Function at 0x1801ddc54
Capabilities:
Delete registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
movaps xmmword [rsp + 0xf0], xmm6
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov r14d, ecx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0xe8], rax
test rdx, rdx
je 0x1801ddcda
mov edx, 0x100
mov rcx, rbx
call fcn.180206c00
cmp rax, 0x100
jne 0x1801ddcda
xor ebx, ebx
and bl, 1
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [0x1803d3468], 0
jne 0x1801ddcec
call fcn.18016b198
test al, al
je 0x1801ddca7
xor ebp, ebp
cmp byte [0x1803d3469], 1
adc ebp, 1
test r14d, r14d
cmovne ebp, r14d
xorps xmm6, xmm6
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
test rbx, rbx
je 0x1801ddd42
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, rbx
call fcn.18014475a
mov rcx, r14
call fcn.18016b343
mov ecx, ebp
mov edx, edi
mov r8, r14
call fcn.18016b470
movaps xmmword [rsp + 0x80], xmm6
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x48]
mov edx, ebp
call fcn.18016b664
cmp byte [rsp + 0x97], 0
js 0x1801ddd88
mov word [rsp + 0x80], 0
mov byte [rsp + 0x97], 0
jmp 0x1801ddda1
mov rax, qword [rsp + 0x80]
mov word [rax], 0
mov qword [rsp + 0x88], 0
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
jmp 0x1801dddb9
add rbx, 0xffffffffffffffe8
mov rcx, rbx
call fcn.1800d3741
cmp rbx, r14
jne 0x1801dddad
mov qword [rsp + 0x68], r14
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
movzx eax, word [0x1803d3470]
or ax, word [0x1803d3670]
je 0x1801dde1b
movzx r9d, byte [rsp + 0x5f]
test r9b, r9b
js 0x1801dddfb
and r9d, 0x7f
jmp 0x1801dde00
mov r9, qword [rsp + 0x50]
dec r9
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x48]
mov r8d, 1
call fcn.1802c641e
lea rdx, [rsp + 0xa0]
movzx eax, byte [rdx + 0x17]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rbx, [rsp + 0xd0]
mov rcx, rbx
call fcn.1800fa7f6
mov qword [rsp + 0xc8], 0
movzx eax, byte [rbx + 0x17]
test al, al
js 0x1801dde7e
and eax, 0x7f
jmp 0x1801dde8e
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xd0]
lea r8, [rsp + 0xc8]
call fcn.1802c7b6e
jmp 0x1801ddeb9
mov rax, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
test rax, rax
je 0x1801ddeb9
xor ecx, ecx
xor ebp, ebp
cmp word [rbx + rcx*2], 0x5c
je 0x1801ddfcf
add rbp, 0xfffffffffffffffe
inc rcx
cmp rax, rcx
jne 0x1801dde97
mov r13d, 1
test r13, r13
jne 0x1801dde62
movzx eax, word [0x1803d3470]
or ax, word [0x1803d3670]
je 0x1801ddf3d
mov qword [rsp + 0x20], 0xe
lea r9, str.REGISTRYUSER_
xor ebx, ebx
lea rcx, [rsp + 0xd0]
mov r8d, 0xe
xor edx, edx
call fcn.18016ab10
cmp eax, 1
mov r14d, 0
adc r14, 2
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0x60]
sar rax, 3
movabs r15, 0xaaaaaaaaaaaaaaab
imul rax, r15
cmp rax, r14
jb 0x1801ddf51
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov dx, 0x5c
call fcn.1800fad70
xor r12d, r12d
xor r13d, r13d
jmp 0x1801de0d7
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x48]
call fcn.1800d2c38
mov bl, 1
cmp byte [rsp + 0xe7], 0
jns 0x1801ddf68
mov rcx, qword [rsp + 0xd0]
call fcn.1801e4f44
cmp byte [rsp + 0x5f], 0
jns 0x1801ddf79
mov rcx, qword [rsp + 0x48]
call fcn.1801e4f44
test bl, bl
jne 0x1801de12d
xor ebx, ebx
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
call fcn.1800d36ac
cmp byte [rsp + 0x97], 0
jns 0x1801ddfaf
mov rcx, qword [rsp + 0x80]
call fcn.1801e4f44
cmp byte [rsp + 0xb7], 0
jns 0x1801ddca9
mov rcx, qword [rsp + 0xa0]
call fcn.1801e4f44
jmp 0x1801ddca9
mov r13d, 1
cmp rbx, rbp
je 0x1801ddeb4
cmp rbp, 2
je 0x1801ddeb4
neg rbp
xor eax, eax
lea rbx, [rsp + 0x60]
lea r14, [rsp + 0xd0]
lea r15, [rsp + 0xc8]
lea r12, [rsp + 0xc0]
sar rbp, 1
mov rcx, rbp
sub rcx, rax
mov qword [rsp + 0xc0], rcx
mov rcx, rbx
mov rdx, r14
mov r8, r15
mov r9, r12
call fcn.1802c7b30
lea rax, [rbp + 1]
mov qword [rsp + 0xc8], rax
movzx edx, byte [rsp + 0xe7]
test dl, dl
jns 0x1801de056
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xd0]
jmp 0x1801de05c
and edx, 0x7f
mov rcx, r14
cmp rdx, rax
jbe 0x1801de0a8
je 0x1801dde62
lea r8, [rbp*2 + 2]
sub rbp, rdx
inc rbp
mov rdx, rbp
mov rbp, r8
cmp word [rcx + rbp], 0x5c
je 0x1801de090
add rbp, 2
inc rdx
jne 0x1801de07b
jmp 0x1801ddeb4
add rcx, rbp
je 0x1801ddeb4
cmp rbp, 0xfffffffffffffffe
jne 0x1801de00a
jmp 0x1801ddeb4
mov r13, rdx
jmp 0x1801ddeb4
add rdx, r12
and r8d, 0x7f
mov rcx, rbx
call fcn.1800fa7f6
mov rcx, rbx
mov dx, 0x5c
call fcn.1800fad70
inc r13
add r12, 0x18
cmp r14, r13
je 0x1801de10b
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
sub rax, rdx
sar rax, 3
imul rax, r15
cmp rax, r13
jbe 0x1801de380
movzx r8d, byte [rdx + r12 + 0x17]
test r8b, r8b
jns 0x1801de0b0
mov r8, qword [rdx + r12 + 8]
mov rdx, qword [rdx + r12]
jmp 0x1801de0b7
lea rcx, [rsp + 0x60]
mov r8, qword [rcx]
lea rax, [r14 + r14*2]
lea r9, [r8 + rax*8]
lea rdx, [rsp + 0xc0]
call fcn.18016bc8a
jmp 0x1801ddf4f
lea r8, [rsp + 0xc8]
mov qword [r8], 0xffffffffffffffff
xor ebx, ebx
lea r14, [rsp + 0x80]
mov rcx, r14
mov edx, edi
xor r9d, r9d
call fcn.1802c77a9
test eax, eax
js 0x1801ddf83
mov rbp, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
sub rbp, rax
je 0x1801de1c5
sar rbp, 3
movabs rax, 0xaaaaaaaaaaaaaaab
imul rbp, rax
mov rcx, qword [rsp + 0xc8]
call sub.ntdll.dll_NtClose
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
cmp rbp, 1
mov rax, rbp
adc rax, 0
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
lea rax, [rsp + 0xd0]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
xor r13d, r13d
xor ebx, ebx
xor r12d, r12d
jmp 0x1801de25b
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov bl, 1
mov rdi, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
jmp 0x1801de1fc
mov rcx, qword [rdi]
call sub.ntdll.dll_NtClose
add rdi, 8
cmp rdi, r14
jne 0x1801de1f0
test bl, 1
je 0x1801de216
mov rcx, qword [rsp + 0xc8]
test rsi, rsi
je 0x1801de230
mov qword [rsi], rcx
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
call fcn.1800d9692
jmp 0x1801ddf83
call sub.ntdll.dll_NtClose
jmp 0x1801de216
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
inc r12
cmp r12, rbp
setae bl
add r13, 0x18
cmp qword [rsp + 0x30], r12
je 0x1801de1de
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
sub rax, rdx
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
cmp rax, r12
jbe 0x1801de380
movzx r8d, byte [rdx + r13 + 0x17]
test r8b, r8b
js 0x1801de297
add rdx, r13
and r8d, 0x7f
jmp 0x1801de2a0
mov r8, qword [rdx + r13 + 8]
mov rdx, qword [rdx + r13]
mov rcx, r14
call fcn.1800fa7f6
mov rcx, r14
mov dx, 0x5c
call fcn.1800fad70
mov dword [rsp + 0x44], 0
mov qword [rsp + 0xc0], 0xffffffffffffffff
cmp byte [rsp + 0x97], 0
mov rdx, r14
jns 0x1801de2dd
mov rdx, qword [rsp + 0x80]
lea r15, [rsp + 0x48]
mov rcx, r15
call fcn.1801447b6
mov rcx, r15
mov edx, edi
lea r8, [rsp + 0xc0]
lea r9, [rsp + 0x44]
call fcn.1802c77a9
mov r15d, eax
cmp byte [rsp + 0x5f], 0
jns 0x1801de315
mov rcx, qword [rsp + 0x48]
call fcn.1801e4f44
test r15d, r15d
js 0x1801de358
cmp qword [rsp + 0x38], r12
je 0x1801de237
cmp dword [rsp + 0x44], 1
je 0x1801de33e
mov rcx, qword [rsp + 0xc0]
call sub.ntdll.dll_NtClose
jmp 0x1801de247
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xc0]
call fcn.180287c48
jmp 0x1801de247
mov rdi, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
jmp 0x1801de376
mov rcx, qword [rdi]
call sub.ntdll.dll_NtDeleteKey
add rdi, 8
cmp rdi, r14
jne 0x1801de36a
jmp 0x1801de1de
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, [0x18034f130]
lea r9, str.__n___size__
mov r8d, 0x601
call fcn.18027be54
int3