Function at 0x140020f50
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x140074100]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
movabs rax, 0xc4eba62100ff823f
mov qword [rsp + 0x30], rax
movabs rax, 0xce1c9ad22293b915
mov qword [rsp + 0x38], rax
movabs rax, 0xdec010b1b23c6b30
mov qword [rsp + 0x40], rax
movabs rax, 0x62034491616a8ada
mov qword [rsp + 0x48], rax
movabs rax, 0x89aa44769c86d364
mov qword [rsp + 0x50], rax
movabs rax, 0x66fc43f891b08765
mov qword [rsp + 0x58], rax
movabs rax, 0x3be56a2e3e37ddda
mov qword [rsp + 0x60], rax
movabs rcx, 0xc996b5af0ea3e56a
mov qword [rsp + 0x68], rcx
movabs r12, 0xb69fd548679ad063
mov qword [rsp + 0x110], r12
movabs r14, 0xa075f2b143dee56c
mov qword [rsp + 0x118], r14
movabs rax, 0xb3a564c2cb6f3755
mov qword [rsp + 0x120], rax
movabs rax, 0x166d21e3131fc986
mov qword [rsp + 0x128], rax
movabs rax, 0xdac62b04e8e8bc27
mov qword [rsp + 0x130], rax
movabs rax, 0xf8a319dc2ecf300
mov qword [rsp + 0x138], rax
movabs rax, 0x3be56a2e6244b8b9
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x1400210f7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.14001a2b0
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140021120
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x110]
call fcn.140019f70
movabs r15, 0xd2feba2409cfa42d
mov qword [rsp + 0x80], r15
movabs rax, 0xa07580d435b79728
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0xdafbfb240bfea40d
mov qword [rsp + 0xe0], rax
movabs rax, 0xa075f2b143dee500
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], r14
movdqa xmm0, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140021a1a
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xd0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0x804f80d435b79728
mov qword [rsp + 0x38], rax
movabs rax, 0xb3a564c2cb6f3755
mov qword [rsp + 0x40], rax
movabs rcx, 0x166d21e3131fc986
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xe0], r12
movabs r15, 0xa075f2b143dee56c
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140075670]
call fcn.14001a000
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0x80]
call fcn.14001ee40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140021302
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.140030a40
mov rcx, rax
call fcn.14002d990
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x140021359
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021354
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021a8c
call fcn.14003362c
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140077684], eax
jle 0x1400214cb
lea rcx, [0x140077684]
call fcn.140033708
cmp dword [0x140077684], 0xffffffff
jne 0x1400214cb
movabs rax, 0xf5c3b82d13e9a930
mov qword [rsp + 0x30], rax
movabs rax, 0xcf3686df26ac9719
mov qword [rsp + 0x38], rax
movabs rax, 0xc7c037aea41d433b
mov qword [rsp + 0x40], rax
movabs rax, 0x730e4895617a9ada
mov qword [rsp + 0x48], rax
movabs rax, 0xdac62b04e8e8e054
mov qword [rsp + 0x50], rax
movabs rax, 0xf8a319dc2ecf300
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
movabs r14, 0xb3a564c2cb6f3755
mov qword [rsp + 0xf0], r14
movabs rcx, 0x166d21e3131fc986
mov qword [rsp + 0xf8], rcx
movabs rcx, 0xdac62b04e8e8bc27
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140077608], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140077618], xmm1
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140021490
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x140077608]
mov rcx, rbx
call fcn.14001a2b0
lea rcx, [0x140059730]
call fcn.1400339a8
nop
lea rcx, [0x140077684]
call fcn.14003369c
jmp 0x1400214dc
lea rbx, [0x140077608]
movabs r14, 0xb3a564c2cb6f3755
cmp qword [0x140077620], 0xf
cmova rbx, qword [0x140077608]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140021511
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x140021539
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140021539
mov bl, 1
jmp 0x14002153b
xor bl, bl
movabs rax, 0x96fab62111e8b510
mov qword [rsp + 0x30], rax
movabs rax, 0xd90786c22ab9801e
mov qword [rsp + 0x38], rax
movabs rax, 0x89d611b6aa1b4475
mov qword [rsp + 0x40], rax
movabs rax, 0x166d21e3131fc9a6
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], r14
movabs rax, 0x166d21e3131fc986
mov qword [rsp + 0xf8], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140075670]
call fcn.14001a000
movzx edx, bl
mov rcx, rax
call fcn.14002a710
mov rcx, rax
call fcn.14002d990
lea rcx, [rsp + 0xe0]
call fcn.14001bcc0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001b170
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x140021617
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.140019f70
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400216a0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002169b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021a92
call fcn.14003362c
movdqa xmm0, xmmword [0x14006bd90]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x1400216fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400216f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021a98
call fcn.14003362c
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.1400318dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov r14d, 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 9
test rdi, rdi
je 0x1400217d1
cmp rdi, 0x7fffffff
ja 0x140021a9e
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140031904
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140021aa4
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002aab0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], r14
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140031904
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140021ab0
lea rcx, [rsp + 0x30]
call fcn.14001bbb0
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140021820
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002181b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021aba
call fcn.14003362c
test bl, bl
je 0x14002196d
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.1400318dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 0x47
test rdi, rdi
je 0x1400218fe
cmp rdi, 0x7fffffff
ja 0x140021ac0
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140031904
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140021ac5
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002aab0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140031904
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140021ad0
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp r14, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140031f98
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140021ada
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140021964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002195e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021ae9
call fcn.14003362c
nop
jmp 0x14002196d
test r13d, r13d
setne bl
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400219b6
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400219b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021aef
call fcn.14003362c
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140021a15
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021a10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021af5
call fcn.14003362c
movzx eax, bl
jmp 0x140021a5f
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140021a5d
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021a58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021afb
call fcn.14003362c
xor al, al
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400335d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140039534
nop
call fcn.140039534
nop
call fcn.140039534
nop
call fcn.14001a9e0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14001abf0
int3
shr rcx, 0x20
call fcn.14001abf0
nop
call fcn.140039534
nop
call fcn.14001a9e0
shr rbx, 0x20
mov ecx, ebx
call fcn.14001abf0
shr rcx, 0x20
call fcn.14001abf0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001b970
nop
call fcn.140039534
nop
call fcn.140039534
nop
call fcn.140039534
int3
call fcn.140039534
int3