Function at 0x140039b15
Capabilities:
Delete registry key

Disassembly:
push rax
pushf
mov eax, 0x13feae70
pushf
not eax
add eax, 0xc428eeb3
xor eax, 0x9868effc
rol eax, 1
popf
pushf
not eax
add eax, 0x8f49abd3
xor eax, 0xa23bacc4
rol eax, 0x93
popf
pushf
not eax
add eax, 0xc35d60d9
xor eax, 0xbec878d9
rol eax, 0xa3
popf
cmp eax, 4
jne 0x140039b64
popf
pop rax
jmp 0x14003a011
cmp eax, 0
jne 0x140039b73
popf
pop rax
jmp 0x140039cf9
cmp eax, 3
jne 0x140039b82
popf
pop rax
jmp 0x140039fb5
cmp eax, 1
jne 0x140039b91
popf
pop rax
jmp 0x140039deb
cmp eax, 0xd
jne 0x140039ba0
popf
pop rax
jmp 0x14003a43f
cmp eax, 0x1a
jne 0x140039baf
popf
pop rax
jmp 0x14003aa02
cmp eax, 0xe
jne 0x140039bbe
popf
pop rax
jmp 0x14003a4b4
cmp eax, 0xb
jne 0x140039bcd
popf
pop rax
jmp 0x14003a364
cmp eax, 0x19
jne 0x140039bdc
popf
pop rax
jmp 0x14003a998
cmp eax, 8
jne 0x140039beb
popf
pop rax
jmp 0x14003a238
cmp eax, 0x10
jne 0x140039bfa
popf
pop rax
jmp 0x14003a5ee
cmp eax, 0x17
jne 0x140039c09
popf
pop rax
jmp 0x14003a917
cmp eax, 9
jne 0x140039c18
popf
pop rax
jmp 0x14003a276
cmp eax, 0x12
jne 0x140039c27
popf
pop rax
jmp 0x14003a6ca
cmp eax, 0x18
jne 0x140039c36
popf
pop rax
jmp 0x14003a94f
cmp eax, 0x11
jne 0x140039c45
popf
pop rax
jmp 0x14003a690
cmp eax, 0x1b
jne 0x140039c54
popf
pop rax
jmp 0x14003aa61
cmp eax, 0x16
jne 0x140039c63
popf
pop rax
jmp 0x14003a8ca
cmp eax, 0xa
jne 0x140039c72
popf
pop rax
jmp 0x14003a319
cmp eax, 0x14
jne 0x140039c81
popf
pop rax
jmp 0x14003a797
cmp eax, 0xf
jne 0x140039c90
popf
pop rax
jmp 0x14003a570
cmp eax, 0x13
jne 0x140039c9f
popf
pop rax
jmp 0x14003a715
cmp eax, 0x15
jne 0x140039cae
popf
pop rax
jmp 0x14003a84e
cmp eax, 2
jne 0x140039cbd
popf
pop rax
jmp 0x140039f0c
cmp eax, 6
jne 0x140039ccc
popf
pop rax
jmp 0x14003a0fd
cmp eax, 0xc
jne 0x140039cdb
popf
pop rax
jmp 0x14003a3f2
cmp eax, 7
jne 0x140039cea
popf
pop rax
jmp 0x14003a159
cmp eax, 5
jne 0x140039cf9
popf
pop rax
jmp 0x14003a0f6
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140019010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
xor r14d, r14d
lea rcx, [0x18b86df60]
pushf
sub rcx, 0x4b861618
popf
jmp 0x140039d3a
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140039da5
push rax
pushf
mov eax, 0xec12c52e
pushf
not eax
add eax, 0xf8f254f8
xor eax, 0xc4a02004
rol eax, 0x32
popf
pushf
not eax
add eax, 0xae2b2d1a
xor eax, 0xbe78801f
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xafb55987
xor eax, 0xf7a41a92
rol eax, 0x38
popf
pushf
not eax
add eax, 0x87a09aae
xor eax, 0x9baff99f
rol eax, 0x8b
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0xb5822b5c
pushf
not eax
add eax, 0x9c5523ab
xor eax, 0x9fc9318e
rol eax, 0x17
popf
pushf
not eax
add eax, 0xa3aa89bb
xor eax, 0xc146a824
rol eax, 0x88
popf
pushf
not eax
add eax, 0xe1d2b91c
xor eax, 0xb667c719
rol eax, 0x90
popf
jmp 0x140039b55
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x3595fbff41f033e0
pushf
not rdi
add rdi, 0x46006a63
xor rdi, 0x5fe8f536
rol rdi, 0x61
popf
pushf
not rdi
add rdi, 0x4226153f
xor rdi, 0x52a80d3c
rol rdi, 0xdc
popf
pushf
not rdi
add rdi, 0x4a881aa6
xor rdi, 0x404e3bc8
rol rdi, 5
popf
pushf
not rdi
add rdi, 0x6528757a
xor rdi, 0x63f8a518
rol rdi, 0xd
popf
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x140039eb3
push rax
pushf
mov eax, 0xfbfc8da7
pushf
not eax
add eax, 0xcc7653ee
xor eax, 0x84a27781
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xaad52403
xor eax, 0x93b406ca
rol eax, 0x56
popf
pushf
not eax
add eax, 0xab30ce7b
xor eax, 0x8abb91da
rol eax, 0x61
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x90d3fa4f
pushf
not eax
add eax, 0xa1f719c7
xor eax, 0xc10a7beb
rol eax, 0x31
popf
pushf
not eax
add eax, 0xa129d2bd
xor eax, 0xa386135c
rol eax, 0xed
popf
pushf
not eax
add eax, 0xce553c65
xor eax, 0xf988b404
rol eax, 0x61
popf
pushf
not eax
add eax, 0xa3c03c81
xor eax, 0xbc7288c0
rol eax, 0x60
popf
jmp 0x140039b55
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140039f6f
push rax
pushf
mov eax, 0x868c10b4
pushf
not eax
add eax, 0xe02d90c5
xor eax, 0xf5c97722
rol eax, 0x48
popf
pushf
not eax
add eax, 0xc75224bb
xor eax, 0xfc880100
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xaca9c830
xor eax, 0x860ad3dd
rol eax, 0x64
popf
pushf
not eax
add eax, 0x821398b5
xor eax, 0xe2160d9c
rol eax, 0x62
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x22978c8e
pushf
not eax
add eax, 0x9cfd8897
xor eax, 0xe9092d8d
rol eax, 0x81
popf
pushf
not eax
add eax, 0xc9fa6cb3
xor eax, 0xecc013f8
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xb4c24bc5
xor eax, 0xcac63069
rol eax, 0xfe
popf
jmp 0x140039b55
mov rax, qword [rbx]
push rax
pushf
mov eax, 0xc709a297
pushf
not eax
add eax, 0xeb5a6b28
xor eax, 0xd24a7f97
rol eax, 0xda
popf
pushf
not eax
add eax, 0x8866c5c9
xor eax, 0x92895c7d
rol eax, 0x99
popf
pushf
not eax
add eax, 0xa32a0c6d
xor eax, 0xe082d283
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xdd48446f
xor eax, 0xf84b8b08
rol eax, 0xf2
popf
jmp 0x140039b55
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, [0x18c064b2b]
pushf
sub r9, 0x4c04f8fb
popf
lea rcx, [rbp + 0xf]
call fcn.1400495a6
nop
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rcx, [rbp + 0x2f]
jmp 0x14003a053
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x14003a0c3
push rax
pushf
mov eax, 0x8393e1a9
pushf
not eax
add eax, 0xe29ab391
xor eax, 0xfef783d6
rol eax, 0x79
popf
pushf
not eax
add eax, 0xc6971e4d
xor eax, 0xcb86de8f
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xdd240df8
xor eax, 0xe4c71502
rol eax, 0xee
popf
pushf
not eax
add eax, 0xc7c3236f
xor eax, 0xdeeafcdd
rol eax, 0x34
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x40154ca5
pushf
not eax
add eax, 0xc932408c
xor eax, 0xf2486da7
rol eax, 0x13
popf
pushf
not eax
add eax, 0xdbccded3
xor eax, 0xe9c1041a
rol eax, 0xff
popf
jmp 0x140039b55
cmp qword [rbx + 0x18], 8
jb 0x14003a159
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0x8c1d8bd
pushf
not eax
add eax, 0xf377175e
xor eax, 0xbcdc89ad
rol eax, 0xca
popf
pushf
not eax
add eax, 0x9b594592
xor eax, 0xbef60c32
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xfbb4f69b
xor eax, 0x8caab1a8
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xef6756e6
xor eax, 0xb065f030
rol eax, 0xd8
popf
jmp 0x140039b55
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, [0x18586227e]
pushf
sub r9, 0x4584d0fe
popf
lea rcx, [rbp - 0x11]
call fcn.1400495a6
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
mov rcx, 0xffffffff80000002
jmp 0x14003a1a2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003a1f2
push rax
pushf
mov eax, 0x7b396244
pushf
not eax
add eax, 0x845245b6
xor eax, 0xe7dd1c33
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xbee3f8c8
xor eax, 0xb9e36cb4
rol eax, 0x86
popf
pushf
not eax
add eax, 0x832bc80a
xor eax, 0x906088f4
rol eax, 0x35
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x9e113ad9
pushf
not eax
add eax, 0xc01ca307
xor eax, 0xd0aafd92
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xabe933a4
xor eax, 0x92085d3d
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x9320951f
xor eax, 0xaf3f2616
rol eax, 0x63
popf
jmp 0x140039b55
cmp eax, 2
sete bl
jmp 0x14003a4b4
mov rcx, qword [rbp - 0x19]
jmp 0x14003a27b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x190eed073]
pushf
sub rdx, 0x50ed7dd3
popf
mov rcx, rsi
jmp 0x14003a297
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x2f]
jmp 0x14003a2a2
call rax
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14003a2e6
push rax
pushf
mov eax, 0x43b1faee
pushf
not eax
add eax, 0x9d6f143b
xor eax, 0xa2f064d1
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xa7e9068e
xor eax, 0xd8eb5fdb
rol eax, 0xff
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x917e613a
pushf
not eax
add eax, 0xd3600549
xor eax, 0xbc69aef9
rol eax, 0x41
popf
pushf
not eax
add eax, 0xa6f3adca
xor eax, 0xae6397da
rol eax, 9
popf
jmp 0x140039b55
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14003a324
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x14003a4b4
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14003a36f
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x14003a3ac
push rax
pushf
mov eax, 0xb4fce2f2
pushf
not eax
add eax, 0xb8f8de63
xor eax, 0xedeebc55
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x8afa26e3
xor eax, 0xa9a5b4e4
rol eax, 0xdd
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x6d5fb986
pushf
not eax
add eax, 0xb8b4cd4e
xor eax, 0xff902f16
rol eax, 0x65
popf
pushf
not eax
add eax, 0x9b00e1d8
xor eax, 0xcb2e6fdf
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xd0f95aa5
xor eax, 0xe455e81d
rol eax, 0x4e
popf
jmp 0x140039b55
xor bl, bl
jmp 0x14003a4b4
mov bl, 0x81
pushf
not bl
add bl, 0xf3
xor bl, 0xf4
rol bl, 0xcc
popf
pushf
not bl
add bl, 6
xor bl, 0x83
rol bl, 0xd1
popf
pushf
not bl
add bl, 0x3b
xor bl, 0xda
rol bl, 0xf6
popf
push rax
pushf
mov eax, 0xd11c3c6f
pushf
not eax
add eax, 0xaa251e4c
xor eax, 0x9f18bf3c
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xe984d4cb
xor eax, 0x8954de2c
rol eax, 0x90
popf
pushf
not eax
add eax, 0x81b105e2
xor eax, 0x90c0996a
rol eax, 0x44
popf
jmp 0x140039b55
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14003a517
push rax
pushf
mov eax, 0x9f39281f
pushf
not eax
add eax, 0xa813d570
xor eax, 0xd22a434e
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xc0b77d93
xor eax, 0xee772826
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xa1105d51
xor eax, 0xd855047c
rol eax, 0x31
popf
pushf
not eax
add eax, 0xe675154d
xor eax, 0xf78d2dc0
rol eax, 0x7f
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0xf460d37b
pushf
not eax
add eax, 0xbe05c183
xor eax, 0xc129b8e8
rol eax, 0x57
popf
pushf
not eax
add eax, 0xe7ba4eb1
xor eax, 0x87802471
rol eax, 0x63
popf
pushf
not eax
add eax, 0xccfb9bd2
xor eax, 0xd7204b40
rol eax, 0x29
popf
pushf
not eax
add eax, 0xbc451a8a
xor eax, 0xe75e46b9
rol eax, 0x5b
popf
jmp 0x140039b55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a5bb
push rax
pushf
mov eax, 0x249bb54c
pushf
not eax
add eax, 0xf47e2007
xor eax, 0xe26494fc
rol eax, 0xab
popf
pushf
not eax
add eax, 0xde099059
xor eax, 0xa2175eec
rol eax, 0xea
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x93678f1
pushf
not eax
add eax, 0x9d879168
xor eax, 0x882a90d4
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xe967fe11
xor eax, 0xe0e0df2f
rol eax, 0x24
popf
jmp 0x140039b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a65c
push rax
pushf
mov eax, 0x7cfb3fd3
pushf
not eax
add eax, 0xdee4152d
xor eax, 0x92777a20
rol eax, 4
popf
pushf
not eax
add eax, 0xa682eaa9
xor eax, 0xb3faa76d
rol eax, 0x45
popf
pushf
not eax
add eax, 0xf877d1b5
xor eax, 0xdea88d5f
rol eax, 0x53
popf
pushf
not eax
add eax, 0xf8cc8523
xor eax, 0xb6b7d1f4
rol eax, 0x4f
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x29fb14a1
pushf
not eax
add eax, 0xf89daeeb
xor eax, 0xd34abb23
rol eax, 0x59
popf
pushf
not eax
add eax, 0xb8f9f7cc
xor eax, 0xe4be26a9
rol eax, 0xdc
popf
jmp 0x140039b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400512f9
push rax
pushf
mov eax, 0xe46910eb
pushf
not eax
add eax, 0xb56d8444
xor eax, 0xbf93846c
rol eax, 0x23
popf
pushf
not eax
add eax, 0x81c547ca
xor eax, 0xba5b09b3
rol eax, 0x95
popf
pushf
not eax
add eax, 0xecff43ef
xor eax, 0xfa4a381e
rol eax, 0x13
popf
jmp 0x140039b55
movdqa xmm0, xmmword [0x1400152b0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], r14w
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14003a764
push rax
pushf
mov eax, 0xa1b44399
pushf
not eax
add eax, 0xafb9d610
xor eax, 0xd8997256
rol eax, 0x65
popf
pushf
not eax
add eax, 0xc0d78fc2
xor eax, 0xed3b8ae7
rol eax, 0xdc
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0xcd15a010
pushf
not eax
add eax, 0x8b842417
xor eax, 0x96a96f61
rol eax, 0x85
popf
pushf
not eax
add eax, 0xc1e09da3
xor eax, 0xb0e330bd
rol eax, 0x48
popf
jmp 0x140039b55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a7f5
push rax
pushf
mov eax, 0x82182eea
pushf
not eax
add eax, 0xe88059bd
xor eax, 0xbe9aadfa
rol eax, 5
popf
pushf
not eax
add eax, 0xc1d51673
xor eax, 0x82954156
rol eax, 0x61
popf
pushf
not eax
add eax, 0xc59abfc6
xor eax, 0xc377dfc6
rol eax, 0x62
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x1e950a3b
pushf
not eax
add eax, 0x84ef8c9e
xor eax, 0x96e1142d
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x8a92b327
xor eax, 0x8830c08f
rol eax, 0x79
popf
pushf
not eax
add eax, 0xfe9e87ba
xor eax, 0xdc281a8e
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x9cc313aa
xor eax, 0xb0ea844e
rol eax, 0xda
popf
jmp 0x140039b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a896
push rax
pushf
mov eax, 0x8f1a23e
pushf
not eax
add eax, 0xacc030b0
xor eax, 0xab2161a1
rol eax, 0x45
popf
pushf
not eax
add eax, 0xf3a0dac0
xor eax, 0xd5a2f6be
rol eax, 0x98
popf
jmp 0x140039b55
push rax
pushf
mov eax, 0x499cfcae
pushf
not eax
add eax, 0xd8e88793
xor eax, 0xaaa216cd
rol eax, 0x79
popf
pushf
not eax
add eax, 0xb7f73098
xor eax, 0xddab5d5f
rol eax, 0x45
popf
jmp 0x140039b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400512f9
push rax
pushf
mov eax, 0x779cfea7
pushf
not eax
add eax, 0xc18ec2e5
xor eax, 0xedba1168
rol eax, 0xce
popf
pushf
not eax
add eax, 0xe4c237ad
xor eax, 0xef6cce82
rol eax, 0x40
popf
jmp 0x140039b55
movzx eax, bl
push rax
pushf
mov eax, 0xb3d21001
pushf
not eax
add eax, 0xc8fc548a
xor eax, 0x82f9c745
rol eax, 0x22
popf
pushf
not eax
add eax, 0xeb63e952
xor eax, 0x82ac2a53
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xff250a70
xor eax, 0x83131fc1
rol eax, 0xf8
popf
jmp 0x140039b55
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400623e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400625fb
nop
push rax
pushf
mov eax, 0x6429854b
pushf
not eax
add eax, 0xac60fa9d
xor eax, 0xfc7c247b
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xa498244c
xor eax, 0xa2c8ffc8
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xcc71b664
xor eax, 0xf7e07c63
rol eax, 0x40
popf
pushf
not eax
add eax, 0xf31380b1
xor eax, 0x915ce942
rol eax, 0xe5
popf
jmp 0x140039b55
call fcn.1400625fb
int3