Function at 0x140022de0
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x80], edi
movabs rax, 0x6ec5ee874e5585
mov qword [rsp + 0x30], rax
movabs rax, 0x1349e861724dc01f
mov qword [rsp + 0x38], rax
movabs rax, 0xbb0cfdea09381af6
mov qword [rsp + 0x40], rax
movabs rax, 0x145ba34e4f550924
mov qword [rsp + 0x48], rax
movabs rax, 0x133f7451437da8de
mov qword [rsp + 0x50], rax
movabs rax, 0x37e6db5c50630f
mov qword [rsp + 0x58], rax
movabs rax, 0x9a39dbf5d0b68b74
mov qword [rsp + 0x60], rax
movabs rcx, 0x308f65a8c3e1c4dc
mov qword [rsp + 0x68], rcx
movabs r12, 0x721ab687e02b07d9
mov qword [rsp + 0x120], r12
movabs r14, 0x7d20800213009c66
mov qword [rsp + 0x128], r14
movabs rax, 0xd6698999706b4693
mov qword [rsp + 0x130], rax
movabs rax, 0x6035c63c3d204a78
mov qword [rsp + 0x138], rax
movabs rax, 0x40531b233713c79d
mov qword [rsp + 0x140], rax
movabs rax, 0x694194be0f0c176a
mov qword [rsp + 0x148], rax
movabs rax, 0x9a39dbf58cc5ee17
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140022f87
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x120]
call fcn.14001b2a0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140022fb0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x120]
call fcn.14001ae30
movabs r15, 0x167bd9eb8e7e7397
mov qword [rsp + 0x80], r15
movabs rax, 0x7d20f2676569ee22
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x1e7e98eb8c4f73b7
mov qword [rsp + 0xd0], rax
movabs rax, 0x7d20800213009c0a
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r14
movdqa xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140023a6f
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xc0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0x5d1af2676569ee22
mov qword [rsp + 0x38], rax
movabs rax, 0xd6698999706b4693
mov qword [rsp + 0x40], rax
movabs rcx, 0x6035c63c3d204a78
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xf0], r12
movabs r15, 0x7d20800213009c66
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x1400786f0]
call fcn.14001aec0
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0xd0]
call fcn.140020a70
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140023192
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.140033780
mov rcx, rax
call fcn.14002f870
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x1400231e9
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400231e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ae1
call fcn.1400364dc
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14007a798], eax
jle 0x14002335b
lea rcx, [0x14007a798]
call fcn.1400365b8
cmp dword [0x14007a798], 0xffffffff
jne 0x14002335b
movabs rax, 0x3146dbe294587e8a
mov qword [rsp + 0x30], rax
movabs rax, 0x1263f46c7672ee13
mov qword [rsp + 0x38], rax
movabs rax, 0xa20cdaf51f1932fd
mov qword [rsp + 0x40], rax
movabs rax, 0x556af4a4f451924
mov qword [rsp + 0x48], rax
movabs rax, 0x40531b2337139bee
mov qword [rsp + 0x50], rax
movabs rax, 0x694194be0f0c176a
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
movabs r14, 0xd6698999706b4693
mov qword [rsp + 0x100], r14
movabs rcx, 0x6035c63c3d204a78
mov qword [rsp + 0x108], rcx
movabs rcx, 0x40531b233713c79d
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x14007a708], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x14007a718], xmm1
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140023320
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14007a708]
mov rcx, rbx
call fcn.14001b2a0
lea rcx, [0x14005c790]
call fcn.140036858
nop
lea rcx, [0x14007a798]
call fcn.14003654c
jmp 0x14002336c
lea rbx, [0x14007a708]
movabs r14, 0xd6698999706b4693
cmp qword [0x14007a720], 0xf
cmova rbx, qword [0x14007a708]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400233a1
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x1400233c9
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400233c9
mov bl, 1
jmp 0x1400233cb
xor bl, bl
movabs rax, 0x527fd5ee965962aa
mov qword [rsp + 0x30], rax
movabs rax, 0x452f4717a67f914
mov qword [rsp + 0x38], rax
movabs rax, 0xec1afced111f35b3
mov qword [rsp + 0x40], rax
movabs rax, 0x6035c63c3d204a58
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r14
movabs rax, 0x6035c63c3d204a78
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x1400786f0]
call fcn.14001aec0
movzx edx, bl
mov rcx, rax
call fcn.14002c290
mov rcx, rax
call fcn.14002f870
lea rcx, [rsp + 0xf0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001c490
nop
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400234a7
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.14001ae30
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140023530
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002352b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ae7
call fcn.1400364dc
movdqa xmm0, xmmword [0x14006ee70]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x14002358b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023aed
call fcn.1400364dc
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
call fcn.1400346dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov r14d, 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], di
mov dword [rsp + 0x80], 9
test rsi, rsi
je 0x140023661
cmp rsi, 0x7fffffff
ja 0x140023af3
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140023af9
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002c630
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], r14
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b05
mov qword [rsp + 0xd0], rdi
lea rax, [0x140077d60]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d460
movzx ebx, al
cmp dword [rsp + 0xd0], 0
jne 0x140023b0f
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400236dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b29
call fcn.1400364dc
test bl, bl
je 0x1400239c2
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
call fcn.1400346dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov rdx, r14
mov qword [rsp + 0x48], rdx
mov word [rsp + 0x30], di
mov dword [rsp + 0x80], 0x207
test rsi, rsi
je 0x1400237be
cmp rsi, 0x7fffffff
ja 0x140023b2f
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b34
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002c630
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b3f
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rdx, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140034e4c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b49
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023823
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002381e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b58
call fcn.1400364dc
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
call fcn.1400346dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], di
mov dword [rsp + 0x80], 0x1c7
test rsi, rsi
je 0x1400238f9
cmp rsi, 0x7fffffff
ja 0x140023b5e
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b63
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002c630
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r15
mov ecx, r12d
call fcn.140034704
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023b6e
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp r14, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140034e4c
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0xf0], edx
lea rax, [0x140077d60]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
cmp edx, 0x91
jne 0x140023968
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d5e0
cmp dword [rsp + 0xd0], 0
jne 0x140023b78
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400239b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b92
call fcn.1400364dc
nop
jmp 0x1400239c2
test r13d, r13d
setne bl
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140023a0b
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b98
call fcn.1400364dc
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x140023a6a
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b9e
call fcn.1400364dc
movzx eax, bl
jmp 0x140023ab4
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x140023ab2
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023aad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ba4
call fcn.1400364dc
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140036480
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003c3e4
nop
call fcn.14003c3e4
nop
call fcn.14003c3e4
nop
call fcn.14001b9d0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14001bbe0
int3
shr rcx, 0x20
call fcn.14001bbe0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.exists
call fcn.14001cd00
nop
call fcn.14003c3e4
nop
call fcn.14001b9d0
shr rbx, 0x20
mov ecx, ebx
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001cc90
nop
call fcn.14003c3e4
nop
call fcn.14001b9d0
shr rbx, 0x20
mov ecx, ebx
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.remove_all
call fcn.14001cd00
nop
call fcn.14003c3e4
nop
call fcn.14003c3e4
nop
call fcn.14003c3e4
int3
call fcn.14003c3e4
int3