Function at 0x14013cfc7
Capabilities:
Delete registry key

Disassembly:
push rax
pushf
mov eax, 0x5f676e6f
pushf
not eax
add eax, 0x9f185ed5
xor eax, 0xacffd8a9
rol eax, 0x91
popf
pushf
not eax
add eax, 0xf48b7338
xor eax, 0xa2f24c99
rol eax, 0x9a
popf
cmp eax, 4
jne 0x14013d004
popf
pop rax
jmp 0x14013d49e
cmp eax, 0
jne 0x14013d013
popf
pop rax
jmp 0x14013d199
cmp eax, 3
jne 0x14013d022
popf
pop rax
jmp 0x14013d455
cmp eax, 1
jne 0x14013d031
popf
pop rax
jmp 0x14013d28b
cmp eax, 0xd
jne 0x14013d040
popf
pop rax
jmp 0x14013d92b
cmp eax, 0x1a
jne 0x14013d04f
popf
pop rax
jmp 0x14013df38
cmp eax, 0xe
jne 0x14013d05e
popf
pop rax
jmp 0x14013d9b3
cmp eax, 0xb
jne 0x14013d06d
popf
pop rax
jmp 0x14013d82a
cmp eax, 0x19
jne 0x14013d07c
popf
pop rax
jmp 0x14013deec
cmp eax, 8
jne 0x14013d08b
popf
pop rax
jmp 0x14013d6d8
cmp eax, 0x10
jne 0x14013d09a
popf
pop rax
jmp 0x14013dac6
cmp eax, 0x17
jne 0x14013d0a9
popf
pop rax
jmp 0x14013de36
cmp eax, 9
jne 0x14013d0b8
popf
pop rax
jmp 0x14013d729
cmp eax, 0x12
jne 0x14013d0c7
popf
pop rax
jmp 0x14013dba3
cmp eax, 0x18
jne 0x14013d0d6
popf
pop rax
jmp 0x14013dea0
cmp eax, 0x11
jne 0x14013d0e5
popf
pop rax
jmp 0x14013db6b
cmp eax, 0x1b
jne 0x14013d0f4
popf
pop rax
jmp 0x14013df84
cmp eax, 0x16
jne 0x14013d103
popf
pop rax
jmp 0x14013ddda
cmp eax, 0xa
jne 0x14013d112
popf
pop rax
jmp 0x14013d7df
cmp eax, 0x14
jne 0x14013d121
popf
pop rax
jmp 0x14013dcdc
cmp eax, 0xf
jne 0x14013d130
popf
pop rax
jmp 0x14013da35
cmp eax, 0x13
jne 0x14013d13f
popf
pop rax
jmp 0x14013dc38
cmp eax, 0x15
jne 0x14013d14e
popf
pop rax
jmp 0x14013dd90
cmp eax, 2
jne 0x14013d15d
popf
pop rax
jmp 0x14013d3ac
cmp eax, 6
jne 0x14013d16c
popf
pop rax
jmp 0x14013d58a
cmp eax, 0xc
jne 0x14013d17b
popf
pop rax
jmp 0x14013d8f1
cmp eax, 7
jne 0x14013d18a
popf
pop rax
jmp 0x14013d5e6
cmp eax, 5
jne 0x14013d199
popf
pop rax
jmp 0x14013d583
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14010a0d0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
xor r14d, r14d
lea rcx, [0x19bb0c6b9]
pushf
sub rcx, 0x5ba148c9
popf
jmp 0x14013d1da
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14013d245
push rax
pushf
mov eax, 0xb1228ee2
pushf
not eax
add eax, 0x8028a83b
xor eax, 0x9f479532
rol eax, 0x73
popf
pushf
not eax
add eax, 0x8d7ceb29
xor eax, 0xdc6f75ab
rol eax, 0xa
popf
pushf
not eax
add eax, 0x9a2607ee
xor eax, 0xbb6ebfe7
rol eax, 0x33
popf
pushf
not eax
add eax, 0xa81cef1f
xor eax, 0xe882d832
rol eax, 0x73
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x45e74abc
pushf
not eax
add eax, 0xe9584a3b
xor eax, 0xfabcf647
rol eax, 0xda
popf
pushf
not eax
add eax, 0x85f5c36a
xor eax, 0x80567d0a
rol eax, 0x83
popf
pushf
not eax
add eax, 0x9d54d130
xor eax, 0x9d0d5eb6
rol eax, 0xe9
popf
jmp 0x14013cff5
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x6c1ffffc6a3a8a68
pushf
not rdi
add rdi, 0x40407940
xor rdi, 0x5e34b211
rol rdi, 0xca
popf
pushf
not rdi
add rdi, 0x59c1314b
xor rdi, 0x6e42b444
rol rdi, 0x6e
popf
pushf
not rdi
add rdi, 0x739112ad
xor rdi, 0x77190577
rol rdi, 0x93
popf
pushf
not rdi
add rdi, 0x6285faeb
xor rdi, 0x4870bf96
rol rdi, 0x22
popf
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x14013d366
push rax
pushf
mov eax, 0x506f4d86
pushf
not eax
add eax, 0xb5f43d0e
xor eax, 0xac583e15
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xdd93fbae
xor eax, 0x8307ab82
rol eax, 0x40
popf
pushf
not eax
add eax, 0xf8bd411e
xor eax, 0x830a5477
rol eax, 0x50
popf
pushf
not eax
add eax, 0xb079f50b
xor eax, 0x91ad82b4
rol eax, 0xd3
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0xb7a6c060
pushf
not eax
add eax, 0xc00429f8
xor eax, 0xa46f3cb2
rol eax, 0x78
popf
pushf
not eax
add eax, 0x9cd6a8bf
xor eax, 0xdfbf03fb
rol eax, 0x31
popf
pushf
not eax
add eax, 0xbcaa3c54
xor eax, 0xd1857b29
rol eax, 0x54
popf
jmp 0x14013cff5
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14013d3fc
push rax
pushf
mov eax, 0xc27d4fda
pushf
not eax
add eax, 0xe4753bd9
xor eax, 0xda03d9c9
rol eax, 0x67
popf
pushf
not eax
add eax, 0xd71024da
xor eax, 0xab699d62
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xbd0d83d1
xor eax, 0xc9508fe3
rol eax, 0xfa
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x1c233557
pushf
not eax
add eax, 0xb141f69d
xor eax, 0xfe21ad60
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xfab8978a
xor eax, 0xc0cf76af
rol eax, 0xf
popf
pushf
not eax
add eax, 0xb1320816
xor eax, 0xe427d36f
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xbc4ec0eb
xor eax, 0x902500e7
rol eax, 0x35
popf
jmp 0x14013cff5
mov rax, qword [rbx]
push rax
pushf
mov eax, 0x868e64f0
pushf
not eax
add eax, 0xbd59b660
xor eax, 0xa75054d1
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xf9ae493d
xor eax, 0xe52af829
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xacee5172
xor eax, 0x8e368158
rol eax, 0x98
popf
jmp 0x14013cff5
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, [0x1b79e8a3c]
pushf
sub r9, 0x778f0c0c
popf
lea rcx, [rbp + 0xf]
call fcn.1401d5a49
nop
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rcx, [rbp + 0x2f]
jmp 0x14013d4e0
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x14013d52a
push rax
pushf
mov eax, 0x78bfcac4
pushf
not eax
add eax, 0x82f341eb
xor eax, 0xc8c1e2e7
rol eax, 0x43
popf
pushf
not eax
add eax, 0xdf5e5e49
xor eax, 0xc799b03a
rol eax, 0xc
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x62c2b885
pushf
not eax
add eax, 0xdf345c13
xor eax, 0xff5716fc
rol eax, 0x67
popf
pushf
not eax
add eax, 0xfb55b5d7
xor eax, 0xcf0f4f0d
rol eax, 0xce
popf
pushf
not eax
add eax, 0xf3267ecb
xor eax, 0xdc37961a
rol eax, 0x38
popf
pushf
not eax
add eax, 0x8986df92
xor eax, 0xf16c47cf
rol eax, 0xb
popf
jmp 0x14013cff5
cmp qword [rbx + 0x18], 8
jb 0x14013d5e6
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0xb9492d5
pushf
not eax
add eax, 0xcc805a0f
xor eax, 0xfc57aac0
rol eax, 0xf
popf
pushf
not eax
add eax, 0xf1b83a64
xor eax, 0xa31b5c9d
rol eax, 0x78
popf
pushf
not eax
add eax, 0x807adfa7
xor eax, 0xa5127418
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x81d18376
xor eax, 0x8f62e91e
rol eax, 0xb0
popf
jmp 0x14013cff5
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, [0x191595578]
pushf
sub r9, 0x5149d808
popf
lea rcx, [rbp - 0x11]
call fcn.1401d5a49
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
mov rcx, 0xffffffff80000002
jmp 0x14013d62f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14013d692
push rax
pushf
mov eax, 0x2f71fb20
pushf
not eax
add eax, 0xe765b16a
xor eax, 0xefb1fa0a
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x877a9525
xor eax, 0xfb5e77d9
rol eax, 0x83
popf
pushf
not eax
add eax, 0x907b12aa
xor eax, 0xab6719b2
rol eax, 0xff
popf
pushf
not eax
add eax, 0xe87fba2e
xor eax, 0xa050d336
rol eax, 0x7d
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0xaa0c8aff
pushf
not eax
add eax, 0xd798cb3b
xor eax, 0xa09dd8b7
rol eax, 0
popf
pushf
not eax
add eax, 0x86dcc70b
xor eax, 0xe5b1bd40
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xb7f894ca
xor eax, 0xa9bb4b38
rol eax, 0xbf
popf
jmp 0x14013cff5
cmp eax, 2
sete bl
jmp 0x14013d9b3
mov rcx, qword [rbp - 0x19]
jmp 0x14013d72e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x19dc2781d]
pushf
sub rdx, 0x5db2f97d
popf
mov rcx, rsi
jmp 0x14013d74a
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x2f]
jmp 0x14013d755
call rax
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14013d799
push rax
pushf
mov eax, 0xcc66c4e6
pushf
not eax
add eax, 0xa7db443b
xor eax, 0x88ba35c3
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xf8e4a9e8
xor eax, 0xb5ba4c98
rol eax, 0x88
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x289fa27a
pushf
not eax
add eax, 0xb41ca529
xor eax, 0x823f5d58
rol eax, 0x53
popf
pushf
not eax
add eax, 0xf1cc9da2
xor eax, 0xdd71cb99
rol eax, 0xc
popf
pushf
not eax
add eax, 0xcc53462c
xor eax, 0xf2d1e1f5
rol eax, 0x3a
popf
jmp 0x14013cff5
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14013d7ea
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x14013d9b3
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14013d835
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14013d898
push rax
pushf
mov eax, 0xe103ed2d
pushf
not eax
add eax, 0xf4e66818
xor eax, 0xe74a64c9
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xb4e8df70
xor eax, 0xa29d88e5
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xa6ec1337
xor eax, 0x9952ac6c
rol eax, 0x17
popf
pushf
not eax
add eax, 0xfd356716
xor eax, 0xf7dd7396
rol eax, 0x9a
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x9e36051
pushf
not eax
add eax, 0x96dfdc50
xor eax, 0xe4f4a53b
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xabf8cea3
xor eax, 0xb7a29f6f
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xc0266aba
xor eax, 0xc357ceee
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xc0f54604
xor eax, 0x95329502
rol eax, 0xe9
popf
jmp 0x14013cff5
xor bl, bl
jmp 0x14013d9b3
mov bl, 0x90
pushf
not bl
add bl, 0xea
xor bl, 0x90
rol bl, 0xb4
popf
pushf
not bl
add bl, 9
xor bl, 0x72
rol bl, 0x8a
popf
pushf
not bl
add bl, 0xc8
xor bl, 0x47
rol bl, 0xed
popf
push rax
pushf
mov eax, 0x40feb3a8
pushf
not eax
add eax, 0xaaa8bfe9
xor eax, 0xb5a6e986
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xf4654e9e
xor eax, 0xcb669126
rol eax, 0xed
popf
pushf
not eax
add eax, 0xc53022e9
xor eax, 0xa1e3ef83
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xad0945b5
xor eax, 0xb597a354
rol eax, 0xf9
popf
jmp 0x14013cff5
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14013da03
push rax
pushf
mov eax, 0x8f9cf0b4
pushf
not eax
add eax, 0xe5ead764
xor eax, 0x9e57453e
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xf5582239
xor eax, 0xdf8e7eef
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x8df27ce3
xor eax, 0xf3199fd1
rol eax, 0x85
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x70bc524e
pushf
not eax
add eax, 0xeefcc183
xor eax, 0xf1ad2ece
rol eax, 1
popf
pushf
not eax
add eax, 0xa3e31afe
xor eax, 0x84089e08
rol eax, 0x59
popf
jmp 0x14013cff5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013da93
push rax
pushf
mov eax, 0x93eb760c
pushf
not eax
add eax, 0x900134bf
xor eax, 0x9144a135
rol eax, 0x24
popf
pushf
not eax
add eax, 0xb9fa1420
xor eax, 0x991178c3
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xd63d75c2
xor eax, 0x866e4954
rol eax, 0x50
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x425d527f
pushf
not eax
add eax, 0xef3b7651
xor eax, 0xf95f08f0
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xac9385bf
xor eax, 0xa7e70428
rol eax, 0xfa
popf
jmp 0x14013cff5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013db25
push rax
pushf
mov eax, 0x9816699b
pushf
not eax
add eax, 0x981065b1
xor eax, 0xc2fa708f
rol eax, 0xee
popf
pushf
not eax
add eax, 0xfb39f202
xor eax, 0x9f7eb323
rol eax, 0x42
popf
pushf
not eax
add eax, 0xa02a2df2
xor eax, 0x8236e667
rol eax, 0xe
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x58533744
pushf
not eax
add eax, 0x862533fa
xor eax, 0xb1c608fe
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x97299512
xor eax, 0xa5088d6e
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xdab8a55f
xor eax, 0xdd79aa00
rol eax, 0xe1
popf
jmp 0x14013cff5
call fcn.14021a52b
push rax
pushf
mov eax, 0x1a668168
pushf
not eax
add eax, 0xa1cd1b5c
xor eax, 0xf0c04abd
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xcc99d3c9
xor eax, 0xa5c68555
rol eax, 0x82
popf
jmp 0x14013cff5
movdqa xmm0, xmmword [0x1400ff1f0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], r14w
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14013dbf2
push rax
pushf
mov eax, 0x51cdc2b3
pushf
not eax
add eax, 0x8fcc092f
xor eax, 0xf3454ac7
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x9b75afe1
xor eax, 0x819e4e40
rol eax, 0x61
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0x1abffba4
pushf
not eax
add eax, 0x95c6748d
xor eax, 0xce7b5d74
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x93eba0b8
xor eax, 0x86358433
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xb7f492a6
xor eax, 0xf62b5d6a
rol eax, 0x4f
popf
jmp 0x14013cff5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013dc83
push rax
pushf
mov eax, 0x15fac619
pushf
not eax
add eax, 0xfc2f58a1
xor eax, 0xe6010af5
rol eax, 5
popf
pushf
not eax
add eax, 0xa97e5100
xor eax, 0xa2ce42bf
rol eax, 0xf2
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0xb634b7a4
pushf
not eax
add eax, 0xd644e681
xor eax, 0xc6c9a160
rol eax, 0x84
popf
pushf
not eax
add eax, 0xd726e769
xor eax, 0x81a4d728
rol eax, 0x62
popf
pushf
not eax
add eax, 0xefdc8ee1
xor eax, 0x99a941c9
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x80778ad6
xor eax, 0xdd88a421
rol eax, 0x46
popf
jmp 0x14013cff5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013dd4a
push rax
pushf
mov eax, 0xbd9a2dc8
pushf
not eax
add eax, 0xc2b315bc
xor eax, 0x806f56f8
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xf169ea5a
xor eax, 0x93e2aa1c
rol eax, 0x15
popf
pushf
not eax
add eax, 0xe2efeea4
xor eax, 0xa5b52431
rol eax, 0x18
popf
pushf
not eax
add eax, 0xfc7c9a02
xor eax, 0xd448666e
rol eax, 0xe
popf
jmp 0x14013cff5
push rax
pushf
mov eax, 0xd35ee9a0
pushf
not eax
add eax, 0x930adbfe
xor eax, 0xd898e619
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xd14710a2
xor eax, 0xb6478713
rol eax, 7
popf
pushf
not eax
add eax, 0xc14759b2
xor eax, 0x9bcee3bd
rol eax, 0x40
popf
jmp 0x14013cff5
call fcn.14021a52b
push rax
pushf
mov eax, 0xca49a027
pushf
not eax
add eax, 0xe6637860
xor eax, 0xf20f6dc9
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xc2037f61
xor eax, 0xdfa90a3a
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xf62cd736
xor eax, 0x9d9c009a
rol eax, 1
popf
jmp 0x14013cff5
movzx eax, bl
push rax
pushf
mov eax, 0x231cd046
pushf
not eax
add eax, 0x8d00816a
xor eax, 0xaeb79a7b
rol eax, 0x85
popf
pushf
not eax
add eax, 0x93fa58a3
xor eax, 0x847608ce
rol eax, 0x65
popf
pushf
not eax
add eax, 0x958bd632
xor eax, 0x940867e9
rol eax, 0x24
popf
pushf
not eax
add eax, 0xc2c9f785
xor eax, 0xb055525e
rol eax, 0x9c
popf
jmp 0x14013cff5
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1402ac965
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1401f095d
int3
call fcn.1402aff10
nop
push rax
pushf
mov eax, 0x9c44aa8c
pushf
not eax
add eax, 0xd741fe02
xor eax, 0x9b150ab0
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xd1c787b0
xor eax, 0xa98d6bfd
rol eax, 0x34
popf
pushf
not eax
add eax, 0x98561fc2
xor eax, 0xcd2211b7
rol eax, 0x27
popf
jmp 0x14013cff5
call fcn.1402aff10
nop
push rax
pushf
mov eax, 0x1ef25050
pushf
not eax
add eax, 0x893ad91b
xor eax, 0xe2405b06
rol eax, 8
popf
pushf
not eax
add eax, 0xb839d834
xor eax, 0xa7688cea
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xcf6bea72
xor eax, 0x8ba7666a
rol eax, 0x2e
popf
jmp 0x14013cff5
call fcn.1401f095d
int3