Function at 0x140048700
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
call fcn.140046e00
test al, al
je 0x140048962
cmp qword [0x1401bfd48], 0xffffffff80000002
je 0x140048962
mov r8b, 1
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140048210
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or esi, 0xffffffff
cmp rcx, rbx
je 0x1400487da
cmp dword [rbx + 0x10], 0
jl 0x1400487cb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400487cb
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], esi
jg 0x1400487c0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x1400487da
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400022b0
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400487f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
xor edi, edi
cmp ecx, 0xe
jne 0x140048891
mov ecx, edi
mov eax, 0x95a02569
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xdb
mov eax, r8d
sub eax, edx
cmp eax, 0x6f
je 0x14004888b
nop dword [rax]
mov eax, r8d
or eax, 0xffffff81
add r8d, eax
inc ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x14004888b
mov eax, 0x95a02569
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xdb
mov eax, r8d
sub eax, edx
cmp eax, 0x6f
jne 0x140048850
mov dword [0x1401c4d60], ecx
mov r14, qword [0x1401bfd48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400488f6
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140048901
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, dword [0x1401c4d60]
lea eax, [r9 + 1]
imul eax, r9d
and eax, 0x80000003
jge 0x14004891e
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 1
jne 0x140048945
mov ecx, eax
cmp r9d, eax
jle 0x14004893f
nop word [rax + rax]
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x140048930
mov dword [0x1401c4d60], ecx
mov r8, r15
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140048ba0
movzx edi, al
mov rbx, qword [rsp + 0x50]
jmp 0x140048b58
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140048210
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or esi, 0xffffffff
cmp rcx, rbx
je 0x1400489c9
cmp dword [rbx + 0x10], 0
jl 0x1400489ba
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400489ba
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], esi
jg 0x1400489af
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x1400489c9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400022b0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400489e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [0x1401bfd48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
je 0x140048a49
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140048a54
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400469b0
test al, al
jne 0x140048a91
lea r8, [rbp - 0x70]
mov r10d, dword [0x1401c4d60]
mov r9d, r10d
nop dword [rax + rax]
lea ecx, [r10 + rdi]
mov eax, r9d
cdq
idiv ecx
mov dword [r8], edx
inc edi
dec r9d
lea r8, [r8 + 4]
movsxd rax, edi
cmp rax, 0xb6
jb 0x140048a70
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [0x1401bfd48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140048af1
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x140048aec
dec r8d
mov dword [0x1401c4d60], r8d
xor dil, dil
jmp 0x140048b58
mov rax, qword [r15]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
jne 0x140048b0d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x140048b47
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140048b47
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
jg 0x140048b6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movzx eax, dil
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x380
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret