Function at 0x5ab690
Capabilities:
Delete registry key

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
nop
lea rcx, [rbp + 0x68]
mov rax, qword [0x0060fda0]
mov rdx, qword [rax]
call fcn.0040bc70
lea rcx, [0x005abccc]
mov rdx, qword [rbp + 0x68]
call fcn.0040c4f0
test eax, eax
setg dil
mov rbx, 0xffffffff80000001
mov rcx, qword [0x00478aa8]
mov dl, 1
call fcn.0047a080
mov rsi, rax
mov rcx, rsi
lea rdx, [0x005abce8]
call fcn.0047b4e0
test al, al
je 0x5ab760
mov rcx, rsi
lea rdx, [0x005abce8]
xor r8, r8
call fcn.0047a3e0
mov rcx, rsi
lea rdx, [rbp + 0x78]
lea r8, [0x005abd78]
call fcn.0047b0d0
mov rcx, rsi
mov rdx, 0xffffffff80000002
call fcn.0047a340
mov rcx, rsi
lea rdx, [0x005abce8]
call fcn.0047b4e0
test al, al
je 0x5ab7ae
mov rbx, 0xffffffff80000002
mov rcx, rsi
lea rdx, [0x005abce8]
xor r8, r8
call fcn.0047a3e0
mov rcx, rsi
lea rdx, [rbp + 0x78]
lea r8, [0x005abd78]
call fcn.0047b0d0
mov rcx, rsi
call fcn.004075c0
cmp rbx, 0xffffffff80000002
jne 0x5ab7ef
call fcn.005acd20
test al, al
jne 0x5ab7ef
test dil, dil
je 0x5ab7db
lea rcx, [0x005abda4]
call fcn.005ace50
jmp 0x5ab7e7
lea rcx, [0x005abdec]
call fcn.005ace50
xor rcx, rcx
call sub.kernel32.dll_ExitProcess
xor rsi, rsi
test dil, dil
jne 0x5ab93f
mov rcx, qword [0x00525f68]
mov dl, 1
xor r8, r8
call fcn.0052b8c0
mov rdi, rax
lea rcx, [rbp + 0x60]
lea rdx, [0x005abe24]
call fcn.005a4920
lea rcx, [rdi + 0x78]
mov rdx, qword [rbp + 0x60]
call fcn.0040ae30
lea rcx, [rbp + 0x58]
lea rdx, [0x005abe44]
call fcn.005a4920
mov rcx, rdi
mov rdx, qword [rbp + 0x58]
call fcn.0052cc30
lea rcx, [rbp + 0x48]
lea rdx, [0x005abe80]
call fcn.005a4920
lea rcx, [rbp + 0x40]
lea rdx, [0x005abef4]
call fcn.005a4920
lea rcx, [rbp + 0x50]
mov edx, 3
mov r8, qword [rbp + 0x48]
lea r9, [0x005abedc]
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.0040c140
mov rcx, rdi
mov rdx, qword [rbp + 0x50]
call fcn.0052cbd0
lea rcx, [rbp + 0x38]
lea rdx, [0x005abfac]
call fcn.005a4920
lea rcx, [rdi + 0x110]
mov rdx, qword [rbp + 0x38]
call fcn.0040ae30
lea rax, [rdi + 0x1a8]
mov rcx, qword [0x005a6588]
mov qword [rax + 8], rcx
lea rcx, [0x005ab680]
mov qword [rax], rcx
mov rcx, rdi
movzx rdx, word [0x005abfee]
call fcn.0052ca10
movzx rax, byte [0x005abff0]
mov byte [rdi + 0x80], al
mov byte [rdi + 0x98], 1
mov rcx, rdi
mov dx, 0xffe2
call fcn.00407af0
mov rcx, rdi
call rax
test al, al
jne 0x5ab915
xor rcx, rcx
call sub.kernel32.dll_ExitProcess
cmp dword [rdi + 0xd8], 6
je 0x5ab926
xor rcx, rcx
call sub.kernel32.dll_ExitProcess
movzx rax, word [rdi + 0xb8]
test ax, 0x100
setne sil
mov rcx, rdi
call fcn.004075c0
test sil, sil
je 0x5ab9aa
mov rcx, 0xffffffff80000001
lea rdx, [0x005abff2]
mov r8d, pe_nt_image_headers64
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, 0xffffffff80000002
lea rdx, [0x005abff2]
mov r8d, pe_nt_image_headers64
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, 0xffffffff80000001
lea rdx, [0x005ac038]
mov r8b, 1
call fcn.005a6680
mov rcx, 0xffffffff80000002
lea rdx, [0x005ac038]
mov r8b, 1
call fcn.005a6680
call fcn.005a6050
mov rcx, 0xffffffff80000001
lea rdx, [0x005ac070]
mov r8b, 1
call fcn.005a6680
mov ecx, 0x80000002
lea rdx, [0x005ac070]
xor r8, r8
call fcn.0059e610
mov rcx, 0xffffffff80000002
lea rdx, [0x005ac070]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac108]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac190]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac218]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac2d4]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac2d4]
xor r8, r8
call fcn.005a6680
mov rcx, qword [0x00478aa8]
mov dl, 1
mov r8d, 0xf013f
call fcn.0047a130
mov rdi, rax
mov rcx, rdi
mov rdx, rbx
call fcn.0047a340
mov rcx, rdi
lea rdx, [0x005ac35c]
call fcn.0047a870
mov rcx, rdi
call fcn.004075c0
mov rcx, qword [0x00478aa8]
mov dl, 1
call fcn.0047a080
mov rdi, rax
mov rcx, rdi
mov rdx, rbx
call fcn.0047a340
mov rcx, rdi
lea rdx, [0x005abce8]
call fcn.0047a870
mov rcx, rdi
call fcn.004075c0
mov rcx, rbx
lea rdx, [0x005ac43c]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac4c4]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac550]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac5dc]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac668]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac6b0]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac700]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac6b0]
xor r8, r8
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac700]
xor r8, r8
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac74c]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac7cc]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac858]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac8d4]
mov r8d, pe_nt_image_headers64
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, rbx
lea rdx, [0x005ac9c4]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005ac9c4]
xor r8, r8
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005aca50]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005acac4]
mov r8b, 1
call fcn.005a6680
mov rcx, rbx
lea rdx, [0x005acb24]
mov r8b, 1
call fcn.005a6680
test sil, sil
je 0x5abc29
lea rcx, [rbp + 0x30]
call fcn.005aad20
lea rcx, [rbp + 0x30]
lea rdx, [0x005acbc0]
call fcn.0040bf40
mov rcx, qword [rbp + 0x30]
call fcn.005aa930
mov rcx, qword [rbp + 0x78]
call fcn.005aaa00
call fcn.005acbe0
mov rcx, rax
mov edx, 0x10
xor r8, r8
xor r9, r9
call sub.user32.dll_PostMessageW
call fcn.005a6930
call fcn.005a6bc0
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040a8c0
lea rcx, [rbp + 0x78]
call fcn.0040a7e0
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop rbp
ret