Function at 0x14001ef50
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x140072100]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
movabs rax, 0x9b9f7eeaff11a819
mov qword [rsp + 0x30], rax
movabs rax, 0x8822a479009e9467
mov qword [rsp + 0x38], rax
movabs rax, 0x597adf5a5b72ee82
mov qword [rsp + 0x40], rax
movabs rax, 0x8633a8baa54b1e94
mov qword [rsp + 0x48], rax
movabs rax, 0xe17eb8b5dd36d66a
mov qword [rsp + 0x50], rax
movabs rax, 0xbd6e75cb651d5a67
mov qword [rsp + 0x58], rax
movabs rax, 0x40953b6d81dfe9c8
mov qword [rsp + 0x60], rax
movabs rcx, 0x511b19ecd46f404c
mov qword [rsp + 0x68], rcx
movabs r12, 0xe9eb0d839874fa45
mov qword [rsp + 0x110], r12
movabs r14, 0xe64bcc1a61d3c81e
mov qword [rsp + 0x118], r14
movabs rax, 0x341fab292221b2e7
mov qword [rsp + 0x120], rax
movabs rax, 0xf25dcdc8d73e5dc8
mov qword [rsp + 0x128], rax
movabs rax, 0xb212d7c7a958b929
mov qword [rsp + 0x130], rax
movabs rax, 0xd41807ae36412e02
mov qword [rsp + 0x138], rax
movabs rax, 0x40953b6dddac8cab
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14001f0f7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.1400182b0
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14001f120
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x110]
call fcn.140017f70
movabs r15, 0x8d8a62eff6218e0b
mov qword [rsp + 0x80], r15
movabs rax, 0xe64bbe7f17baba5a
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x858f23eff4108e2b
mov qword [rsp + 0xe0], rax
movabs rax, 0xe64bcc1a61d3c872
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], r14
movdqa xmm0, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14001fa1a
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xd0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0xc671be7f17baba5a
mov qword [rsp + 0x38], rax
movabs rax, 0x341fab292221b2e7
mov qword [rsp + 0x40], rax
movabs rcx, 0xf25dcdc8d73e5dc8
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xe0], r12
movabs r15, 0xe64bcc1a61d3c81e
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140073670]
call fcn.140018000
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0x80]
call fcn.14001ce40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14001f302
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.14002e9c0
mov rcx, rax
call fcn.14002b910
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x14001f359
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f354
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fa8c
call fcn.1400315ac
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140075684], eax
jle 0x14001f4cb
lea rcx, [0x140075684]
call fcn.140031688
cmp dword [0x140075684], 0xffffffff
jne 0x14001f4cb
movabs rax, 0xaab760e6ec078316
mov qword [rsp + 0x30], rax
movabs rax, 0x8908b87404a1ba6b
mov qword [rsp + 0x38], rax
movabs rax, 0x407af8454d53c689
mov qword [rsp + 0x40], rax
movabs rax, 0x973ea4bea55b0e94
mov qword [rsp + 0x48], rax
movabs rax, 0xb212d7c7a958e55a
mov qword [rsp + 0x50], rax
movabs rax, 0xd41807ae36412e02
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
movabs r14, 0x341fab292221b2e7
mov qword [rsp + 0xf0], r14
movabs rcx, 0xf25dcdc8d73e5dc8
mov qword [rsp + 0xf8], rcx
movabs rcx, 0xb212d7c7a958b929
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140075608], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140075618], xmm1
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001f490
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x140075608]
mov rcx, rbx
call fcn.1400182b0
lea rcx, [0x1400576b0]
call fcn.140031928
nop
lea rcx, [0x140075684]
call fcn.14003161c
jmp 0x14001f4dc
lea rbx, [0x140075608]
movabs r14, 0x341fab292221b2e7
cmp qword [0x140075620], 0xf
cmova rbx, qword [0x140075608]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14001f511
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14001f539
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14001f539
mov bl, 1
jmp 0x14001f53b
xor bl, bl
movabs rax, 0xc98e6eeaee069f36
mov qword [rsp + 0x30], rax
movabs rax, 0x9f39b86908b4ad6c
mov qword [rsp + 0x38], rax
movabs rax, 0xe6cde5d4355c1c7
mov qword [rsp + 0x40], rax
movabs rax, 0xf25dcdc8d73e5de8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], r14
movabs rax, 0xf25dcdc8d73e5dc8
mov qword [rsp + 0xf8], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140073670]
call fcn.140018000
movzx edx, bl
mov rcx, rax
call fcn.140028690
mov rcx, rax
call fcn.14002b910
lea rcx, [rsp + 0xe0]
call fcn.140019cc0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140019170
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14001f617
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.140017f70
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001f6a0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f69b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fa92
call fcn.1400315ac
movdqa xmm0, xmmword [0x140069d90]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x14001f6fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f6f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fa98
call fcn.1400315ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.14002f85c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov r14d, 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 9
test rdi, rdi
je 0x14001f7d1
cmp rdi, 0x7fffffff
ja 0x14001fa9e
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.14002f884
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14001faa4
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.140028a30
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], r14
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.14002f884
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14001fab0
lea rcx, [rsp + 0x30]
call fcn.140019bb0
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14001f820
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f81b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001faba
call fcn.1400315ac
test bl, bl
je 0x14001f96d
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.14002f85c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 0x47
test rdi, rdi
je 0x14001f8fe
cmp rdi, 0x7fffffff
ja 0x14001fac0
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.14002f884
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14001fac5
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.140028a30
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.14002f884
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14001fad0
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp r14, 7
cmova rcx, qword [rsp + 0x30]
call fcn.14002ff18
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14001fada
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14001f964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f95e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fae9
call fcn.1400315ac
nop
jmp 0x14001f96d
test r13d, r13d
setne bl
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x14001f9b6
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f9b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001faef
call fcn.1400315ac
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x14001fa15
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fa10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001faf5
call fcn.1400315ac
movzx eax, bl
jmp 0x14001fa5f
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x14001fa5d
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fa58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fafb
call fcn.1400315ac
xor al, al
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140031550
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400374b4
nop
call fcn.1400374b4
nop
call fcn.1400374b4
nop
call fcn.1400189e0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140018bf0
int3
shr rcx, 0x20
call fcn.140018bf0
nop
call fcn.1400374b4
nop
call fcn.1400189e0
shr rbx, 0x20
mov ecx, ebx
call fcn.140018bf0
shr rcx, 0x20
call fcn.140018bf0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.140019970
nop
call fcn.1400374b4
nop
call fcn.1400374b4
nop
call fcn.1400374b4
int3
call fcn.1400374b4
int3