Function at 0x14009b300
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
lea rcx, [0x140124297]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14009b3a7
mov rsi, rax
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.14009ad40
mov rcx, rbx
call fcn.1400819e0
lea rcx, [rbp - 0x38]
mov rdx, rax
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x28]
mov r8, rdi
call fcn.14009ad40
lea rcx, [rbp - 0x28]
call fcn.1400819e0
mov r8, rbp
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14009b3ae
mov sil, 1
cmp eax, 2
je 0x14009b90d
xor esi, esi
jmp 0x14009b90d
xor esi, esi
jmp 0x14009b91f
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x38]
call rax
mov r14d, eax
lea rcx, [0x140149ab0]
lea rdx, str.___NtUnloadDriver_Status_0x
call fcn.14001a4b0
mov ecx, dword [0x140144914]
mov edx, dword [0x140144918]
lea ebx, [rcx - 1]
imul ebx, ecx
test bl, 1
sete byte [rbp + 0x2f]
cmp edx, 0xa
setl byte [rbp + 0x2e]
mov ecx, 0x9497618
mov r9d, 0xe5ca17a4
mov r10d, 0x7a2b000a
mov r8d, 0xfffff1ff
mov r11d, 0x89925eaf
mov r15d, 0xac995dab
nop word [rax + rax]
cmp ecx, 0xac995daa
jg 0x14009b580
cmp ecx, 0x8463822d
je 0x14009b60b
cmp ecx, 0x89925eaf
je 0x14009b5b7
cmp ecx, 0xa8706c98
jne 0x14009b430
mov rcx, qword [rbp + 0x18]
add rcx, 0x18
mov edx, 0xc902bd3a
nop dword [rax]
cmp edx, 0x65725469
je 0x14009b5c1
cmp edx, 0xc902bd3a
jne 0x14009b470
mov edx, dword [0x140145444]
lea esi, [rdx - 1]
imul esi, edx
test sil, 1
sete byte [rbp + 0x2d]
mov edx, dword [0x140145448]
mov edi, 0x83aeebd6
cmove edi, r9d
cmp edx, 0xa
setl byte [rbp + 0x2c]
cmovl edi, r9d
mov edx, 0x9fae06e2
nop word [rax + rax]
cmp edx, 0xe929ab5a
jle 0x14009b4f0
cmp edx, 0xe929ab5b
je 0x14009b50f
cmp edx, 0x6c0afda4
je 0x14009b556
cmp edx, 0x7a2b000a
jne 0x14009b4c0
mov edx, edi
jmp 0x14009b4c0
cmp edx, 0x83aeebd6
je 0x14009b533
cmp edx, 0x9fae06e2
je 0x14009b53a
cmp edx, 0xe5ca17a4
jne 0x14009b4c0
mov edx, 0xe929ab5b
jmp 0x14009b4c0
mov qword [rbp + 0x20], rcx
mov rdx, qword [rbp + 0x20]
mov edx, dword [rdx]
mov dword [rbp + 0x14], edx
mov edx, dword [rbp + 0x14]
and edx, r8d
mov dword [rbp + 0x10], edx
mov dword [rbp + 0xc], 0x800
mov edx, 0x6c0afda4
jmp 0x14009b4c0
mov edx, 0x7a2b000a
jmp 0x14009b4c0
movzx ebx, byte [rbp + 0x2d]
cmp byte [rbp + 0x2c], 0
mov edx, 0x83aeebd6
cmovne edx, r10d
test bl, bl
cmovne edx, r10d
jmp 0x14009b4c0
mov edx, dword [rbp + 0xc]
movzx edx, dx
or edx, dword [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
mov dword [rsi], edx
mov edx, dword [rbp + 0x14]
mov edx, 0x65725469
jmp 0x14009b470
cmp ecx, 0xac995dab
je 0x14009b5cb
cmp ecx, 0x18ef5df2
je 0x14009b601
cmp ecx, 0x9497618
jne 0x14009b430
mov dl, byte [rbp + 0x2f]
cmp byte [rbp + 0x2e], 0
mov ecx, 0x18ef5df2
cmovne ecx, r15d
test dl, dl
cmovne ecx, r15d
jmp 0x14009b430
mov ecx, 0xa8706c98
jmp 0x14009b430
mov ecx, 0x8463822d
jmp 0x14009b430
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov qword [rbp + 0x18], rcx
mov ecx, dword [0x140144914]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
mov ecx, 0x18ef5df2
cmove ecx, r11d
cmp dword [0x140144918], 0xa
cmovl ecx, r11d
jmp 0x14009b430
mov ecx, 0xac995dab
jmp 0x14009b430
mov rcx, rax
mov edx, r14d
call fcn.14007e1b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x18]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x20]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009b670
mov edx, 0x7edbeddb
nop
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009b6b0
cmp edi, 0x4f763e7c
jle 0x14009b6e0
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009b670
mov edx, r8d
cmp edi, 0x79631133
je 0x14009b670
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009b670
jmp 0x14009b759
cmp edi, 0xabdfd435
jg 0x14009b710
cmp edi, 0x91105d4e
je 0x14009b74f
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009b670
mov edx, 0x79631133
jmp 0x14009b670
cmp edi, 0xfa81deb6
je 0x14009b669
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009b670
mov edx, 0xabdfd436
jmp 0x14009b670
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009b670
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009b670
movzx ecx, byte [rbp + 0x18]
cmp byte [rbp + 0x20], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009b745
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009b670
mov edx, 0x4f763e7d
jmp 0x14009b670
mov rcx, rax
call fcn.140005a60
test r14d, r14d
je 0x14009b8ee
lea rcx, [0x140149ab0]
lea rdx, str.____Driver_Unload_Failed__
call fcn.14001a4b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x18]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x20]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009b7e0
mov edx, 0x7edbeddb
nop word cs:[rax + rax]
nop
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009b820
cmp edi, 0x4f763e7c
jle 0x14009b850
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009b7e0
mov edx, r8d
cmp edi, 0x79631133
je 0x14009b7e0
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009b7e0
jmp 0x14009b8c9
cmp edi, 0xabdfd435
jg 0x14009b880
cmp edi, 0x91105d4e
je 0x14009b8bf
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009b7e0
mov edx, 0x79631133
jmp 0x14009b7e0
cmp edi, 0xfa81deb6
je 0x14009b7d0
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009b7e0
mov edx, 0xabdfd436
jmp 0x14009b7e0
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009b7e0
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009b7e0
movzx ecx, byte [rbp + 0x18]
cmp byte [rbp + 0x20], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009b8b5
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009b7e0
mov edx, 0x4f763e7d
jmp 0x14009b7e0
mov rcx, rax
call fcn.140005a60
lea rcx, [rbp - 0x28]
call fcn.1400819e0
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor esi, esi
jmp 0x14009b90d
lea rcx, [rbp - 0x28]
call fcn.1400819e0
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete sil
lea rcx, [rbp - 0x28]
call fcn.140001e90
lea rcx, [rbp - 0x60]
call fcn.140001e90
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret