Function at 0x140351cc0
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov eax, dword [0x140ae0a30]
mov ebx, dword [0x140ae0a34]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x40]
mov edx, 0x6d0d3197
mov eax, 0xb7b17231
cmove eax, edx
cmp ebx, 0xa
setl byte [rbp + 0x18]
cmovl eax, edx
mov edx, 0x75619657
mov edi, 0x1a04d8
cmp edx, 0x5f7f2e78
jg 0x140351d50
cmp edx, 0x9d78a051
je 0x140351db0
cmp edx, 0xb7b17231
je 0x140351d7f
cmp edx, 0x1a04d8
jne 0x140351d20
mov edx, eax
jmp 0x140351d20
cmp edx, 0x5f7f2e79
je 0x140351d86
cmp edx, 0x6d0d3197
je 0x140351da6
cmp edx, 0x75619657
jne 0x140351d20
movzx ebx, byte [rbp + 0x40]
cmp byte [rbp + 0x18], 0
mov edx, 0xb7b17231
cmovne edx, edi
test bl, bl
cmovne edx, edi
jmp 0x140351d20
mov edx, 0x1a04d8
jmp 0x140351d20
movzx edx, word [0x1406818d9]
mov word [rbp - 0x58], dx
mov rdx, qword [0x1406818d1]
mov qword [rbp - 0x60], rdx
mov edx, 0x9d78a051
jmp 0x140351d20
mov edx, 0x5f7f2e79
jmp 0x140351d20
mov qword [rbp + 0x10], rcx
mov eax, dword [0x140ae0928]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140ae092c], 0xa
setl cl
or cl, al
mov ecx, 0x7b0fe5ea
mov eax, 0xf0c387a7
cmove ecx, eax
mov r8d, 0x5cf01476
cmove r8d, eax
mov eax, dword [0x140ae0a08]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x140ae0a0c], 0xa
setl dl
or dl, al
mov r15d, 0xe528120b
mov eax, 0x1704202e
cmove r15d, eax
mov r11d, 0x10a771b0
cmove r11d, eax
mov eax, dword [0x140ae0c50]
mov edx, dword [0x140ae0c54]
lea r12d, [rax - 1]
imul r12d, eax
test r12b, 1
mov eax, 0xba1695bf
mov r13d, 0xa86ce128
cmove r13d, eax
mov dword [rbp + 0x64], edx
cmp edx, 0xa
cmovl r13d, eax
mov edx, 0x810466a7
lea rsi, [rbp - 0x60]
mov r10d, 0x92955ee7
jmp 0x140351e70
mov rax, qword [rbp - 8]
mov qword [rbp + 0x40], rax
mov edx, 0x17a4db39
nop
mov eax, edx
cmp edx, 0x10a771af
jle 0x140351eb0
cmp eax, 0x46b97a23
jle 0x140351ef0
cmp eax, 0x46b97a24
je 0x140351e62
cmp eax, 0x73e230b1
je 0x140351f42
mov edx, eax
cmp eax, 0x7bf1baed
jne 0x140351e70
mov edx, r11d
jmp 0x140351e70
cmp eax, 0xbc8bcf70
jle 0x140351f20
cmp eax, 0xbc8bcf71
je 0x140352011
cmp eax, 0xe528120b
je 0x140351f50
mov edx, eax
cmp eax, 0x2745cc2
jne 0x140351e70
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x80], rax
mov edx, 0xbc8bcf71
jmp 0x140351e70
mov edx, r15d
cmp eax, 0x10a771b0
je 0x140351e70
cmp eax, 0x1704202e
jne 0x1403521ac
mov edx, 0x10a771b0
jmp 0x140351e70
cmp eax, 0x810466a7
je 0x140351f66
mov edx, eax
cmp eax, 0xaa62751c
jne 0x140351e70
mov qword [rbp + 0x68], rsi
mov edx, 0x2745cc2
jmp 0x140351e70
mov qword [rbp - 8], rsi
mov edx, 0x46b97a24
jmp 0x140351e70
cmp byte [rbp + 0x7c], 0
mov edx, 0x73e230b1
mov eax, 0xaa62751c
cmovne edx, eax
jmp 0x140351e70
test r12b, 1
sete byte [rbp + 0x38]
cmp dword [rbp + 0x64], 0xa
setl byte [rbp + 0x70]
mov eax, 0x12f8892c
jmp 0x140351f90
mov eax, 0xff7cdb4a
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x12f8892b
jg 0x140351fb0
cmp eax, 0xa86ce128
je 0x140351fe1
cmp eax, 0xba1695bf
je 0x140351fe8
cmp eax, 0xff7cdb4a
jne 0x140351f90
jmp 0x140351ff4
cmp eax, 0x2e8f3c48
je 0x140351f7d
cmp eax, 0x1ab26eab
je 0x140351fef
cmp eax, 0x12f8892c
jne 0x140351f90
movzx edx, byte [rbp + 0x38]
cmp byte [rbp + 0x70], 0
mov eax, 0xa86ce128
mov ebx, 0x1ab26eab
cmovne eax, ebx
test dl, dl
cmovne eax, ebx
jmp 0x140351f90
mov eax, 0x1ab26eab
jmp 0x140351f90
mov eax, 0x2e8f3c48
jmp 0x140351f90
mov eax, r13d
jmp 0x140351f90
lea rax, [rbp - 0x57]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
cmp byte [rax], 0
setne byte [rbp + 0x7c]
mov edx, 0x7bf1baed
jmp 0x140351e70
mov r9, rsi
mov rax, qword [rbp + 0x80]
mov edx, 0x6a087684
jmp 0x140352040
mov dword [rbp + 0x70], esi
mov edx, dword [rbp + 0x70]
cmp edx, 0xa
mov edx, 0x86c673e2
cmovl edx, r10d
nop word cs:[rax + rax]
nop
mov r14d, edx
cmp edx, 0x4e01a5ea
jle 0x140352090
cmp r14d, 0x5cf01475
jle 0x1403520d0
cmp r14d, 0x5cf01476
je 0x140352152
cmp r14d, 0x7b0fe5ea
je 0x14035213c
mov edx, r14d
cmp r14d, 0x6a087684
jne 0x140352040
mov edx, 0xc1bb4ed6
jmp 0x140352040
cmp r14d, 0xc1bb4ed5
jg 0x140352110
mov edx, r8d
cmp r14d, 0x92955ee7
je 0x140352040
cmp r14d, 0xa074cc2a
jne 0x14035218f
mov edx, dword [rbp + 8]
add edx, 0x34
mov dword [rbp + 0x38], edx
mov edx, 0x5ce466cf
jmp 0x140352040
cmp r14d, 0x4e01a5eb
je 0x140352022
mov edx, r14d
cmp r14d, 0x5ce466cf
jne 0x140352040
mov edx, dword [rbp + 0x88]
xor edx, dword [rbp + 0x38]
mov rsi, qword [rbp + 0x18]
mov byte [rbp + rsi - 0x60], dl
mov esi, dword [rbp + 0x70]
add esi, 1
mov edx, 0x4e01a5eb
jmp 0x140352040
cmp r14d, 0xc1bb4ed6
je 0x140352146
mov edx, r14d
cmp r14d, 0xf0c387a7
jne 0x140352040
mov edx, dword [rbp + 0x70]
mov edx, dword [rbp + 0x70]
mov edx, dword [rbp + 0x70]
mov edx, 0x5cf01476
jmp 0x140352040
mov edx, 0xa074cc2a
jmp 0x140352040
mov edx, 0x4e01a5eb
xor esi, esi
jmp 0x140352040
movsxd rdx, dword [rbp + 0x70]
mov qword [rbp + 0x18], rdx
mov rdx, qword [rbp + 0x18]
movsx edx, byte [rax + rdx]
mov dword [rbp + 0x88], edx
movsxd rdx, dword [rbp + 0x70]
imul rbx, rdx, 0x51eb851f
mov rdi, rbx
shr rdi, 0x3f
sar rbx, 0x24
add ebx, edi
imul edi, ebx, 0x32
sub edx, edi
mov dword [rbp + 8], edx
mov edx, ecx
jmp 0x140352040
mov edx, r14d
cmp r14d, 0x86c673e2
jne 0x140352040
mov edx, 0x73e230b1
mov rsi, r9
jmp 0x140351e70
mov edx, eax
cmp eax, 0x17a4db39
jne 0x140351e70
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1403522a1
mov rdi, rax
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
mov rcx, rsi
mov rbx, qword [rbp + 0x10]
mov r8, rbx
call fcn.140351520
mov qword [rbp + 0x40], rsi
mov ecx, 0xf30c1eb8
nop
cmp ecx, 0xafff729c
je 0x140352210
cmp ecx, 0xf30c1eb8
jne 0x1403521f0
mov rcx, qword [rbp + 0x40]
call fcn.1402a67c0
mov ecx, 0xafff729c
jmp 0x1403521f0
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp - 8]
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rsi, [rbp + 0x18]
mov rcx, rsi
mov r8, rbx
call fcn.140351520
mov qword [rbp + 0x80], rsi
mov ecx, 0xf30c1eb8
lea r14, [rbp - 0x60]
nop word [rax + rax]
cmp ecx, 0xafff729c
je 0x140352273
cmp ecx, 0xf30c1eb8
jne 0x140352250
mov rcx, qword [rbp + 0x80]
call fcn.1402a67c0
mov ecx, 0xafff729c
jmp 0x140352250
mov qword [rbp + 0x40], rax
mov rdx, qword [rbp + 0x40]
lea r8, [rbp + 8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1403522bb
mov r15b, 1
cmp eax, 2
je 0x140352d5b
jmp 0x140352d58
xor r15d, r15d
mov eax, r15d
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 8]
call rax
test eax, eax
je 0x140352f9e
mov eax, dword [0x140ae0a48]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140ae0a4c], 0xa
setl cl
or cl, al
mov eax, 0xc30b41da
mov edx, 0xd768e06f
cmove eax, edx
mov ecx, 0x5167eeec
cmove ecx, edx
mov edx, 0x80a693c1
nop dword [rax + rax]
cmp edx, 0xd768e06e
jle 0x140352350
cmp edx, 0xd768e06f
je 0x140352362
cmp edx, 0x5167eeec
je 0x140352369
cmp edx, 0x70634c9a
jne 0x140352320
mov edx, ecx
jmp 0x140352320
cmp edx, 0x80a693c1
je 0x14035236d
cmp edx, 0xc30b41da
jne 0x140352320
jmp 0x14035238a
mov edx, 0x5167eeec
jmp 0x140352320
mov edx, eax
jmp 0x140352320
movups xmm0, xmmword [str.j.____e]
movups xmmword [rbp + 0x4b], xmm0
movups xmm0, xmmword [0x1406818db]
movaps xmmword [rbp + 0x40], xmm0
mov edx, 0x70634c9a
jmp 0x140352320
mov eax, dword [0x140ae0d80]
mov r15d, dword [0x140ae0d84]
lea r12d, [rax - 1]
imul r12d, eax
test r12b, 1
sete al
cmp r15d, 0xa
setl cl
or cl, al
mov r9d, 0x2fa6d0a6
mov eax, 0x4f3362b2
cmove r9d, eax
mov r10d, 0xb735d90e
cmove r10d, eax
mov r14d, 0xc5eac9cb
mov eax, 0xa57dc66d
cmove r14d, eax
mov eax, dword [0x140ae0a40]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140ae0a44], 0xa
setl r11b
or r11b, al
mov eax, dword [0x140ae0de8]
mov ecx, dword [0x140ae0dec]
lea ebx, [rax - 1]
imul ebx, eax
mov dword [rbp - 0x20], ebx
test bl, 1
sete al
mov dword [rbp - 0x24], ecx
cmp ecx, 0xa
setl cl
or cl, al
mov ecx, 0x3d173613
mov eax, 0xf5749018
cmove ecx, eax
mov dword [rbp + 0x64], ecx
mov ecx, 0x5a7f476d
cmove ecx, eax
mov ebx, 0xd82810c4
mov eax, 0x8910c097
cmove ebx, eax
mov dword [rbp + 0x10], ebx
mov ebx, 0x94211ee2
cmove ebx, eax
mov dword [rbp - 0x40], ebx
mov ebx, 0x27fd0526
mov eax, 0x38e70a2b
cmove ebx, eax
mov dword [rbp - 0x3c], ebx
mov ebx, 0x90793b4a
cmove ebx, eax
mov dword [rbp - 0x38], ebx
mov eax, 0xbf575762
mov ebx, 0xe6f7101d
cmove eax, ebx
mov r8d, 0x3188a2bd
cmove r8d, ebx
mov edx, 0x701037fe
mov ebx, 0x6a3fbada
cmove edx, ebx
mov dword [rbp - 0x34], edx
test r11b, r11b
mov ebx, 0xf900452
mov edx, 0x9212576
cmove ebx, edx
mov dword [rbp - 0x1c], ebx
mov r13d, 0x4f748ffe
cmove r13d, edx
mov ebx, 0xf506d6e2
mov edx, 0x7163106f
cmove ebx, edx
mov dword [rbp - 0x14], ebx
mov edi, 0x7a06579b
cmove edi, edx
mov ebx, 0x84e72013
mov edx, 0xa4beab28
cmove ebx, edx
mov dword [rbp - 0xc], ebx
mov ebx, 0xd4da2c14
cmove ebx, edx
mov dword [rbp - 0x30], ebx
lea rsi, [rbp + 0x5a]
mov edx, 0x4e8d041b
mov r11d, 0x280f48ce
mov dword [rbp - 0x2c], r15d
mov dword [rbp - 0x28], r12d
mov dword [rbp - 0x18], r13d
mov dword [rbp - 0x10], edi
jmp 0x140352510
mov edx, 0x4a02f1c0
nop word [rax + rax]
mov ebx, edx
cmp edx, 0xf900451
jle 0x140352560
cmp ebx, 0x4f748ffd
jg 0x1403525a0
cmp ebx, 0x310e003f
jle 0x140352604
cmp ebx, 0x310e0040
je 0x140352b8c
mov edx, dword [rbp - 0x30]
cmp ebx, 0x4e8d041b
je 0x140352510
mov edx, ebx
cmp ebx, 0x4a02f1c0
jne 0x140352510
jmp 0x140352cf4
cmp ebx, 0xf506d6e1
jg 0x1403525d0
cmp ebx, 0xa4beab27
jg 0x140352630
cmp ebx, 0x84e72013
je 0x140352ba2
mov edx, ebx
cmp ebx, 0x92553eea
jne 0x140352510
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x38], rdx
mov edx, 0xc27b461
jmp 0x140352510
cmp ebx, 0x73eefb98
jg 0x140352775
cmp ebx, 0x4f748ffe
je 0x140352bac
mov edx, ebx
cmp ebx, 0x7163106f
jne 0x140352510
mov edx, 0x7a06579b
jmp 0x140352510
cmp ebx, 0x9ba28a2
jg 0x140352799
cmp ebx, 0xf506d6e2
je 0x140352bbc
mov edx, ebx
cmp ebx, 0x9212576
jne 0x140352510
mov rdx, qword [rbp + 0x70]
mov edx, 0x4f748ffe
jmp 0x140352510
cmp ebx, 0xf900452
je 0x140352502
mov edx, ebx
cmp ebx, 0x2a026c2a
jne 0x140352510
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x70], rdx
mov edx, 0x9ba28a3
jmp 0x140352510
cmp ebx, 0xa4beab28
je 0x140352bc6
mov edx, ebx
cmp ebx, 0xd4da2c14
jne 0x140352510
test r12b, 1
sete byte [rbp + 0x8f]
cmp r15d, 0xa
setl byte [rbp + 0x7c]
mov ebx, 0x733f9628
jmp 0x140352670
mov ebx, 0x280f48ce
nop dword [rax]
cmp ebx, 0xceff3fd
jle 0x1403526c0
cmp ebx, 0x2fa6d0a5
jle 0x1403526f0
cmp ebx, 0x4f3362b2
je 0x140352747
cmp ebx, 0x733f9628
jne 0x140352758
movzx edx, byte [rbp + 0x8f]
cmp byte [rbp + 0x7c], 0
mov ebx, 0xa57dc66d
cmovne ebx, r11d
test dl, dl
cmovne ebx, r11d
jmp 0x140352670
cmp ebx, 0xc5eac9ca
jg 0x140352710
cmp ebx, 0xa57dc66d
je 0x140352664
cmp ebx, 0xb735d90e
jne 0x140352670
mov rdx, qword [rbp + 0x80]
cmp byte [rdx], 0
setne byte [rbp + 0x88]
mov ebx, r9d
jmp 0x140352670
cmp ebx, 0xceff3fe
je 0x14035272c
cmp ebx, 0x280f48ce
jne 0x140352670
mov ebx, r14d
jmp 0x140352670
cmp ebx, 0xc5eac9cb
je 0x14035273d
cmp ebx, 0x3e6ae8
jne 0x140352670
mov ebx, r10d
jmp 0x140352670
mov qword [rbp + 0x80], rsi
mov ebx, 0x3e6ae8
jmp 0x140352670
mov ebx, 0xceff3fe
jmp 0x140352670
mov rdx, qword [rbp + 0x80]
mov ebx, 0xb735d90e
jmp 0x140352670
cmp ebx, 0x2fa6d0a6
jne 0x140352670
mov dl, byte [rbp + 0x88]
mov byte [rbp + 0x7b], dl
mov edx, dword [rbp - 0xc]
jmp 0x140352510
mov edx, edi
cmp ebx, 0x73eefb99
je 0x140352510
mov edx, ebx
cmp ebx, 0x7a06579b
jne 0x140352510
mov edx, dword [rbp - 0x14]
jmp 0x140352510
mov edx, r13d
cmp ebx, 0x9ba28a3
je 0x140352510
mov edx, ebx
cmp ebx, 0xc27b461
jne 0x140352510
test byte [rbp - 0x20], 1
mov r15, qword [rbp + 0x38]
sete byte [rbp + 0x7a]
cmp dword [rbp - 0x24], 0xa
setl byte [rbp + 0x79]
mov ebx, 0xdb711cfb
jmp 0x1403527f0
mov rdx, qword [rbp + 0x80]
movzx edx, byte [r15 + rdx]
mov byte [rbp + 0x8f], dl
mov ebx, dword [rbp + 0x10]
nop word cs:[rax + rax]
mov r13d, ebx
cmp ebx, 0xf7b1413
jle 0x1403528a0
cmp r13d, 0x4aaa782b
jle 0x140352910
cmp r13d, 0x6a3fbad9
jg 0x1403529a6
cmp r13d, 0x4aaa782c
je 0x140352aa3
mov ebx, r8d
cmp r13d, 0x564c15c9
je 0x1403527f0
mov ebx, r13d
cmp r13d, 0x5a7f476d
jne 0x1403527f0
movzx edx, byte [rbp + 0x8f]
movsxd rbx, dword [rbp + 0x88]
imul rdi, rbx, 0x51eb851f
mov rsi, rdi
shr rsi, 0x3f
sar rdi, 0x24
add edi, esi
imul esi, edi, 0x32
sub ebx, esi
lea esi, [rbx + 0x34]
mov edi, 0xcb
sub edi, ebx
and edi, edx
not edx
and edx, esi
or edi, edx
mov rdx, qword [rbp + 0x80]
mov byte [rbp + rdx + 0x40], dil
mov edx, dword [rbp + 0x88]
add edx, 1
mov dword [rbp + 0x7c], edx
mov ebx, dword [rbp + 0x64]
jmp 0x1403527f0
cmp r13d, 0xbf575761
jle 0x140352960
cmp r13d, 0xe6f7101c
jg 0x1403529d8
cmp r13d, 0xbf575762
je 0x140352ab0
cmp r13d, 0xd82810c4
je 0x140352aba
mov ebx, r13d
cmp r13d, 0xdb711cfb
jne 0x1403527f0
movzx edx, byte [rbp + 0x7a]
cmp byte [rbp + 0x79], 0
mov ebx, 0x6a3fbada
mov esi, 0x8911574b
cmovne ebx, esi
test dl, dl
cmovne ebx, esi
jmp 0x1403527f0
cmp r13d, 0x3188a2bc
jle 0x140352a1a
mov ebx, eax
cmp r13d, 0x3188a2bd
je 0x1403527f0
cmp r13d, 0x38e70a2b
je 0x140352a6d
mov ebx, r13d
cmp r13d, 0x3d173613
jne 0x1403527f0
mov ebx, 0xbac644d6
mov r12d, dword [rbp + 0x7c]
jmp 0x1403527f0
cmp r13d, 0x90793b49
jle 0x140352a4c
cmp r13d, 0x90793b4a
je 0x140352a7d
cmp r13d, 0x94211ee2
je 0x1403527d1
mov ebx, r13d
cmp r13d, 0xbac644d6
jne 0x1403527f0
mov dword [rbp + 0x88], r12d
mov ebx, dword [rbp - 0x38]
jmp 0x1403527f0
cmp r13d, 0x6a3fbada
je 0x140352ac4
cmp r13d, 0x701037fe
je 0x140352ace
mov ebx, r13d
cmp r13d, 0x7a04f387
jne 0x1403527f0
mov ebx, dword [rbp - 0x40]
jmp 0x1403527f0
cmp r13d, 0xe6f7101d
je 0x140352ad8
cmp r13d, 0xf5749018
je 0x140352ae2
mov ebx, r13d
cmp r13d, 0xfa8dd48b
jne 0x1403527f0
movsxd rdx, dword [rbp + 0x88]
mov qword [rbp + 0x80], rdx
mov ebx, 0x7a04f387
jmp 0x1403527f0
mov ebx, ecx
cmp r13d, 0x17513885
je 0x1403527f0
cmp r13d, 0x27fd0526
jne 0x140352b5f
cmp byte [rbp + 0x78], 0
mov ebx, 0xf7b1414
mov edx, 0xfa8dd48b
cmovne ebx, edx
jmp 0x1403527f0
cmp r13d, 0x8910c097
je 0x140352a92
mov ebx, r13d
cmp r13d, 0x8911574b
jne 0x1403527f0
mov ebx, dword [rbp - 0x34]
jmp 0x1403527f0
mov edx, dword [rbp + 0x88]
mov ebx, 0x90793b4a
jmp 0x1403527f0
mov edx, dword [rbp + 0x88]
cmp edx, 0x1b
setl byte [rbp + 0x78]
mov ebx, dword [rbp - 0x3c]
jmp 0x1403527f0
mov rdx, qword [rbp + 0x80]
mov ebx, 0x94211ee2
jmp 0x1403527f0
mov ebx, 0xbac644d6
xor r12d, r12d
jmp 0x1403527f0
mov ebx, 0x4aaa782c
jmp 0x1403527f0
mov ebx, 0x17513885
jmp 0x1403527f0
mov ebx, 0x8911574b
jmp 0x1403527f0
mov ebx, 0x564c15c9
jmp 0x1403527f0
mov ebx, 0x3188a2bd
jmp 0x1403527f0
movzx edx, byte [rbp + 0x8f]
mov esi, dword [rbp + 0x88]
mov esi, dword [rbp + 0x88]
mov esi, dword [rbp + 0x88]
mov esi, dword [rbp + 0x88]
mov esi, dword [rbp + 0x88]
movsxd rsi, dword [rbp + 0x88]
imul rdi, rsi, 0x51eb851f
mov rbx, rdi
shr rbx, 0x3f
sar rdi, 0x24
add edi, ebx
imul edi, edi, 0x32
sub esi, edi
mov edi, 0xcb
sub edi, esi
add esi, 0x34
and edi, 0x99
and esi, 0x66
or esi, edi
xor sil, dl
xor sil, 0x99
mov rdx, qword [rbp + 0x80]
mov byte [rbp + rdx + 0x40], sil
mov edx, dword [rbp + 0x88]
mov ebx, 0x5a7f476d
jmp 0x1403527f0
mov ebx, r13d
cmp r13d, 0xf7b1414
jne 0x1403527f0
mov edx, 0x73eefb99
mov r15d, dword [rbp - 0x2c]
mov r12d, dword [rbp - 0x28]
mov r13d, dword [rbp - 0x18]
mov edi, dword [rbp - 0x10]
lea rsi, [rbp + 0x5a]
jmp 0x140352510
cmp byte [rbp + 0x7b], 0
mov edx, 0x2a026c2a
mov ebx, 0x92553eea
cmovne edx, ebx
jmp 0x140352510
mov edx, 0x310e0040
jmp 0x140352510
mov rdx, qword [rbp + 0x70]
mov qword [rbp + 0x68], rdx
mov edx, dword [rbp - 0x1c]
jmp 0x140352510
mov edx, 0x2a026c2a
jmp 0x140352510
test r12b, 1
sete byte [rbp + 0x8f]
cmp r15d, 0xa
setl byte [rbp + 0x7c]
mov ebx, 0x733f9628
jmp 0x140352bf0
mov ebx, 0x280f48ce
nop word cs:[rax + rax]
nop
cmp ebx, 0xceff3fd
jle 0x140352c40
cmp ebx, 0x2fa6d0a5
jle 0x140352c70
cmp ebx, 0x4f3362b2
je 0x140352cc7
cmp ebx, 0x733f9628
jne 0x140352cd8
movzx edx, byte [rbp + 0x8f]
cmp byte [rbp + 0x7c], 0
mov ebx, 0xa57dc66d
cmovne ebx, r11d
test dl, dl
cmovne ebx, r11d
jmp 0x140352bf0
cmp ebx, 0xc5eac9ca
jg 0x140352c90
cmp ebx, 0xa57dc66d
je 0x140352be0
cmp ebx, 0xb735d90e
jne 0x140352bf0
mov rdx, qword [rbp + 0x80]
cmp byte [rdx], 0
setne byte [rbp + 0x88]
mov ebx, r9d
jmp 0x140352bf0
cmp ebx, 0xceff3fe
je 0x140352cac
cmp ebx, 0x280f48ce
jne 0x140352bf0
mov ebx, r14d
jmp 0x140352bf0
cmp ebx, 0xc5eac9cb
je 0x140352cbd
cmp ebx, 0x3e6ae8
jne 0x140352bf0
mov ebx, r10d
jmp 0x140352bf0
mov qword [rbp + 0x80], rsi
mov ebx, 0x3e6ae8
jmp 0x140352bf0
mov ebx, 0xceff3fe
jmp 0x140352bf0
mov rdx, qword [rbp + 0x80]
mov ebx, 0xb735d90e
jmp 0x140352bf0
cmp ebx, 0x2fa6d0a6
jne 0x140352bf0
mov dl, byte [rbp + 0x88]
mov edx, 0xd4da2c14
jmp 0x140352510
mov rdx, qword [rbp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1402c9010
mov rcx, rax
call fcn.1402b3ed0
lea rsi, [rbp + 0x18]
mov qword [rbp + 0x80], rsi
mov ecx, 0xf30c1eb8
lea r14, [rbp - 0x60]
cmp ecx, 0xafff729c
je 0x140352d43
cmp ecx, 0xf30c1eb8
jne 0x140352d20
mov rcx, qword [rbp + 0x80]
call fcn.1402a67c0
mov ecx, 0xafff729c
jmp 0x140352d20
mov qword [rbp + 0x40], rax
mov rdx, qword [rbp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor r15d, r15d
mov rcx, rsi
call fcn.1402a0970
mov edx, dword [0x140ae0bc8]
mov eax, dword [0x140ae0bcc]
lea ecx, [rdx - 1]
imul ecx, edx
test cl, 1
mov edx, 0x7b54ee61
mov edi, 0x71ab2ecb
cmove edi, edx
cmp eax, 0xa
cmovl edi, edx
mov edx, 0xe9750b5d
mov r8d, 0xe333b06c
nop word cs:[rax + rax]
cmp edx, 0xf5bdfd8f
je 0x140352e81
cmp edx, 0xe9750b5d
jne 0x140352da0
mov qword [rbp + 0x40], rsi
mov edx, 0x30c88223
nop dword [rax]
cmp edx, 0x420e84de
je 0x140352e77
cmp edx, 0x30c88223
jne 0x140352dc0
test cl, 1
mov rdx, qword [rbp + 0x40]
sete byte [rbp + 0x68]
cmp eax, 0xa
setl byte [rbp + 0x80]
mov edx, 0x246d3ec1
nop
cmp edx, 0x246d3ec0
jg 0x140352e20
cmp edx, 0x80bdb28a
je 0x140352e54
cmp edx, 0xe333b06c
je 0x140352e5b
cmp edx, 0xef356e00
jne 0x140352df0
jmp 0x140352e6d
cmp edx, 0x7b54ee61
je 0x140352e5f
cmp edx, 0x71ab2ecb
je 0x140352e66
cmp edx, 0x246d3ec1
jne 0x140352df0
movzx ebx, byte [rbp + 0x68]
cmp byte [rbp + 0x80], 0
mov edx, 0x71ab2ecb
cmovne edx, r8d
test bl, bl
cmovne edx, r8d
jmp 0x140352df0
mov edx, 0xef356e00
jmp 0x140352df0
mov edx, edi
jmp 0x140352df0
mov edx, 0x80bdb28a
jmp 0x140352df0
mov edx, 0xe333b06c
jmp 0x140352df0
mov edx, 0x420e84de
jmp 0x140352dc0
mov edx, 0xf5bdfd8f
jmp 0x140352da0
mov rcx, r14
call fcn.1402a0970
mov edx, dword [0x140ae0bc8]
mov eax, dword [0x140ae0bcc]
lea ecx, [rdx - 1]
imul ecx, edx
test cl, 1
mov edx, 0x7b54ee61
mov edi, 0x71ab2ecb
cmove edi, edx
cmp eax, 0xa
cmovl edi, edx
mov edx, 0xe9750b5d
mov r8d, 0xe333b06c
nop dword [rax]
cmp edx, 0xf5bdfd8f
je 0x1403522a4
cmp edx, 0xe9750b5d
jne 0x140352ec0
mov qword [rbp + 0x18], r14
mov edx, 0x30c88223
nop dword [rax]
cmp edx, 0x420e84de
je 0x140352f94
cmp edx, 0x30c88223
jne 0x140352ee0
test cl, 1
mov rdx, qword [rbp + 0x18]
sete byte [rbp - 8]
cmp eax, 0xa
setl byte [rbp + 0x40]
mov edx, 0x246d3ec1
nop dword [rax + rax]
cmp edx, 0x246d3ec0
jg 0x140352f40
cmp edx, 0x80bdb28a
je 0x140352f71
cmp edx, 0xe333b06c
je 0x140352f78
cmp edx, 0xef356e00
jne 0x140352f10
jmp 0x140352f8a
cmp edx, 0x7b54ee61
je 0x140352f7c
cmp edx, 0x71ab2ecb
je 0x140352f83
cmp edx, 0x246d3ec1
jne 0x140352f10
movzx ebx, byte [rbp - 8]
cmp byte [rbp + 0x40], 0
mov edx, 0x71ab2ecb
cmovne edx, r8d
test bl, bl
cmovne edx, r8d
jmp 0x140352f10
mov edx, 0xef356e00
jmp 0x140352f10
mov edx, edi
jmp 0x140352f10
mov edx, 0x80bdb28a
jmp 0x140352f10
mov edx, 0xe333b06c
jmp 0x140352f10
mov edx, 0x420e84de
jmp 0x140352ee0
mov edx, 0xf5bdfd8f
jmp 0x140352ec0
lea rsi, [rbp + 0x18]
mov qword [rbp + 0x80], rsi
mov ecx, 0xf30c1eb8
lea r14, [rbp - 0x60]
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0xafff729c
je 0x140352fe3
cmp ecx, 0xf30c1eb8
jne 0x140352fc0
mov rcx, qword [rbp + 0x80]
call fcn.1402a67c0
mov ecx, 0xafff729c
jmp 0x140352fc0
mov qword [rbp + 0x40], rax
mov rdx, qword [rbp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
sete r15b
jmp 0x140352d5b