Function at 0x1401c6bf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14036f2b0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rcx
lea rcx, [0x14034e998]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1401c6e1e
lea rcx, str.RegistryMachineSystemCurrentControlSetServices_
call fcn.14000fa60
mov rcx, rax
call fcn.140005e70
mov rsi, rax
mov rcx, rbx
call fcn.14005a7a0
mov rbp, rax
mov rcx, rbx
call fcn.14000de50
sub rax, rbp
cmp rax, rsi
jb 0x1401c6e4d
mov rcx, rbx
call fcn.1400721e0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
mov r8, rbx
lea rcx, [rsp + 0x78]
call fcn.1401c5250
nop
lea rcx, [rsp + 0x78]
call fcn.1400721e0
mov rdx, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, str.SYSTEMCurrentControlSetServices_
call fcn.14000fa60
mov rcx, rax
call fcn.140005e70
mov rsi, rax
mov rcx, rbx
call fcn.14005a7a0
mov rbp, rax
mov rcx, rbx
call fcn.14000de50
sub rax, rbp
cmp rax, rsi
jb 0x1401c6e47
mov rcx, rbx
call fcn.1400721e0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, str.SYSTEMCurrentControlSetServices_
mov r8, rbx
lea rcx, [rsp + 0x48]
call fcn.1401c5250
nop
lea rcx, [rsp + 0x48]
call fcn.1400721e0
mov rdx, rax
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1401c6d3f
cmp eax, 2
sete bl
jmp 0x1401c6e06
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x68]
call rax
mov ebx, eax
lea rdx, str.___NtUnloadDriver_Status_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1401c4cb0
mov rcx, rax
lea rdx, [0x140122460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1401c3ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test ebx, ebx
je 0x1401c6de6
lea rdx, str.____Driver_Unload_Failed__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1401c4cb0
mov rcx, rax
lea rdx, [0x1401c3ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x48]
call fcn.1400721e0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x1401c6e06
lea rcx, [rsp + 0x48]
call fcn.1400721e0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
jne 0x1401c6de2
mov bl, 1
lea rcx, [rsp + 0x48]
call fcn.14000df90
nop
lea rcx, [rsp + 0x78]
call fcn.14000df90
movzx eax, bl
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140253d60
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140005ec0
nop
call fcn.140005ec0
int3