + 0x10]
test rsi, rsi
je 0x1400c3f8e
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea r12, [rbp + 0x10]
cmp r15, 8
cmovae r12, rdi
cmp rsi, 8
jae 0x1400c3ea7
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
jmp 0x1400c3f02
or rsi, 7
cmp rsi, rcx
cmova rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, rdx
ja 0x1400c4513
lfence
add rcx, rcx
call fcn.140073800
mov qword [rsp + 0x50], rax
mov rdi, qword [rbp + 0x20]
lea r8, [rdi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.14035bc80
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov r15, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x10]
movups xmm0, xmmword [rsp + 0x50]
mov r14d, dword [rsp + 0x30]
mov rax, qword [rbp - 0x40]
cmp rax, qword [rbp - 0x38]
je 0x1400c3f2f
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x60], r13
mov edx, 7
mov word [rsp + 0x50], r13w
add qword [rbp - 0x40], 0x20
jmp 0x1400c3f46
lea r8, [rsp + 0x50]
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x48]
call fcn.140079680
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400c3f83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c3f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c450d
call fcn.140359090
mov word [rsp + 0x50], r13w
mov r12, qword [rsp + 0x70]
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
cmp r15, 8
jb 0x1400c3fd2
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400c3fca
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4519
mov rcx, rdi
call fcn.140359090
mov word [rbp + 0x10], r13w
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r12
je 0x1400c3ffb
movabs rcx, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
jmp 0x1400c3b50
mov r14, qword [rbp + 0x30]
xor r12b, r12b
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov r8d, 0x10
lea rdx, str.WhiteThumbprints
lea rcx, [rbp - 0x68]
call fcn.1400739a0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400c4081
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c407c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c451f
call fcn.140359090
test ebx, 0xfffffffd
je 0x1400c40ee
lea rcx, str.0cg_
mov rax, qword [str.0cg_]
cmp rax, rcx
je 0x1400c444f
test byte [rax + 0x1c], 1
je 0x1400c444f
cmp byte [rax + 0x19], 2
jb 0x1400c444f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
mov edx, 0x20
mov dword [rsp + 0x20], eax
lea r9, str.WhiteThumbprints
lea r8, [0x1405f62c8]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
mov rsi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
jmp 0x1400c445c
mov rsi, qword [rbp - 0x40]
mov rax, rsi
mov rbx, qword [rbp - 0x48]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x1400c4459
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov rdi, r13
mov rcx, rbx
cmp rbx, rsi
je 0x1400c4145
nop word [rax + rax]
mov rax, qword [rcx + 0x10]
lea rdi, [rdi + rax*2]
add rdi, 2
add rcx, 0x20
cmp rcx, rsi
jne 0x1400c4130
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov qword [rsp + 0x48], r13
add rdi, 2
je 0x1400c41a3
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1400c4525
lfence
mov rcx, rdi
call fcn.140073800
mov qword [rsp + 0x38], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x48], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14035c350
mov qword [rsp + 0x40], rbx
mov r14, qword [rbp + 0x30]
mov rsi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
mov rdi, r13
cmp rbx, rsi
je 0x1400c41f0
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400c41bd
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
add r8, r8
mov rcx, qword [rsp + 0x38]
add rcx, rdi
call fcn.14035bc80
mov rax, qword [rbx + 0x10]
lea rdi, [rdi + rax*2]
mov rax, qword [rsp + 0x38]
mov word [rax + rdi], r13w
add rdi, 2
add rbx, 0x20
cmp rbx, rsi
jne 0x1400c41b0
mov rax, qword [rsp + 0x38]
mov word [rax + rdi], r13w
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov r8d, 0x10
lea rdx, str.WhiteThumbprints
lea rcx, [rsp + 0x78]
call fcn.1400739a0
nop
mov qword [rbp - 0x30], r13
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
lea rsi, [rsp + 0x78]
mov r15, qword [rsp + 0x78]
mov r13, qword [rbp - 0x70]
cmp r13, 8
cmovae rsi, r15
mov rdi, qword [rbp - 0x78]
cmp rdi, 8
jae 0x1400c426a
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
jmp 0x1400c42d1
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400c452b
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 0x78]
lea r8, [rbx*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r14, qword [rbp + 0x30]
mov r13, qword [rbp - 0x70]
mov r15, qword [rsp + 0x78]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor eax, eax
mov qword [rbp], rax
mov rsi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
cmp rsi, rax
je 0x1400c4336
mov rbx, rax
sub rbx, rsi
mov rcx, rbx
call fcn.140073800
mov rdi, rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rcx, [rax + rbx]
mov qword [rbp], rcx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
sub rdi, rsi
mov rax, qword [rsp + 0x70]
add rax, rdi
mov qword [rbp - 8], rax
mov rsi, qword [rsp + 0x38]
mov dword [rbp + 8], 7
cmp r13, 8
jb 0x1400c437d
lea rdx, [r13*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400c4370
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4531
mov rcx, r15
call fcn.140359090
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x1400c43b7
mov rdx, qword [rsp + 0x48]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400c43af
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4537
mov rcx, rsi
call fcn.140359090
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
sub rcx, rax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 8]
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r12d, r12b
mov ecx, 1
test eax, eax
cmove r12d, ecx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400c4443
mov rdx, qword [rbp]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c442d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c453d
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor r13d, r13d
mov qword [rbp], r13
jmp 0x1400c4446
xor r13d, r13d
lea rcx, [rbp - 0x30]
call fcn.140073b90
mov rsi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
jmp 0x1400c445c
mov r12b, 1
test rbx, rbx
je 0x1400c44bb
cmp rbx, rsi
je 0x1400c447b
mov rcx, rbx
call fcn.140073b90
add rbx, 0x20
cmp rbx, rsi
jne 0x1400c4466
mov rbx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x38]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400c44a7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4507
mov rcx, rbx
call fcn.140359090
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r13
test r14, r14
je 0x1400c44cd
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x30], r13
lea rcx, [rbp + 0x38]
call fcn.140073b90
movzx eax, r12b
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140073980
nop
call fcn.140368068
int3
call fcn.140368068
int3
call fcn.1400710c0
nop
call fcn.140073980
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
int3