Function at 0x3cf9c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov dil, dl
mov r12, rcx
xor ebx, ebx
mov r13, rbx
mov qword [rax + 0x20], rbx
mov rax, qword [0x00032688]
mov rsi, qword [rax + 0x40]
mov r15, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r14, rax
cmp dword [r12 + 0x10], ebx
jl 0x3d306
cmp dword [r12 + 0x10], 0x104
je 0x3d306
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9b, dil
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15]
call fcn.00048ed4
cmp eax, ebx
jge 0x3d03d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x197
lea r9, [0x0004a1b0]
lea r8, [0x0004abe0]
xor edx, edx
lea ecx, [rbx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
jmp 0x3d308
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0xc0], ebx
cmp qword [rsp + 0x60], rbx
je 0x3d067
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.000497ac
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x3d070
mov edi, 0xc000000d
mov dword [rsp + 0x40], edi
cmp edi, ebx
jl 0x3d1c6
cmp word [rsp + 0x48], bx
je 0x3d1c6
lea rdx, [rsp + 0xc0]
mov ecx, r14d
call fcn.0003f710
mov edi, eax
mov dword [rsp + 0x40], eax
mov r12d, 0xc0000022
cmp eax, r12d
je 0x3d1fb
cmp eax, ebx
jl 0x3d0c8
cmp dword [rsp + 0xc0], 3
je 0x3d1fb
cmp dword [rsp + 0xc0], 4
je 0x3d1fb
lea r8, [rsp + 0xc8]
mov edx, 0x1000
lea rcx, [rsp + 0x48]
call fcn.0003c534
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x3d1bc
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r13, qword [rsp + 0xc8]
mov r8, r13
mov edx, 0x1000
lea rcx, [rsp + 0x48]
call fcn.0003f968
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r12d
je 0x3d1fb
cmp eax, ebx
jl 0x3d146
cmp dword [rsp + 0xc0], 3
je 0x3d1fb
cmp dword [rsp + 0xc0], 4
je 0x3d1fb
lea rcx, [rsi + 0xe0]
call sub.FLTMGR.SYS_FltAcquirePushLockShared
mov rcx, qword [r13 + 0x18]
bt dword [rcx], 9
jae 0x3d182
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, 3
mov r8d, r14d
lea rdx, [rsp + 0x48]
call fcn.0003726c
mov edi, r12d
mov dword [rsp + 0x40], r12d
jmp 0x3d1ae
test byte [rcx], 0x40
je 0x3d1ae
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, 3
mov r8d, r14d
lea rdx, [rsp + 0x48]
call fcn.00039eec
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsi + 0xe0]
call sub.FLTMGR.SYS_FltReleasePushLock
jmp 0x3d1fb
mov r13, qword [rsp + 0xc8]
jmp 0x3d1fb
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1a4
lea r9, [0x0004a1b0]
lea r8, [0x0004ac30]
xor edx, edx
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r12d, 0xc0000022
cmp r13, rbx
je 0x3d208
mov rcx, r13
call fcn.0003c5e4
cmp qword [rsp + 0x50], rbx
je 0x3d21e
mov edx, 0x73525349
lea rcx, [rsp + 0x48]
call fcn.00044fd0
cmp edi, r12d
jne 0x3d2f3
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rbx
mov r9d, 0xf003f
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [r15]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov esi, eax
cmp eax, ebx
jge 0x3d283
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0xf6
lea r9, [0x0004a1b0]
lea r8, [0x0004cb80]
xor edx, edx
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edi, esi
jmp 0x3d2d0
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov esi, eax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, ebx
jge 0x3d2ce
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0xff
lea r9, [0x0004a1b0]
lea r8, [0x0004cbc0]
xor edx, edx
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edi, esi
jmp 0x3d2d0
mov edi, esi
cmp esi, ebx
jl 0x3d2f3
mov rcx, qword [r15]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [r15], rbx
mov rax, qword [rsp + 0xb0]
mov qword [rax + 8], rbx
mov dword [rax + 0x10], r12d
mov edi, r12d
mov edx, 0x73525349
lea rcx, [rsp + 0x58]
call fcn.00044fd0
mov eax, edi
jmp 0x3d308
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret