Function at 0x140035440
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
mov ecx, 0xa
call fcn.140001d80
mov rcx, rbx
call fcn.140032d20
test eax, eax
jne 0x14003548d
lea r8d, [rax + 0x10]
lea rdx, str.Realtek_Audio
lea rcx, str._Removed_Realtek_Audio_driver_Failure__
call fcn.140001d60
jmp 0x1400358af
mov dword [rbx + 0x1b8], 1
xor ebp, ebp
lea r13, str.MicrosoftWindowsCurrentVersionUninstall
mov r14d, 0x80000002
or edi, 0xffffffff
cmp dword [rbx + 0x1a0], ebp
je 0x1400356b2
cmp dword [rbx + 0x1b0], ebp
je 0x1400356b2
call fcn.14003c3f0
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400354e0
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa0], rax
test r13, 0xffffffffffff0000
jne 0x140035523
movzx esi, r13w
mov ecx, esi
call fcn.14003c170
test rax, rax
je 0x140035534
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400060c0
jmp 0x140035534
mov rdx, r13
lea rcx, [rsp + 0xa0]
call fcn.140006560
nop
lea r8, [rsp + 0xa0]
lea rdx, [rbx + 0x198]
lea rcx, [rsp + 0x30]
call fcn.140006b70
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete sil
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140035596
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400355b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
je 0x1400355e1
lea rdx, str.F132AF7F_7BCA_4EDE_8A7C_958108FE7DBC
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rbx + 0x198]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035626
mov rcx, qword [rsp + 0x98]
call fcn.14000d010
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003566b
mov rcx, qword [rsp + 0x98]
call fcn.14000d010
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARE
mov ecx, 0x80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400356b2
mov rcx, qword [rsp + 0x98]
call fcn.14000d010
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x1b4], 0
je 0x1400357d9
call fcn.14003c3f0
mov rcx, rax
test rax, rax
setne bpl
test ebp, ebp
jne 0x1400356dd
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa8], rax
test r13, 0xffffffffffff0000
jne 0x14003571d
movzx esi, r13w
mov ecx, esi
call fcn.14003c170
test rax, rax
je 0x14003572e
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.1400060c0
jmp 0x14003572e
mov rdx, r13
lea rcx, [rsp + 0xa8]
call fcn.140006560
nop
lea rdx, [rbx + 0x198]
lea r8, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.140006b70
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete sil
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140035790
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x1400357b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
je 0x1400357d9
lea rdx, str.5449FB4F_1802_4D5B_A6D8_087DB1142147
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003589f
cmp dword [rbx + 0x1b0], eax
je 0x14003589f
lea rdx, str.Alcmtr
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.AlcWzrd
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RTHDCPL
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RtHDVCpl
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SOUNDMAN
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SkyTel
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
lea ecx, [rdx + 5]
mov r8d, edx
call fcn.140026120
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret