Function at 0x1400af620
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x70], xmm9
movdqa xmmword [rbp + 0x60], xmm8
movdqa xmmword [rbp + 0x50], xmm7
movdqa xmmword [rbp + 0x40], xmm6
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov r13, rcx
movabs rax, 0x6c642e6c6c64746e
mov qword [rbp - 0x30], rax
mov word [rbp - 0x28], WSASetLastError
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400af6c6
mov r14, rax
mov rdi, qword [r13 + 0x10]
movabs r15, 0x7ffffffffffffffe
mov rax, r15
sub rax, rdi
cmp rax, 0x33
jbe 0x1400af6f2
cmp qword [r13 + 0x18], 8
mov rsi, r13
jb 0x1400af6aa
mov rsi, qword [r13]
cmp dword [0x1406e823c], 0xa
jl 0x1400af6f7
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400af73a
jmp 0x1400af6f7
xor r14d, r14d
mov eax, r14d
movaps xmm6, xmmword [rbp + 0x40]
movaps xmm7, xmmword [rbp + 0x50]
movaps xmm8, xmmword [rbp + 0x60]
movaps xmm9, xmmword [rbp + 0x70]
add rsp, 0x108
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14008dc80
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], gethostname
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rbx, [rbp - 0x30]
mov rcx, rbx
mov r8, r13
call fcn.1400a5a10
cmp dword [0x1406e823c], 0xa
jl 0x1400af762
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400af762
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], gethostname
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x30]
mov r8, r13
call fcn.1400a5a10
jmp 0x1400af6f7
cmp qword [rbp - 0x18], 8
jb 0x1400af76d
mov rbx, qword [rbp - 0x30]
lea rcx, [rbp - 0x48]
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov r12, qword [r13 + 0x10]
sub r15, r12
cmp r15, 0x21
jbe 0x1400af7b0
cmp qword [r13 + 0x18], 8
mov rdi, r13
jb 0x1400af794
mov rdi, qword [r13]
cmp dword [0x1406e823c], 0xa
jl 0x1400af7b5
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400af7f8
jmp 0x1400af7b5
call fcn.14008dc80
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], Ordinal_41
lea r9, str.SYSTEMCurrentControlSetServices_
lea rbx, [rbp - 0x10]
mov rcx, rbx
mov r8, r13
call fcn.1400a5a10
cmp dword [0x1406e823c], 0xa
jl 0x1400af820
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400af820
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], Ordinal_41
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x10]
mov r8, r13
call fcn.1400a5a10
jmp 0x1400af7b5
cmp qword [rbp + 8], 8
jb 0x1400af82b
mov rbx, qword [rbp - 0x10]
lea r8, [rbp - 0x38]
mov rcx, 0xffffffff80000002
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400af854
mov r14b, 1
cmp eax, 2
je 0x1400afa12
jmp 0x1400afa0f
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x48]
call rax
test eax, eax
je 0x1400af9f1
movups xmm0, xmmword [str.nRQQ_a]
movups xmmword [rbp + 0x1b], xmm0
movdqu xmm0, xmmword [0x1402630c9]
movdqa xmmword [rbp + 0x10], xmm0
mov eax, dword [0x1406e8280]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e8284], 0xa
setl al
or al, cl
movdqa xmm8, xmmword [0x140258800]
xor ecx, ecx
movdqa xmm1, xmmword [str.0000000000000000]
movdqa xmm4, xmmword [0x140258810]
movdqa xmm3, xmmword [0x140258820]
movdqa xmm9, xmmword [str.0123456789:____]
movdqa xmm5, xmmword [0x140259760]
nop word cs:[rax + rax]
movdqa xmm0, xmm8
movdqu xmm7, xmmword [rbp + rcx + 0x10]
movdqa xmm6, xmm0
paddb xmm6, xmm1
movdqa xmm2, xmm4
psubb xmm2, xmm0
pand xmm2, xmm7
pandn xmm7, xmm6
por xmm7, xmm2
movdqu xmmword [rbp + rcx + 0x10], xmm7
lea rdx, [rcx + 0x10]
paddb xmm0, xmm3
test rcx, rcx
mov rcx, rdx
jne 0x1400af8f5
xor byte [rbp + 0x20], 0x40
xor byte [rbp + 0x21], 0x41
xor byte [rbp + 0x22], 0x42
xor byte [rbp + 0x23], 0x43
xor byte [rbp + 0x24], 0x44
xor byte [rbp + 0x25], 0x45
xor byte [rbp + 0x26], 0x46
xor byte [rbp + 0x27], 0x47
xor byte [rbp + 0x28], 0x48
xor byte [rbp + 0x29], 0x49
xor byte [rbp + 0x2a], 0x4a
test al, al
jne 0x1400af9ab
movdqa xmm0, xmmword [rbp + 0x10]
movdqa xmm2, xmm0
pandn xmm2, xmm9
pand xmm0, xmm5
por xmm0, xmm2
movdqa xmmword [rbp + 0x10], xmm0
xor byte [rbp + 0x20], 0x40
xor byte [rbp + 0x21], 0x41
xor byte [rbp + 0x22], 0x42
xor byte [rbp + 0x23], 0x43
xor byte [rbp + 0x24], 0x44
xor byte [rbp + 0x25], 0x45
xor byte [rbp + 0x26], 0x46
xor byte [rbp + 0x27], 0x47
xor byte [rbp + 0x28], 0x48
xor byte [rbp + 0x29], 0x49
xor byte [rbp + 0x2a], 0x4a
xor ecx, ecx
jmp 0x1400af8f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x10]
call fcn.140093140
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp qword [rbp + 8], 8
jb 0x1400af9fe
mov rdx, qword [rbp - 0x10]
jmp 0x1400afa02
cmp qword [rbp + 8], 8
jb 0x1400afa52
mov rdx, qword [rbp - 0x10]
jmp 0x1400afa56
lea rdx, [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor r14d, r14d
lea rcx, [rbp - 0x10]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400afa6b
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400afa9b
lea rdx, [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
sete r14b
jmp 0x1400afa12
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400afa7d
test ebx, ebx
jne 0x1400afad0
cmp dword [0x1406e7d60], 0xa
jl 0x1400afa97
mov edi, dword [0x1406e7d64]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400afaf0
test al, al
jne 0x1400afaf2
cmp edx, 0xa
jl 0x1400afaa4
test ebx, ebx
jne 0x1400afae0
cmp dword [0x1406e7d60], 0xa
jl 0x1400afa6b
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400afa6b
nop
jmp 0x1400afac0
jmp 0x1400afad0
jmp 0x1400afae0
jmp 0x1400afaf0
lea rcx, [rbp - 0x30]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400afb32
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400afb66
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400afb44
test ebx, ebx
jne 0x1400afba0
cmp dword [0x1406e7d60], 0xa
jl 0x1400afb5e
mov edi, dword [0x1406e7d64]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400afbc0
test al, al
jne 0x1400af6c9
cmp edx, 0xa
jl 0x1400afb6f
test ebx, ebx
jne 0x1400afbb0
cmp dword [0x1406e7d60], 0xa
jl 0x1400afb32
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400afb32
nop dword [rax]
jmp 0x1400afb90
jmp 0x1400afba0
jmp 0x1400afbb0
jmp 0x1400afbc0