Function at 0x140023e70
Capabilities:
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x398], rbx
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r13d, r8d
mov r12d, edx
mov rsi, rcx
mov r8d, dword [rcx + 0x50]
lea rdx, [rsp + 0x70]
call fcn.140023df0
nop
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140023f2a
lea rdx, str.EndpointId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x50], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
or r14, 0xffffffffffffffff
cmp dword [rsp + 0x50], ebx
jne 0x14002469b
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x120]
call fcn.14005b890
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
lea r8d, [r14 + 0xe]
lea rdx, [0x140087d40]
lea rcx, [rbp - 0x28]
call fcn.140002500
nop
lea r8d, [r14 + 0x10]
lea rdx, str.WavesSvc64.exe
lea rcx, [rbp - 0x28]
call fcn.140002500
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x68], 0
cmp byte [rbp + 0x120], 0
jne 0x140023fd2
mov r8, rbx
jmp 0x140023fea
lea rax, [rbp + 0x120]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140023fe0
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140002500
nop
mov rcx, qword [rbp - 0x58]
cmp rcx, 1
jb 0x140024066
lea rax, [rbp - 0x68]
mov rdi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x50]
cmp r15, 0x10
cmovae rax, rdi
lea rbx, [rcx - 1]
add rbx, rax
cmp byte [rbx], 0x5c
sete al
test al, al
je 0x140024042
movzx eax, byte [rbx]
cmp al, byte [0x140086b1c]
jne 0x140024039
xor eax, eax
jmp 0x14002403e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140024055
lea rcx, [rbp - 0x68]
call fcn.140002440
cmp rbx, rax
je 0x140024066
dec rbx
jmp 0x140024020
lea rax, [rbp - 0x68]
cmp r15, 0x10
cmovae rax, rdi
sub rbx, rax
jmp 0x140024069
mov rbx, r14
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp - 0x68]
call fcn.140018850
nop
lea r8, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14002b330
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000bed0
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x1400240f2
inc rax
mov rcx, qword [rbp - 8]
cmp rax, 0x1000
jb 0x1400240ed
test cl, 0x1f
je 0x1400240c0
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400240cf
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400240de
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x1400240ea
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0x10], 0xf
xor r15d, r15d
mov qword [rbp + 8], r15
mov byte [rbp - 8], r15b
mov rax, qword [rbp + 0x110]
cmp rax, 0x10
jb 0x140024161
inc rax
mov rcx, qword [rbp + 0xf8]
cmp rax, 0x1000
jb 0x14002415c
test cl, 0x1f
je 0x14002412f
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002413e
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002414d
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024159
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov edx, r13d
lea rcx, [rbp + 0xd8]
call fcn.140022f70
mov rdi, rax
mov edx, r12d
lea rcx, [rbp + 0xb8]
call fcn.140022f70
mov rbx, rax
mov edx, dword [rsi + 0x50]
lea rcx, [rbp + 0x98]
call fcn.140022f90
nop
mov r8, rax
lea rdx, str._Retask
lea rcx, [rbp + 0x78]
call fcn.14002b380
nop
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.14002b3e0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14002b2a0
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14002b3e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14002b2a0
nop
mov rax, qword [rbp + 0x30]
cmp rax, 0x10
jb 0x140024239
inc rax
mov rcx, qword [rbp + 0x18]
cmp rax, 0x1000
jb 0x140024234
test cl, 0x1f
je 0x140024207
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024216
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024225
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024231
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0x30], 0xf
mov qword [rbp + 0x28], r15
mov byte [rbp + 0x18], 0
mov rax, qword [rbp + 0x50]
cmp rax, 0x10
jb 0x14002429f
inc rax
mov rcx, qword [rbp + 0x38]
cmp rax, 0x1000
jb 0x14002429a
test cl, 0x1f
je 0x14002426d
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002427c
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002428b
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024297
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0x50], 0xf
mov qword [rbp + 0x48], r15
mov byte [rbp + 0x38], 0
mov rax, qword [rbp + 0x70]
cmp rax, 0x10
jb 0x140024305
inc rax
mov rcx, qword [rbp + 0x58]
cmp rax, 0x1000
jb 0x140024300
test cl, 0x1f
je 0x1400242d3
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400242e2
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400242f1
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x1400242fd
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r15
mov byte [rbp + 0x58], 0
mov rax, qword [rbp + 0x90]
cmp rax, 0x10
jb 0x14002436e
inc rax
mov rcx, qword [rbp + 0x78]
cmp rax, 0x1000
jb 0x140024369
test cl, 0x1f
je 0x14002433c
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002434b
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002435a
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024366
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
mov rax, qword [rbp + 0xb0]
cmp rax, 0x10
jb 0x1400243e0
inc rax
mov rcx, qword [rbp + 0x98]
cmp rax, 0x1000
jb 0x1400243db
test cl, 0x1f
je 0x1400243ae
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400243bd
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400243cc
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x1400243d8
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
mov rax, qword [rbp + 0xd0]
cmp rax, 0x10
jb 0x140024455
inc rax
mov rcx, qword [rbp + 0xb8]
cmp rax, 0x1000
jb 0x140024450
test cl, 0x1f
je 0x140024423
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024432
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024441
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x14002444d
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0xd0], 0xf
mov qword [rbp + 0xc8], r15
mov byte [rbp + 0xb8], 0
mov rax, qword [rbp + 0xf0]
cmp rax, 0x10
jb 0x1400244ca
inc rax
mov rcx, qword [rbp + 0xd8]
cmp rax, 0x1000
jb 0x1400244c5
test cl, 0x1f
je 0x140024498
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400244a7
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400244b6
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x1400244c2
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp + 0xf0], 0xf
mov qword [rbp + 0xe8], r15
mov byte [rbp + 0xd8], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
call fcn.14000f920
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x54]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000f9b0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000f9e0
add rdi, 4
lea rax, [rsp + 0x58]
cmp rdi, rax
je 0x14002454c
mov rbx, qword [rsp + 0x60]
jmp 0x140024510
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
lea r8, [rsp + 0x60]
call fcn.14002f530
nop
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x1400245c9
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x1400245c4
test cl, 0x1f
je 0x140024597
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400245a6
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400245b5
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x1400245c1
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x48], 0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14002462f
inc rax
mov rcx, qword [rbp - 0x68]
cmp rax, 0x1000
jb 0x14002462a
test cl, 0x1f
je 0x1400245fd
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002460c
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002461b
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024627
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x140024704
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x140024694
test cl, 0x1f
je 0x140024667
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024676
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024685
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140024691
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
jmp 0x140024704
mov rcx, qword [rsi + 0x2d0]
test rcx, rcx
je 0x1400246b8
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400246b8
mov qword [rsi + 0x2d0], rbx
cmp qword [rsi + 0x2d0], rbx
jne 0x1400246e5
lea r9, str.RealtekAudioBackgroundProcessClass
lea r8, str.RealtekAudioBackgroundProcessClass
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov qword [rsi + 0x2d0], rax
cmp rax, rbx
je 0x1400246f5
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call fcn.140024750
jmp 0x140024704
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call fcn.1400249c0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140024722
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14003aa30
mov rbx, qword [rsp + 0x398]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret