Function at 0x140022d00
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x80], ebx
movabs rax, 0xaf7bb5c108b32e6f
mov qword [rsp + 0x30], rax
movabs rax, 0x6ee3bf1ef6704e09
mov qword [rsp + 0x38], rax
movabs rax, 0x65ffe8d5d4edb578
mov qword [rsp + 0x40], rax
movabs rax, 0xa7c3966187a13e8e
mov qword [rsp + 0x48], rax
movabs rax, 0x83aeaf4ef9a5f3c4
mov qword [rsp + 0x50], rax
movabs rax, 0x24a48e64e201e5c1
mov qword [rsp + 0x58], rax
movabs rax, 0x2f80b4ba23872932
mov qword [rsp + 0x60], rax
movabs rcx, 0x2c8fc43767687f76
mov qword [rsp + 0x68], rcx
movabs r12, 0xdd0fc6a86fd67c33
mov qword [rsp + 0x120], r12
movabs r14, 0x8ad77d973d1270
mov qword [rsp + 0x128], r14
movabs rax, 0x89a9ca6adbee91d
mov qword [rsp + 0x130], rax
movabs rax, 0xd3adf313f5d47dd2
mov qword [rsp + 0x138], rax
movabs rax, 0xd0c2c03c8dcb9c87
mov qword [rsp + 0x140], rax
movabs rax, 0x4dd2fc01b15d91a4
mov qword [rsp + 0x148], rax
movabs rax, 0x2f80b4ba7ff44c51
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140022ea7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x120]
call fcn.14001b2a0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140022ed0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x120]
call fcn.14001ae30
movabs r15, 0xb96ea9c40183087d
mov qword [rsp + 0x80], r15
movabs rax, 0x8aa518e1546034
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0xb16be8c403b2085d
mov qword [rsp + 0xd0], rax
movabs rax, 0x8ad77d973d121c
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r14
movdqa xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140023991
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xc0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0x20b0a518e1546034
mov qword [rsp + 0x38], rax
movabs rax, 0x89a9ca6adbee91d
mov qword [rsp + 0x40], rax
movabs rcx, 0xd3adf313f5d47dd2
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xf0], r12
movabs r15, 0x8ad77d973d1270
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x1400776f0]
call fcn.14001aec0
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0xd0]
call fcn.1400209e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400230b2
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.140035450
mov rcx, rax
call fcn.1400314d0
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140023109
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023104
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a03
call fcn.14003835c
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140079790], eax
jle 0x14002327b
lea rcx, [0x140079790]
call fcn.140038438
cmp dword [0x140079790], 0xffffffff
jne 0x14002327b
movabs rax, 0x9e53abcd1ba50560
mov qword [rsp + 0x30], rax
movabs rax, 0x6fc9a313f24f6005
mov qword [rsp + 0x38], rax
movabs rax, 0x7cffcfcac2cc9d73
mov qword [rsp + 0x40], rax
movabs rax, 0xb6ce9a6587b12e8e
mov qword [rsp + 0x48], rax
movabs rax, 0xd0c2c03c8dcbc0f4
mov qword [rsp + 0x50], rax
movabs rax, 0x4dd2fc01b15d91a4
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
movabs r14, 0x89a9ca6adbee91d
mov qword [rsp + 0x100], r14
movabs rcx, 0xd3adf313f5d47dd2
mov qword [rsp + 0x108], rcx
movabs rcx, 0xd0c2c03c8dcb9c87
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140079700], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140079710], xmm1
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140023240
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rdi, [0x140079700]
mov rcx, rdi
call fcn.14001b2a0
lea rcx, [0x14005ea70]
call fcn.1400386d8
nop
lea rcx, [0x140079790]
call fcn.1400383cc
jmp 0x14002328c
lea rdi, [0x140079700]
movabs r14, 0x89a9ca6adbee91d
cmp qword [0x140079718], 0xf
cmova rdi, qword [0x140079700]
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400232c1
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x1400232ea
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400232ea
mov dil, 1
jmp 0x1400232ed
xor dil, dil
movabs rax, 0xfd6aa5c119a41940
mov qword [rsp + 0x30], rax
movabs rax, 0x79f8a30efe5a7702
mov qword [rsp + 0x38], rax
movabs rax, 0x32e9e9d2ccca9a3d
mov qword [rsp + 0x40], rax
movabs rax, 0xd3adf313f5d47df2
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r14
movabs rax, 0xd3adf313f5d47dd2
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x1400776f0]
call fcn.14001aec0
movzx edx, dil
mov rcx, rax
call fcn.14002def0
mov rcx, rax
call fcn.1400314d0
lea rcx, [rsp + 0xf0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001c490
nop
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400233ca
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.14001ae30
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140023453
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002344e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a09
call fcn.14003835c
movdqa xmm0, xmmword [0x14006e260]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x1400234ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400234a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a0f
call fcn.14003835c
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.14003653c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov esi, 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 9
test r14, r14
je 0x140023582
cmp r14, 0x7fffffff
ja 0x140023a2b
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036564
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a15
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e290
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], rsi
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036564
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a21
mov qword [rsp + 0xd0], rbx
lea rax, [0x140076d60]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d470
movzx edi, al
cmp dword [rsp + 0xd0], 0
jne 0x140023a31
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400235fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a4b
call fcn.14003835c
test dil, dil
je 0x1400238e2
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.14003653c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov qword [rsp + 0x48], rdx
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x207
test r14, r14
je 0x1400236df
cmp r14, 0x7fffffff
ja 0x140023a75
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036564
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a51
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e290
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036564
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a5c
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rdx, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140036cac
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a66
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023744
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002373f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a7b
call fcn.14003835c
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0xa0]
lea r15, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova r15, qword [rsp + 0x90]
call fcn.14003653c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], bx
mov dword [rsp + 0x80], 0x1c7
test r14, r14
je 0x140023819
cmp r14, 0x7fffffff
ja 0x140023ab0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140036564
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140023a81
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x30]
call fcn.14002e290
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140036564
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023a8c
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp rsi, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140036cac
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0xf0], edx
lea rax, [0x140076d60]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xd0], xmm0
cmp edx, 0x91
jne 0x140023888
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14001d5f0
cmp dword [rsp + 0xd0], 0
jne 0x140023a96
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400238d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ab6
call fcn.14003835c
nop
jmp 0x1400238e2
test r13d, r13d
setne dil
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x14002392c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023abc
call fcn.14003835c
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x14002398b
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac2
call fcn.14003835c
movzx eax, dil
jmp 0x1400239d6
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x1400239d4
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ac8
call fcn.14003835c
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140038300
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003e264
nop
call fcn.14003e264
nop
call fcn.14003e264
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
int3
shr rcx, 0x20
call fcn.14001bbe0
int3
call fcn.14001b9d0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.exists
call fcn.14001cd00
nop
call fcn.14003e264
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001cc90
nop
call fcn.14001b9d0
nop
call fcn.14003e264
nop
shr rdi, 0x20
mov ecx, edi
call fcn.14001bbe0
shr rcx, 0x20
call fcn.14001bbe0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
lea rcx, str.remove_all
call fcn.14001cd00
nop
call fcn.14001b9d0
nop
call fcn.14003e264
nop
call fcn.14003e264
nop
call fcn.14003e264
int3
call fcn.14003e264
int3