Function at 0x140119f5a
Capabilities:
Delete registry key

Disassembly:
push rax
pushf
mov eax, 0x81a8743b
pushf
not eax
add eax, 0xa6486b20
xor eax, 0xdfc85d9a
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x9982e438
xor eax, 0xba17eec8
rol eax, 0x86
popf
cmp eax, 4
jne 0x140119f97
popf
pop rax
jmp 0x14011a40b
cmp eax, 0
jne 0x140119fa6
popf
pop rax
jmp 0x14011a12c
cmp eax, 3
jne 0x140119fb5
popf
pop rax
jmp 0x14011a3c2
cmp eax, 1
jne 0x140119fc4
popf
pop rax
jmp 0x14011a21e
cmp eax, 0xd
jne 0x140119fd3
popf
pop rax
jmp 0x14011a85f
cmp eax, 0x1a
jne 0x140119fe2
popf
pop rax
jmp 0x14011ae4c
cmp eax, 0xe
jne 0x140119ff1
popf
pop rax
jmp 0x14011a8c5
cmp eax, 0xb
jne 0x14011a000
popf
pop rax
jmp 0x14011a75e
cmp eax, 0x19
jne 0x14011a00f
popf
pop rax
jmp 0x14011ae13
cmp eax, 8
jne 0x14011a01e
popf
pop rax
jmp 0x14011a5d3
cmp eax, 0x10
jne 0x14011a02d
popf
pop rax
jmp 0x14011a9d9
cmp eax, 0x17
jne 0x14011a03c
popf
pop rax
jmp 0x14011ad4a
cmp eax, 9
jne 0x14011a04b
popf
pop rax
jmp 0x14011a624
cmp eax, 0x12
jne 0x14011a05a
popf
pop rax
jmp 0x14011aac9
cmp eax, 0x18
jne 0x14011a069
popf
pop rax
jmp 0x14011adc7
cmp eax, 0x11
jne 0x14011a078
popf
pop rax
jmp 0x14011aa7e
cmp eax, 0x1b
jne 0x14011a087
popf
pop rax
jmp 0x14011ae98
cmp eax, 0x16
jne 0x14011a096
popf
pop rax
jmp 0x14011ad01
cmp eax, 0xa
jne 0x14011a0a5
popf
pop rax
jmp 0x14011a700
cmp eax, 0x14
jne 0x14011a0b4
popf
pop rax
jmp 0x14011ac02
cmp eax, 0xf
jne 0x14011a0c3
popf
pop rax
jmp 0x14011a95b
cmp eax, 0x13
jne 0x14011a0d2
popf
pop rax
jmp 0x14011ab71
cmp eax, 0x15
jne 0x14011a0e1
popf
pop rax
jmp 0x14011aca3
cmp eax, 2
jne 0x14011a0f0
popf
pop rax
jmp 0x14011a319
cmp eax, 6
jne 0x14011a0ff
popf
pop rax
jmp 0x14011a4d1
cmp eax, 0xc
jne 0x14011a10e
popf
pop rax
jmp 0x14011a7ff
cmp eax, 7
jne 0x14011a11d
popf
pop rax
jmp 0x14011a507
cmp eax, 5
jne 0x14011a12c
popf
pop rax
jmp 0x14011a4ca
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
xor r14d, r14d
lea rcx, [0x1a6d2f8ae]
pushf
sub rcx, 0x66c3dc3e
popf
jmp 0x14011a16d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14011a1d8
push rax
pushf
mov eax, 0x796b4a11
pushf
not eax
add eax, 0xde9b387e
xor eax, 0x9da2b45b
rol eax, 0x93
popf
pushf
not eax
add eax, 0xce0d44a2
xor eax, 0xe2d8795c
rol eax, 0xad
popf
pushf
not eax
add eax, 0xec9ddc9e
xor eax, 0x807a1e0a
rol eax, 0xba
popf
pushf
not eax
add eax, 0xd644d94f
xor eax, 0xcf90a7b3
rol eax, 0x75
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xa076599e
pushf
not eax
add eax, 0xd9c754ea
xor eax, 0x9210633e
rol eax, 0x84
popf
pushf
not eax
add eax, 0xe995527d
xor eax, 0xc22e51af
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xeaded4a6
xor eax, 0x991fdfe5
rol eax, 0x80
popf
jmp 0x140119f88
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x1c2d0a734d8707c1
pushf
not rdi
add rdi, 0x6f851b93
xor rdi, 0x6a827aaf
rol rdi, 0x7e
popf
pushf
not rdi
add rdi, 0x50820b73
xor rdi, 0x58050fb7
rol rdi, 0x2d
popf
pushf
not rdi
add rdi, 0x53272c23
xor rdi, 0x4e93976e
rol rdi, 0xea
popf
pushf
not rdi
add rdi, 0x5ca0243b
xor rdi, 0x493c5656
rol rdi, 0x24
popf
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x14011a2d3
push rax
pushf
mov eax, 0xeb089ba
pushf
not eax
add eax, 0xb3b8c97e
xor eax, 0xa29bbbae
rol eax, 0x48
popf
pushf
not eax
add eax, 0x8a70920f
xor eax, 0xf6ec2503
rol eax, 0x9f
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xaf151e12
pushf
not eax
add eax, 0x8d44ce9d
xor eax, 0xcbd4f2f4
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xed6b1c4b
xor eax, 0xb1e6593e
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x9e85ba67
xor eax, 0x9a976823
rol eax, 0x26
popf
jmp 0x140119f88
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14011a37c
push rax
pushf
mov eax, 0xe0292e09
pushf
not eax
add eax, 0xd9acdc18
xor eax, 0xea115db3
rol eax, 0xde
popf
pushf
not eax
add eax, 0xdb0c36b7
xor eax, 0x92c1c5d1
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xfe406425
xor eax, 0xc32e4669
rol eax, 0xce
popf
pushf
not eax
add eax, 0x92495a20
xor eax, 0xc8532159
rol eax, 0x73
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0x7aa602e6
pushf
not eax
add eax, 0xe9eeeba3
xor eax, 0xda78979c
rol eax, 0x69
popf
pushf
not eax
add eax, 0xe04b860d
xor eax, 0xaf0895f2
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xe54428fa
xor eax, 0xd83dcbe4
rol eax, 0x31
popf
jmp 0x140119f88
mov rax, qword [rbx]
push rax
pushf
mov eax, 0xae9fd8d0
pushf
not eax
add eax, 0x9701ef48
xor eax, 0xb100ad54
rol eax, 0x93
popf
pushf
not eax
add eax, 0xe641f54e
xor eax, 0xdabc1f71
rol eax, 0x50
popf
pushf
not eax
add eax, 0xdac23b1c
xor eax, 0xa1786380
rol eax, 0x88
popf
jmp 0x140119f88
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, [0x191f321dc]
pushf
sub r9, 0x51e4052c
popf
lea rcx, [rbp + 0xf]
call fcn.1401a7fb8
nop
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rcx, [rbp + 0x2f]
jmp 0x14011a44d
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x14011a497
push rax
pushf
mov eax, 0xdcf3b47d
pushf
not eax
add eax, 0xdc04f850
xor eax, 0xfa03b74f
rol eax, 0x30
popf
pushf
not eax
add eax, 0x83915edd
xor eax, 0x8ef459de
rol eax, 0xfe
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0x66f4b780
pushf
not eax
add eax, 0xc25e058d
xor eax, 0x8283590e
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x8ba88f78
xor eax, 0x80274a82
rol eax, 0x56
popf
jmp 0x140119f88
cmp qword [rbx + 0x18], 8
jb 0x14011a507
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0xc6a60dda
pushf
not eax
add eax, 0xd79f6d1d
xor eax, 0x8b7a373b
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x937f70b1
xor eax, 0xf1991ea3
rol eax, 0x76
popf
jmp 0x140119f88
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, [0x197680505]
pushf
sub r9, 0x5758e915
popf
lea rcx, [rbp - 0x11]
call fcn.1401a7fb8
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
mov rcx, 0xffffffff80000002
jmp 0x14011a550
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14011a58d
push rax
pushf
mov eax, 0xd7e90aa1
pushf
not eax
add eax, 0xaf30acfa
xor eax, 0xce08645b
rol eax, 0x68
popf
pushf
not eax
add eax, 0xe775c72f
xor eax, 0x9fafc415
rol eax, 0xe8
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0x110b7058
pushf
not eax
add eax, 0x83ca0163
xor eax, 0x8a506845
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xf864d531
xor eax, 0xb39f4c33
rol eax, 0x25
popf
pushf
not eax
add eax, 0xbf4bced8
xor eax, 0xf8122eb7
rol eax, 0x63
popf
jmp 0x140119f88
cmp eax, 2
sete bl
jmp 0x14011a8c5
mov rcx, qword [rbp - 0x19]
jmp 0x14011a629
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1ad356a78]
pushf
sub rdx, 0x6d264d58
popf
mov rcx, rsi
jmp 0x14011a645
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x2f]
jmp 0x14011a650
call rax
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14011a6ba
push rax
pushf
mov eax, 0x33447ac3
pushf
not eax
add eax, 0xf9a12965
xor eax, 0xe6732c71
rol eax, 0xda
popf
pushf
not eax
add eax, 0xd4c4ec32
xor eax, 0xfef3aab4
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xcd125ef5
xor eax, 0xfdec5de3
rol eax, 5
popf
pushf
not eax
add eax, 0xb4d58aa1
xor eax, 0xf4a2421e
rol eax, 0xd7
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xdf1867b9
pushf
not eax
add eax, 0x9821bbc4
xor eax, 0xc902742f
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xeaa3f1f6
xor eax, 0xa4bb8311
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x93df3456
xor eax, 0xcb682f25
rol eax, 0x7c
popf
jmp 0x140119f88
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14011a70b
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x14011a8c5
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
jmp 0x14011a769
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14011a7cc
push rax
pushf
mov eax, 0x6e988232
pushf
not eax
add eax, 0xbdbf1365
xor eax, 0xe7d6017e
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xe0c80b2c
xor eax, 0xcf6d7715
rol eax, 0x60
popf
pushf
not eax
add eax, 0xc38433a8
xor eax, 0xdd63d338
rol eax, 0x70
popf
pushf
not eax
add eax, 0xfde45168
xor eax, 0xb340db26
rol eax, 0x21
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0x645684b
pushf
not eax
add eax, 0xf4549b9d
xor eax, 0xc2f67fd4
rol eax, 0x64
popf
pushf
not eax
add eax, 0x8aff5a2a
xor eax, 0xbb5e91d7
rol eax, 0xee
popf
jmp 0x140119f88
xor bl, bl
jmp 0x14011a8c5
mov bl, 0x1d
pushf
not bl
add bl, 0x2a
xor bl, 0x6f
rol bl, 0x1b
popf
pushf
not bl
add bl, 0xdd
xor bl, 0x41
rol bl, 0xd9
popf
push rax
pushf
mov eax, 0x704e1c2a
pushf
not eax
add eax, 0x94b6f884
xor eax, 0xbbc8c2e5
rol eax, 0x53
popf
pushf
not eax
add eax, 0xf75ad736
xor eax, 0x9aad3d1c
rol eax, 0x15
popf
pushf
not eax
add eax, 0xe1938f18
xor eax, 0xfc6393fb
rol eax, 0xd2
popf
jmp 0x140119f88
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14011a902
push rax
pushf
mov eax, 0x2be6c1e4
pushf
not eax
add eax, 0xb3b050d5
xor eax, 0xe5576267
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xb76608f0
xor eax, 0x87efbd3f
rol eax, 0x63
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xdd3cd13c
pushf
not eax
add eax, 0xc7a745d8
xor eax, 0xd3b066b2
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xcd9d56df
xor eax, 0xbaf1001d
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x9eeedfcd
xor eax, 0x8e810780
rol eax, 0x53
popf
pushf
not eax
add eax, 0x90ce77c6
xor eax, 0xda37e93a
rol eax, 0x71
popf
jmp 0x140119f88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011a9a6
push rax
pushf
mov eax, 0x60452d14
pushf
not eax
add eax, 0xb77b2a94
xor eax, 0xc7b6b857
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xfaefe941
xor eax, 0xd9e15eef
rol eax, 0x71
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0x77724080
pushf
not eax
add eax, 0xe3422565
xor eax, 0xb9e91708
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xc9ee6ec9
xor eax, 0xafff2ffb
rol eax, 9
popf
jmp 0x140119f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aa25
push rax
pushf
mov eax, 0x93bdf6fb
pushf
not eax
add eax, 0xefa0a698
xor eax, 0xd180abc5
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xdcbbb8c8
xor eax, 0xfe9230b6
rol eax, 0x25
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xb4ca69eb
pushf
not eax
add eax, 0x93747ce8
xor eax, 0x9f0b32fa
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xa5bfb5c2
xor eax, 0xd899b927
rol eax, 0x22
popf
pushf
not eax
add eax, 0xab8bb27e
xor eax, 0x93b27765
rol eax, 0x61
popf
pushf
not eax
add eax, 0x91050791
xor eax, 0xff8c888d
rol eax, 0x34
popf
jmp 0x140119f88
call fcn.1401eb76d
push rax
pushf
mov eax, 0xf779aebc
pushf
not eax
add eax, 0xdfd209e8
xor eax, 0xa4be3e64
rol eax, 0x95
popf
pushf
not eax
add eax, 0xed9e34d9
xor eax, 0xdb0b067e
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xd42757f0
xor eax, 0x974b2670
rol eax, 0xf1
popf
jmp 0x140119f88
movdqa xmm0, xmmword [0x1400f8e50]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], r14w
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14011ab18
push rax
pushf
mov eax, 0x51361b23
pushf
not eax
add eax, 0xcd5521b4
xor eax, 0xf1889584
rol eax, 0x49
popf
pushf
not eax
add eax, 0xc7ffb76a
xor eax, 0xf8d98e4c
rol eax, 0xc3
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xa1e238c5
pushf
not eax
add eax, 0x9f466637
xor eax, 0xf22d6319
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xfe83910c
xor eax, 0xc89eadf6
rol eax, 0xef
popf
pushf
not eax
add eax, 0xdf085dc5
xor eax, 0xef7f9677
rol eax, 0x26
popf
pushf
not eax
add eax, 0xf22e1d30
xor eax, 0x9a2cfe98
rol eax, 0xad
popf
jmp 0x140119f88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011abbc
push rax
pushf
mov eax, 0xf83291de
pushf
not eax
add eax, 0x9afaa1e5
xor eax, 0xda4738b4
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x8cdc9b2a
xor eax, 0xaa9fec60
rol eax, 0x18
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xb68aacf6
pushf
not eax
add eax, 0xc6bb23ea
xor eax, 0xca35c999
rol eax, 0xca
popf
pushf
not eax
add eax, 0xba491559
xor eax, 0x9e47f7be
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x914c8432
xor eax, 0xefb8906a
rol eax, 0x97
popf
jmp 0x140119f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011ac70
push rax
pushf
mov eax, 0xf17eecf2
pushf
not eax
add eax, 0x847b8938
xor eax, 0x988ca75e
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xddc083a2
xor eax, 0xd9306ae7
rol eax, 0x14
popf
pushf
not eax
add eax, 0xaa2f9796
xor eax, 0xbd6bd214
rol eax, 2
popf
pushf
not eax
add eax, 0xf1892250
xor eax, 0xdeee151e
rol eax, 0x1f
popf
jmp 0x140119f88
push rax
pushf
mov eax, 0xc574fede
pushf
not eax
add eax, 0x84fcec29
xor eax, 0x889914c9
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x8bda789e
xor eax, 0x940fdee5
rol eax, 0xf4
popf
jmp 0x140119f88
call fcn.1401eb76d
push rax
pushf
mov eax, 0xe0af124b
pushf
not eax
add eax, 0xf2a70758
xor eax, 0x81c954d9
rol eax, 0x33
popf
pushf
not eax
add eax, 0xe1bb09a9
xor eax, 0xca77c546
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xa45eeb0e
xor eax, 0xa0be9553
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x9f899da9
xor eax, 0xbe995de5
rol eax, 0xde
popf
jmp 0x140119f88
movzx eax, bl
push rax
pushf
mov eax, 0x83e5cc2f
pushf
not eax
add eax, 0xf9d39392
xor eax, 0x99d07f39
rol eax, 0x82
popf
pushf
not eax
add eax, 0xf4456ba9
xor eax, 0x87fe3bdd
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xfe66da6e
xor eax, 0xd8417ade
rol eax, 0x57
popf
jmp 0x140119f88
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14027ae25
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1401c2053
int3
call fcn.14027e366
nop
push rax
pushf
mov eax, 0x15f4fad
pushf
not eax
add eax, 0x8cb0f955
xor eax, 0x8c926ed7
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xe447aaba
xor eax, 0xf355c3b8
rol eax, 0x79
popf
jmp 0x140119f88
call fcn.14027e366
nop
push rax
pushf
mov eax, 0x537618b4
pushf
not eax
add eax, 0xfb965dc8
xor eax, 0xd2370b77
rol eax, 0x58
popf
pushf
not eax
add eax, 0xa2f48e5c
xor eax, 0xe61204f4
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xdc16a7b1
xor eax, 0x94d70a2c
rol eax, 0x62
popf
jmp 0x140119f88
call fcn.1401c2053
int3