Function at 0x140022d00
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140075100]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x80], ebx
movabs rax, 0x908a6dd72ae576ef
mov qword [rsp + 0x30], rax
movabs rax, 0xc9a79c88396eb351
mov qword [rsp + 0x38], rax
movabs rax, 0x498286279ca00210
mov qword [rsp + 0x40], rax
movabs rax, 0x2c2b1d7b675351de
mov qword [rsp + 0x48], rax
movabs rax, 0xc0c288b0b6ba7334
mov qword [rsp + 0x50], rax
movabs rax, 0x8127bd0a2dd32ec9
mov qword [rsp + 0x58], rax
movabs rax, 0xf77660c885caf46a
mov qword [rsp + 0x60], rax
movabs rcx, 0x65a30b1dc54e4186
mov qword [rsp + 0x68], rcx
movabs r12, 0xe2fe1ebe4d8024b3
mov qword [rsp + 0x120], r12
movabs r14, 0xa7cef4eb5823ef28
mov qword [rsp + 0x128], r14
movabs rax, 0x24e7f254e5f35e75
mov qword [rsp + 0x130], rax
movabs rax, 0x5845780915261282
mov qword [rsp + 0x138], rax
movabs rax, 0x93aee7c2c2d41c77
mov qword [rsp + 0x140], rax
movabs rax, 0xe851cf6f7e8f5aac
mov qword [rsp + 0x148], rax
movabs rax, 0xf77660c8d9b99109
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140022ea7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x120]
call fcn.14001b2a0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140022ed0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x120]
call fcn.14001ae30
movabs r15, 0x869f71d223d550fd
mov qword [rsp + 0x80], r15
movabs rax, 0xa7ce868e2e4a9d6c
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x8e9a30d221e450dd
mov qword [rsp + 0xd0], rax
movabs rax, 0xa7cef4eb5823ef44
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r14
movdqa xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140023991
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xc0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0x87f4868e2e4a9d6c
mov qword [rsp + 0x38], rax
movabs rax, 0x24e7f254e5f35e75
mov qword [rsp + 0x40], rax
movabs rcx, 0x5845780915261282
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xf0], r12
movabs r15, 0xa7cef4eb5823ef28
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140076700]
call fcn.14001aec0
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0xd0]
call fcn.1400209e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400230b2
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.140033b40
mov rcx, rax
call fcn.14002fbc0
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140023109
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023104
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a03
call fcn.140036a4c
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400787a0], eax
jle 0x14002327b
lea rcx, [0x1400787a0]
call fcn.140036b28
cmp dword [0x1400787a0], 0xffffffff
jne 0x14002327b
movabs rax, 0xa1a273db39f35de0
mov qword [rsp + 0x30], rax
movabs rax, 0xc88d80853d519d5d
mov qword [rsp + 0x38], rax
movabs rax, 0x5082a1388a812a1b
mov qword [rsp + 0x40], rax
movabs rax, 0x3d26117f674341de
mov qword [rsp + 0x48], rax
movabs rax, 0x93aee7c2c2d44004
mov qword [rsp + 0x50], rax
movabs rax, 0xe851cf6f7e8f5aac
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
movabs r14, 0x24e7f254e5f35e75
mov qword [rsp + 0x100], r14
movabs rcx, 0x5845780915261282
mov qword [rsp + 0x108], rcx
movabs rcx, 0x93aee7c2c2d41c77
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140078710], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140078720], xmm1
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140023240
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rdi, [0x140078710]
mov rcx, rdi
call fcn.14001b2a0
lea rcx, [0x14005ce10]
call fcn.140036dc8
nop
lea rcx, [0x1400787a0]
call fcn.140036abc
jmp 0x14002328c
lea rdi, [0x140078710]
movabs r14, 0x24e7f254e5f35e75
cmp qword [0x140078728], 0xf
cmova rdi, qword [0x140078710]
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400232c1
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x1400232ea
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400232ea
mov dil, 1
jmp 0x1400232ed
xor dil, dil
movabs rax, 0xc29b7dd73bf241c0
mov qword [rsp + 0x30], rax
movabs rax, 0xdebc809831448a5a
mov qword [rsp + 0x38], rax
movabs rax, 0x1e94872084872d55
mov qword [rsp + 0x40], rax
movabs rax, 0x58457809152612a2
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r14
movabs rax, 0x5845780915261282
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140076700]
call fcn.14001aec0
movzx edx, dil
mov rcx, rax
call fcn.14002c5e0
mov rcx, rax
call fcn.14002fbc0
lea rcx, [rsp + 0xf0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001c490
nop
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400233ca
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.14001ae30
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140023453
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002344e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a09
call fcn.140036a4c
movdqa xmm0, xmmword [0x14006d260]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x1400234ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400234a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a0f
call fcn.140036a4c
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.140034c2c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov esi, 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 9
test r14, r14
je 0x140023582
cmp r14, 0x7fffffff
ja 0x140023a2b
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140034c54
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a15
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002c980
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], rsi
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140034c54
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a21
mov qword [rsp + 0xd0], rbx
lea rax, [0x140075d60]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d470
movzx edi, al
cmp dword [rsp + 0xd0], 0
jne 0x140023a31
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400235fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a4b
call fcn.140036a4c
test dil, dil
je 0x1400238e2
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.140034c2c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov qword [rsp + 0x48], rdx
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x207
test r14, r14
je 0x1400236df
cmp r14, 0x7fffffff
ja 0x140023a75
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140034c54
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a51
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002c980
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140034c54
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a5c
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rdx, 7
cmova rcx, qword [rsp + 0x30]
call fcn.14003539c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a66
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023744
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002373f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a7b
call fcn.140036a4c
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.140034c2c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x1c7
test r14, r14
je 0x140023819
cmp r14, 0x7fffffff
ja 0x140023ab0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140034c54
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a81
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002c980
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140034c54
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a8c
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rsi, 7
cmova rcx, qword [rsp + 0x30]
call fcn.14003539c
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0xf0], edx
lea rax, [0x140075d60]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
cmp edx, 0x91
jne 0x140023888
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d5f0
cmp dword [rsp + 0xd0], 0
jne 0x140023a96
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400238d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ab6
call fcn.140036a4c
nop
jmp 0x1400238e2
test r13d, r13d
setne dil
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x14002392c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023abc
call fcn.140036a4c
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14002398b
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac2
call fcn.140036a4c
movzx eax, dil
jmp 0x1400239d6
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x1400239d4
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac8
call fcn.140036a4c
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400369f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003c954
nop
call fcn.14003c954
nop
call fcn.14003c954
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
int3
shr rcx, 0x20
call fcn.14001bbe0
int3
call fcn.14001b9d0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.exists
call fcn.14001cd00
nop
call fcn.14003c954
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001cc90
nop
call fcn.14001b9d0
nop
call fcn.14003c954
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.remove_all
call fcn.14001cd00
nop
call fcn.14001b9d0
nop
call fcn.14003c954
nop
call fcn.14003c954
nop
call fcn.14003c954
int3
call fcn.14003c954
int3