Function at 0x14020b3f1
Capabilities:
Delete registry key

Disassembly:
jmp 0x1402f3120
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x428]
mov rax, qword [0x140961e80]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
mov dword [rbp + 4], 0xc0000001
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x68]
call sym.SystemInformer.exe_PhGetBaseName
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x88], rax
movzx eax, byte [rbp + 0x3e0]
test eax, eax
je 0x1402f33e0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
lea r9, [0x14095a070]
mov r8, 0xfffffffffffffffd
mov edx, 0x20006
lea rcx, [rbp + 0x28]
call sym.SystemInformer.exe_PhCreateKey
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1402f31ee
jmp 0x1402f353c
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
mov r9, rax
mov r8, qword [rbp + 0x28]
mov edx, 0x20006
lea rcx, [rbp + 0x48]
call sym.SystemInformer.exe_PhCreateKey
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1402f3231
jmp 0x1402f353c
mov dword [rbp + 0xa4], 4
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0xa4]
mov r8d, 4
lea rdx, [0x14095a080]
mov rcx, qword [rbp + 0x48]
call sym.SystemInformer.exe_PhSetValueKey
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1402f326e
jmp 0x1402f353c
cmp dword [rbp + 4], 0
jl 0x1402f33db
lea rcx, [0x14095a000]
call fcn.14020c73d
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call sym.SystemInformer.exe_PhGetBaseDirectory
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0xe8], rax
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x108], rax
mov rcx, qword [rbp + 0x108]
call sym.SystemInformer.exe_PhGetBaseName
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x148], 2
lea rax, [0x14064db00]
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0xe8]
mov r8, rax
lea rdx, [rbp + 0x148]
call sym.SystemInformer.exe_PhConcatStringRef3
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
mov r9, rax
mov r8, 0xfffffffffffffffd
mov edx, 0x20006
lea rcx, [rbp + 0xc8]
call sym.SystemInformer.exe_PhCreateKey
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x1402f33db
lea rdx, str.GlobalFlag
mov rcx, qword [rbp + 0xc8]
call fcn.14020abb8
mov dword [rbp + 0x174], eax
cmp dword [rbp + 0x174], 0xffffffff
jne 0x1402f3392
mov dword [rbp + 0x174], 0
mov eax, dword [rbp + 0x174]
bts eax, 9
mov dword [rbp + 0x174], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x174]
mov r8d, 4
lea rdx, [0x14095a090]
mov rcx, qword [rbp + 0xc8]
call sym.SystemInformer.exe_PhSetValueKey
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x1402f353c
mov dword [rsp + 0x20], 0
lea r9, [0x14095a070]
mov r8, 0xfffffffffffffffd
mov edx, 0x10000
lea rcx, [rbp + 0x28]
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
jl 0x1402f343b
mov rax, qword [rbp + 0x88]
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
mov edx, 0x10000
lea rcx, [rbp + 0x48]
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
jl 0x1402f343b
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop
lea rcx, [0x14095a000]
call fcn.14020c73d
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x1b8], rax
mov rcx, qword [rbp + 0x1b8]
call sym.SystemInformer.exe_PhGetBaseDirectory
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x1b8], rax
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x1d8], rax
mov rcx, qword [rbp + 0x1d8]
call sym.SystemInformer.exe_PhGetBaseName
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x218], 2
lea rax, [0x14064db00]
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1b8]
mov r8, rax
lea rdx, [rbp + 0x218]
call sym.SystemInformer.exe_PhConcatStringRef3
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, 0xfffffffffffffffd
mov edx, 0x20006
lea rcx, [rbp + 0x198]
call sym.SystemInformer.exe_PhOpenKey
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x1402f353c
lea rdx, [0x14095a090]
mov rcx, qword [rbp + 0x198]
call sym.SystemInformer.exe_PhDeleteValueKey
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ntdll.dll_NtClose]
nop
cmp qword [rbp + 0x28], 0
je 0x1402f354e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
nop
cmp qword [rbp + 0x48], 0
je 0x1402f3560
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140754b00]
call fcn.1402124fd
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.14020ee98
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret