Function at 0x1400804cf
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [0x1403a8327]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14008075c
mov r15, rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x10]
call fcn.14001af56
mov qword [rbp + 0x18], rax
mov ecx, 0xd4f04be9
cmp ecx, 0x33792d70
je 0x14008054b
cmp ecx, 0xd4f04be9
jne 0x140080528
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x10]
add rax, qword [rcx + 0x10]
mov ecx, 0x33792d70
jmp 0x140080528
mov qword [rbp - 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rbp - 8]
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
mov qword [rbp - 0x28], rcx
mov eax, dword [0x1403fd750]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1403fd754], 0xa
setl cl
or cl, al
mov eax, 0xf8aa3a80
mov edx, 0xcbe44420
cmove eax, edx
mov ecx, 0x2ac2abcc
cmove ecx, edx
mov edx, 0xcc8a1660
cmp edx, 0xcc8a165f
jle 0x1400805c2
cmp edx, 0xcc8a1660
je 0x1400805dd
cmp edx, 0xf8aa3a80
je 0x1400805e1
cmp edx, 0x2ac2abcc
jne 0x14008059a
mov rdx, qword [rbp - 0x28]
mov edx, eax
jmp 0x14008059a
cmp edx, 0x82ea556a
je 0x1400805e8
cmp edx, 0xcbe44420
jne 0x14008059a
mov rdx, qword [rbp - 0x28]
mov edx, 0x2ac2abcc
jmp 0x14008059a
mov edx, ecx
jmp 0x14008059a
mov edx, 0x82ea556a
jmp 0x14008059a
lea rdi, [rbp - 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.14007fd98
mov rdx, qword [rdi]
mov r8, qword [rbp - 0x30]
lea rsi, [rbp - 0x58]
lea r9, [rbp - 0x28]
mov rcx, rsi
call fcn.14007ffa0
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rdi, [rbp - 0x28]
mov rcx, rdi
mov r8, rsi
call fcn.140062557
lea rcx, [rbp - 0x58]
mov rdx, rdi
call fcn.1400801a8
mov eax, 0xf9955b72
mov r14d, 0x9609b047
mov esi, 0x8fb3a74c
cmp eax, 0xa7ecfb1f
jle 0x14008066f
cmp eax, 0xa7ecfb20
je 0x14008067f
cmp eax, 0x2dc2ae60
je 0x1400806a2
cmp eax, 0xf9955b72
jne 0x140080640
mov rcx, rdi
call fcn.14003aa0c
mov qword [rbp - 8], rdi
mov eax, 0xa7ecfb20
jmp 0x140080640
cmp eax, 0x8fb3a74c
je 0x1400806b2
cmp eax, 0x9609b047
jne 0x140080640
jmp 0x1400806e3
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, esi
cmp dword [0x1403fb540], 0xa
cmovl eax, esi
jmp 0x140080640
mov rcx, qword [rbp - 8]
call fcn.14003c8f8
mov eax, 0x8fb3a74c
jmp 0x140080640
mov rcx, qword [rbp - 8]
call fcn.14003c8f8
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, r14d
cmp dword [0x1403fb540], 0xa
cmovl eax, r14d
jmp 0x140080640
lea r14, [rbp - 0x58]
mov rcx, r14
call fcn.140080338
lea rcx, [rbp - 8]
mov rdx, rax
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rdi, [rbp - 0x28]
mov rcx, rdi
mov r8, rbx
call fcn.14007f8c8
mov eax, 0x7990630f
cmp eax, 0x7990630f
je 0x140080726
cmp eax, 0x5a869933
jne 0x140080716
jmp 0x14008072d
mov eax, 0x5a869933
jmp 0x140080716
mov qword [rbp + 0x18], rdi
mov rcx, qword [rbp + 0x18]
call fcn.14001af56
lea r8, [rbp + 8]
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x140080770
mov sil, 1
cmp eax, 2
je 0x1400807d3
jmp 0x1400807d1
xor esi, esi
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 8]
call rax
test eax, eax
je 0x14008088f
mov eax, 0x7990630f
cmp eax, 0x7990630f
je 0x1400807ad
cmp eax, 0x5a869933
jne 0x14008079d
jmp 0x1400807b4
mov eax, 0x5a869933
jmp 0x14008079d
mov qword [rbp + 0x18], rdi
mov rcx, qword [rbp + 0x18]
call fcn.14001af56
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
xor esi, esi
lea rcx, [rbp - 0x28]
call fcn.140037744
mov eax, 0xf9955b72
mov edi, 0x9609b047
mov ebx, 0x8fb3a74c
cmp eax, 0xa7ecfb1f
jle 0x14008081a
cmp eax, 0xa7ecfb20
je 0x14008082d
cmp eax, 0x2dc2ae60
je 0x140080850
cmp eax, 0xf9955b72
jne 0x1400807eb
mov rcx, r14
call fcn.14003aa0c
mov qword [rbp - 0x28], r14
mov eax, 0xa7ecfb20
jmp 0x1400807eb
cmp eax, 0x8fb3a74c
je 0x140080860
cmp eax, 0x9609b047
jne 0x1400807eb
jmp 0x14008075e
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, ebx
cmp dword [0x1403fb540], 0xa
cmovl eax, ebx
jmp 0x1400807eb
mov rcx, qword [rbp - 0x28]
call fcn.14003c8f8
mov eax, 0x8fb3a74c
jmp 0x1400807eb
mov rcx, qword [rbp - 0x28]
call fcn.14003c8f8
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, edi
cmp dword [0x1403fb540], 0xa
cmovl eax, edi
jmp 0x1400807eb
mov eax, 0x7990630f
cmp eax, 0x7990630f
je 0x1400808a4
cmp eax, 0x5a869933
jne 0x140080894
jmp 0x1400808ab
mov eax, 0x5a869933
jmp 0x140080894
mov qword [rbp + 0x18], rdi
mov rcx, qword [rbp + 0x18]
call fcn.14001af56
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
test eax, eax
sete sil
jmp 0x1400807d3