Function at 0x140022d00
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x80], ebx
movabs rax, 0x233aabb029d8c1f
mov qword [rsp + 0x30], rax
movabs rax, 0xe4d6e47c968db5cd
mov qword [rsp + 0x38], rax
movabs rax, 0x7fab2a7ff7b0cd90
mov qword [rsp + 0x40], rax
movabs rax, 0x12e05b5bf95a7272
mov qword [rsp + 0x48], rax
movabs rax, 0xbf8e64fcb7fc1eb4
mov qword [rsp + 0x50], rax
movabs rax, 0xc5cf00ae31c4451d
mov qword [rsp + 0x58], rax
movabs rax, 0x74fa02784bad465a
mov qword [rsp + 0x60], rax
movabs rcx, 0xa0fa15351b1f4c22
mov qword [rsp + 0x68], rcx
movabs r12, 0x7047d9d265f8de43
mov qword [rsp + 0x120], r12
movabs r14, 0x8abf8c1ff7c0e9b4
mov qword [rsp + 0x128], r14
movabs rax, 0x12ce5e0c8ee391f5
mov qword [rsp + 0x130], rax
movabs rax, 0x668e3e298b2f312e
mov qword [rsp + 0x138], rax
movabs rax, 0xece20b8ec39271f7
mov qword [rsp + 0x140], rax
movabs rax, 0xacb972cb62983178
mov qword [rsp + 0x148], rax
movabs rax, 0x74fa027817de2339
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140022ea7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x120]
call fcn.14001b2a0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140022ed0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x120]
call fcn.14001ae30
movabs r15, 0x1426b6be0badaa0d
mov qword [rsp + 0x80], r15
movabs rax, 0x8abffe7a81a99bf0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x1c23f7be099caa2d
mov qword [rsp + 0xd0], rax
movabs rax, 0x8abf8c1ff7c0e9d8
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r14
movdqa xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140023991
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xc0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0xaa85fe7a81a99bf0
mov qword [rsp + 0x38], rax
movabs rax, 0x12ce5e0c8ee391f5
mov qword [rsp + 0x40], rax
movabs rcx, 0x668e3e298b2f312e
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xf0], r12
movabs r15, 0x8abf8c1ff7c0e9b4
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140077700]
call fcn.14001aec0
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0xd0]
call fcn.1400209e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400230b2
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.1400355f0
mov rcx, rax
call fcn.140031670
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140023109
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023104
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a03
call fcn.1400384fc
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400797a0], eax
jle 0x14002327b
lea rcx, [0x1400797a0]
call fcn.1400385d8
cmp dword [0x1400797a0], 0xffffffff
jne 0x14002327b
movabs rax, 0x331bb4b7118ba710
mov qword [rsp + 0x30], rax
movabs rax, 0xe5fcf87192b29bc1
mov qword [rsp + 0x38], rax
movabs rax, 0x66ab0d60e191e59b
mov qword [rsp + 0x40], rax
movabs rax, 0x3ed575ff94a6272
mov qword [rsp + 0x48], rax
movabs rax, 0xece20b8ec3922d84
mov qword [rsp + 0x50], rax
movabs rax, 0xacb972cb62983178
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
movabs r14, 0x12ce5e0c8ee391f5
mov qword [rsp + 0x100], r14
movabs rcx, 0x668e3e298b2f312e
mov qword [rsp + 0x108], rcx
movabs rcx, 0xece20b8ec39271f7
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140079710], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140079720], xmm1
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140023240
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rdi, [0x140079710]
mov rcx, rdi
call fcn.14001b2a0
lea rcx, [0x14005e8c0]
call fcn.140038878
nop
lea rcx, [0x1400797a0]
call fcn.14003856c
jmp 0x14002328c
lea rdi, [0x140079710]
movabs r14, 0x12ce5e0c8ee391f5
cmp qword [0x140079728], 0xf
cmova rdi, qword [0x140079710]
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400232c1
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x1400232ea
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400232ea
mov dil, 1
jmp 0x1400232ed
xor dil, dil
movabs rax, 0x5022babb138abb30
mov qword [rsp + 0x30], rax
movabs rax, 0xf3cdf86c9ea78cc6
mov qword [rsp + 0x38], rax
movabs rax, 0x28bd2b78ef97e2d5
mov qword [rsp + 0x40], rax
movabs rax, 0x668e3e298b2f310e
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r14
movabs rax, 0x668e3e298b2f312e
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140077700]
call fcn.14001aec0
movzx edx, dil
mov rcx, rax
call fcn.14002e090
mov rcx, rax
call fcn.140031670
lea rcx, [rsp + 0xf0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001c490
nop
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400233ca
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.14001ae30
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140023453
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002344e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a09
call fcn.1400384fc
movdqa xmm0, xmmword [0x14006e260]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x1400234ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400234a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a0f
call fcn.1400384fc
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.1400366dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov esi, 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 9
test r14, r14
je 0x140023582
cmp r14, 0x7fffffff
ja 0x140023a2b
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036704
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a15
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e430
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], rsi
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a21
mov qword [rsp + 0xd0], rbx
lea rax, [0x140076d60]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d470
movzx edi, al
cmp dword [rsp + 0xd0], 0
jne 0x140023a31
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400235fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a4b
call fcn.1400384fc
test dil, dil
je 0x1400238e2
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.1400366dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov qword [rsp + 0x48], rdx
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x207
test r14, r14
je 0x1400236df
cmp r14, 0x7fffffff
ja 0x140023a75
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036704
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a51
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e430
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a5c
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rdx, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140036e4c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a66
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023744
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002373f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a7b
call fcn.1400384fc
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.1400366dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x1c7
test r14, r14
je 0x140023819
cmp r14, 0x7fffffff
ja 0x140023ab0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036704
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a81
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e430
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a8c
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rsi, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140036e4c
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0xf0], edx
lea rax, [0x140076d60]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
cmp edx, 0x91
jne 0x140023888
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d5f0
cmp dword [rsp + 0xd0], 0
jne 0x140023a96
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400238d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ab6
call fcn.1400384fc
nop
jmp 0x1400238e2
test r13d, r13d
setne dil
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x14002392c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023abc
call fcn.1400384fc
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14002398b
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac2
call fcn.1400384fc
movzx eax, dil
jmp 0x1400239d6
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x1400239d4
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac8
call fcn.1400384fc
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400384a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003e404
nop
call fcn.14003e404
nop
call fcn.14003e404
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
int3
shr rcx, 0x20
call fcn.14001bbe0
int3
call fcn.14001b9d0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.exists
call fcn.14001cd00
nop
call fcn.14003e404
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001cc90
nop
call fcn.14001b9d0
nop
call fcn.14003e404
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.remove_all
call fcn.14001cd00
nop
call fcn.14001b9d0
nop
call fcn.14003e404
nop
call fcn.14003e404
nop
call fcn.14003e404
int3
call fcn.14003e404
int3