Function at 0x1407e7a30
Capabilities:
Allocate or change rwx memory
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov edx, 0x1000
xor esi, esi
xor ecx, ecx
mov r8d, edx
lea r9d, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1407e7c86
xor edx, edx
mov qword [rsp + 0x98], rdi
mov r8d, 0x1000
mov rcx, rax
call fcn.1407eaf20
mov r11d, 0x53
mov r9d, WSAStartup
mov word [rbp - 0x50], r11w
mov r10d, 0x65
mov r8d, 0x74
mov eax, 0x59
mov word [rbp - 0x4e], ax
mov edi, 0x5c
mov word [rbp - 0x4c], r11w
mov eax, 0x54
mov word [rbp - 0x4a], ax
mov edx, 0x43
mov eax, 0x45
mov ecx, WSAGetLastError
mov word [rbp - 0x48], ax
mov eax, 0x4d
mov word [rbp - 0x46], ax
mov eax, 0x75
mov word [rbp - 0x44], di
mov word [rbp - 0x42], dx
mov word [rbp - 0x40], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rbp - 0x3e], r9w
mov word [rbp - 0x3c], r9w
mov word [rbp - 0x3a], r10w
mov word [rbp - 0x38], cx
mov word [rbp - 0x36], r8w
mov word [rbp - 0x34], dx
mov word [rbp - 0x32], ax
mov word [rbp - 0x30], cx
lea rcx, str.KbDriver
mov word [rbp - 0x2e], r8w
mov word [rbp - 0x2c], r9w
mov word [rbp - 0x2a], ax
mov eax, WSAGetLastError
mov word [rbp - 0x28], ax
mov eax, 0x76
mov word [rbp - 0x26], r11w
mov word [rbp - 0x24], r10w
mov word [rbp - 0x22], r8w
mov word [rbp - 0x20], di
mov word [rbp - 0x1e], r11w
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], r9w
mov word [rbp - 0x18], ax
mov eax, 0x69
mov word [rbp - 0x16], ax
mov eax, 0x63
mov word [rbp - 0x14], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rbp - 0x12], r10w
mov word [rbp - 0x10], ax
mov word [rbp - 0xe], di
mov word [rbp - 0xc], si
call fcn.1407e7400
mov rdi, rax
test rax, rax
je 0x1407e7c6d
xor edx, edx
mov qword [rbp + 0x10], rsi
mov r8d, 0x1000
mov rcx, rbx
call fcn.1407eaf20
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1407e7bb0
lea r8, [rbp - 0x50]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1407e7bc0
lea rax, [rbx - 2]
cmp word [rax + 2], si
lea rax, [rax + 2]
jne 0x1407e7bd6
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdi + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x1407e7bf0
lea rax, [rbp + 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1407e7c59
mov rcx, qword [rbp + 0x10]
call fcn.1407e78c0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x98]
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret