Function at 0x140001000
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x14000c038]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov eax, 0x44
mov word [rsp + 0xc8], ax
mov eax, 0x69
mov word [rsp + 0xca], ax
mov eax, 0x73
mov word [rsp + 0xcc], ax
mov eax, 0x70
mov word [rsp + 0xce], ax
mov eax, 0x6c
mov word [rsp + 0xd0], ax
mov eax, 0x61
mov word [rsp + 0xd2], ax
mov eax, 0x79
mov word [rsp + 0xd4], ax
mov eax, 0x4e
mov word [rsp + 0xd6], ax
mov eax, 0x61
mov word [rsp + 0xd8], ax
mov eax, 0x6d
mov word [rsp + 0xda], ax
mov eax, 0x65
mov word [rsp + 0xdc], ax
xor eax, eax
mov word [rsp + 0xde], ax
xor eax, eax
mov word [rsp + 0xe0], ax
mov eax, 0x45
mov word [rsp + 0xe8], ax
mov eax, 0x72
mov word [rsp + 0xea], ax
mov eax, 0x72
mov word [rsp + 0xec], ax
mov eax, 0x6f
mov word [rsp + 0xee], ax
mov eax, 0x72
mov word [rsp + 0xf0], ax
mov eax, 0x43
mov word [rsp + 0xf2], ax
mov eax, 0x6f
mov word [rsp + 0xf4], ax
mov eax, 0x6e
mov word [rsp + 0xf6], ax
mov eax, 0x74
mov word [rsp + 0xf8], ax
mov eax, 0x72
mov word [rsp + 0xfa], ax
mov eax, 0x6f
mov word [rsp + 0xfc], ax
mov eax, 0x6c
mov word [rsp + 0xfe], ax
xor eax, eax
mov word [rsp + 0x100], ax
xor eax, eax
mov word [rsp + 0x102], ax
mov eax, 0x49
mov word [rsp + 0xb0], ax
mov eax, 0x6d
mov word [rsp + 0xb2], ax
mov eax, 0x61
mov word [rsp + 0xb4], ax
mov eax, 0x67
mov word [rsp + 0xb6], ax
mov eax, 0x65
mov word [rsp + 0xb8], ax
mov eax, 0x50
mov word [rsp + 0xba], ax
mov eax, 0x61
mov word [rsp + 0xbc], ax
mov eax, 0x74
mov word [rsp + 0xbe], ax
mov eax, 0x68
mov word [rsp + 0xc0], ax
xor eax, eax
mov word [rsp + 0xc2], ax
xor eax, eax
mov word [rsp + 0xc4], ax
mov eax, 0x53
mov word [rsp + 0x90], ax
mov eax, 0x74
mov word [rsp + 0x92], ax
mov eax, 0x61
mov word [rsp + 0x94], ax
mov eax, 0x72
mov word [rsp + 0x96], ax
mov eax, 0x74
mov word [rsp + 0x98], ax
xor eax, eax
mov word [rsp + 0x9a], ax
xor eax, eax
mov word [rsp + 0x9c], ax
mov eax, 0x54
mov word [rsp + 0x80], ax
mov eax, 0x79
mov word [rsp + 0x82], ax
mov eax, 0x70
mov word [rsp + 0x84], ax
mov eax, 0x65
mov word [rsp + 0x86], ax
xor eax, eax
mov word [rsp + 0x88], ax
xor eax, eax
mov word [rsp + 0x8a], ax
mov eax, 0x57
mov word [rsp + 0xa0], ax
mov eax, 0x4f
mov word [rsp + 0xa2], ax
mov eax, 0x57
mov word [rsp + 0xa4], ax
mov eax, 0x36
mov word [rsp + 0xa6], ax
mov eax, 0x34
mov word [rsp + 0xa8], ax
xor eax, eax
mov word [rsp + 0xaa], ax
xor eax, eax
mov word [rsp + 0xac], ax
lea r8, [rsp + 0xc8]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [rsp + 0xe8]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [rsp + 0xb0]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [rsp + 0x90]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [rsp + 0x80]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [rsp + 0xa0]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov edx, 0x100
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x30], rax
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140003880
mov rax, qword [rsp + 0x120]
movzx eax, word [rax]
mov r8d, eax
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x30]
call fcn.1400035c0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 0x100
mov word [rsp + 0x42], ax
lea rdx, [0x140003970]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea r8, [0x14000c000]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, str.Count
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, str.NextInstance
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x40
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140003490
add rsp, 0x110
pop rdi
ret