Function at 0x1401cd9f0
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov r15, rcx
movzx eax, word [0x1403eeee1]
mov word [rbp - 0x38], ax
mov eax, dword [0x140837ab8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140837abc], 0xa
setl cl
or cl, al
mov r10d, 0xc2655c84
mov eax, 0x39ca1a6e
cmove r10d, eax
mov r11d, 0x3fdca39e
cmove r11d, eax
mov eax, dword [0x1408379f8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1408379fc], 0xa
setl dl
or dl, al
mov r14d, 0xc2d74956
mov eax, 0x833057af
cmove r14d, eax
mov rdi, qword [0x1403eeed9]
mov ebx, 0xb5192b05
cmove ebx, eax
mov qword [rbp - 0x40], rdi
mov eax, 0xcafd72c
mov r8d, 0x19f385e7
mov r9d, 0xd436d8c6
nop dword [rax]
cmp eax, 0x34a0642f
jg 0x1401cdae0
cmp eax, 0xc2655c84
je 0x1401cdbeb
cmp eax, 0xcafd72c
je 0x1401cdafe
cmp eax, 0x19f385e7
jne 0x1401cdab0
mov eax, r11d
jmp 0x1401cdab0
cmp eax, 0x34a06430
je 0x1401cdb0d
cmp eax, 0x39ca1a6e
je 0x1401cdbd7
cmp eax, 0x3fdca39e
jne 0x1401cdab0
mov eax, r10d
jmp 0x1401cdab0
cmp byte [rbp - 0x37], 0
mov eax, 0x34a06430
cmove eax, r8d
jmp 0x1401cdab0
xor edi, edi
mov eax, 0x669c9f05
nop word cs:[rax + rax]
nop
cmp eax, 0xd436d8c5
jle 0x1401cdb50
cmp eax, 0xd436d8c6
je 0x1401cdb90
cmp eax, 0x1010398e
je 0x1401cdbe1
cmp eax, 0x669c9f05
jne 0x1401cdb20
mov dword [rbp - 0x20], edi
mov eax, ebx
jmp 0x1401cdb20
cmp eax, 0x833057af
je 0x1401cdb74
cmp eax, 0xb5192b05
je 0x1401cdb7e
cmp eax, 0xc2d74956
jne 0x1401cdb20
cmp byte [rbp], 0
mov eax, 0x1010398e
cmovne eax, r9d
jmp 0x1401cdb20
mov eax, dword [rbp - 0x20]
mov eax, 0xb5192b05
jmp 0x1401cdb20
mov eax, dword [rbp - 0x20]
cmp eax, 0xa
setl byte [rbp]
mov eax, r14d
jmp 0x1401cdb20
movsxd rax, dword [rbp - 0x20]
movzx edi, byte [rbp + rax - 0x40]
movsxd rsi, dword [rbp - 0x20]
imul rcx, rsi, 0x5397829d
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x24
add ecx, edx
imul ecx, ecx, 0x31
sub esi, ecx
lea ecx, [rsi + 0x36]
mov edx, 0xc9
sub edx, esi
and edx, edi
not edi
and edi, ecx
or edx, edi
mov byte [rbp + rax - 0x40], dl
mov edi, dword [rbp - 0x20]
add edi, 1
jmp 0x1401cdb0f
mov eax, 0x3fdca39e
jmp 0x1401cdab0
mov eax, 0x19f385e7
jmp 0x1401cdab0
lea rsi, [rbp - 0x40]
mov qword [rbp - 0x20], rsi
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401cddea
mov rbx, rax
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
mov rcx, rsi
mov r8, r15
call fcn.1401cd760
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov edi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove edi, edx
mov ecx, 0xbfdfa790
cmove ecx, edx
cmp qword [rbp - 0x28], 8
mov edx, 0xad6d326
mov esi, 0xd8848f1c
cmovae esi, edx
mov qword [rbp], rax
mov eax, 0x2da7141d
lea r8, [rbp - 0x20]
mov r14, rbp
nop dword [rax + rax]
cmp eax, 0xad6d325
jg 0x1401cdca0
cmp eax, 0xb3ce7c32
je 0x1401cdcc0
cmp eax, 0xbfdfa790
je 0x1401cdcca
cmp eax, 0xd8848f1c
jne 0x1401cdc80
jmp 0x1401cdce4
cmp eax, 0xad6d326
je 0x1401cdcd9
cmp eax, 0x2da7141d
je 0x1401cdcdd
cmp eax, 0x3722f1cd
jne 0x1401cdc80
mov rax, qword [rbp + 0x28]
mov eax, 0xbfdfa790
jmp 0x1401cdc80
mov eax, 0xd8848f1c
mov rdx, qword [r8]
jmp 0x1401cdc80
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
mov eax, edi
jmp 0x1401cdc80
mov eax, ecx
jmp 0x1401cdc80
mov rdx, qword [r14]
mov eax, esi
jmp 0x1401cdc80
lea rcx, [rbp - 0x58]
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea r12, [rbp - 0x20]
mov rcx, r12
mov r8, r15
call fcn.1401cd760
mov qword [rbp + 0x20], r12
mov rax, qword [rbp + 0x20]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov esi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove esi, edx
mov qword [rbp + 0x28], rax
mov ecx, 0xbfdfa790
cmove ecx, edx
cmp qword [rbp - 8], 8
mov eax, 0xad6d326
mov edi, 0xd8848f1c
cmovae edi, eax
mov eax, 0x2da7141d
lea r15, [rbp + 0x28]
nop dword [rax]
cmp eax, 0xad6d325
jg 0x1401cdd80
cmp eax, 0xb3ce7c32
je 0x1401cdda0
cmp eax, 0xbfdfa790
je 0x1401cddaa
cmp eax, 0xd8848f1c
jne 0x1401cdd60
jmp 0x1401cddc4
cmp eax, 0xad6d326
je 0x1401cddb9
cmp eax, 0x2da7141d
je 0x1401cddbd
cmp eax, 0x3722f1cd
jne 0x1401cdd60
mov rax, qword [rbp + 0x20]
mov eax, 0xbfdfa790
jmp 0x1401cdd60
mov eax, 0xd8848f1c
mov rdx, qword [r14]
jmp 0x1401cdd60
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp], rax
mov eax, esi
jmp 0x1401cdd60
mov eax, ecx
jmp 0x1401cdd60
mov rdx, qword [r15]
mov eax, edi
jmp 0x1401cdd60
lea r8, [rbp - 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1401cddf1
mov sil, 1
cmp eax, 2
je 0x1401ce153
jmp 0x1401ce151
xor esi, esi
jmp 0x1401ce165
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x58]
call rax
test eax, eax
je 0x1401ce17b
movups xmm0, xmmword [0x1403eeeee]
movups xmmword [rbp + 0xb], xmm0
mov eax, dword [0x140838290]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140838294], 0xa
setl cl
or cl, al
mov r10d, 0x4ff867c7
mov eax, 0x335a8a0
cmove r10d, eax
mov r11d, 0xff0094ec
cmove r11d, eax
mov eax, dword [0x140838428]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x14083842c], 0xa
setl dl
or dl, al
mov r13d, 0xd4f6f57f
mov eax, 0x26ffbc1c
cmove r13d, eax
movups xmm0, xmmword [0x1403eeee3]
mov r9d, 0x79300fd2
cmove r9d, eax
movaps xmmword [rbp], xmm0
mov eax, 0x491545dc
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x335a89f
jle 0x1401cdef0
cmp eax, 0x335a8a0
je 0x1401cdf0e
cmp eax, 0x4ff867c7
je 0x1401ce04a
cmp eax, 0x491545dc
jne 0x1401cdeb0
cmp byte [rbp + 0x1a], 0
mov eax, 0xb957c4c6
mov ecx, 0xf90a642d
cmove eax, ecx
jmp 0x1401cdeb0
cmp eax, 0xb957c4c6
je 0x1401cdf15
cmp eax, 0xf90a642d
je 0x1401ce038
cmp eax, 0xff0094ec
jne 0x1401cdeb0
mov eax, r10d
jmp 0x1401cdeb0
mov eax, 0xff0094ec
jmp 0x1401cdeb0
xor edi, edi
mov eax, 0x4dcf7dac
nop dword [rax]
cmp eax, 0x26ffbc1b
jg 0x1401cdf50
cmp eax, 0x9e6a7647
je 0x1401cdf81
cmp eax, 0xc3778203
je 0x1401ce040
cmp eax, 0xd4f6f57f
jne 0x1401cdf20
jmp 0x1401ce030
cmp eax, 0x26ffbc1c
je 0x1401cdf86
cmp eax, 0x79300fd2
je 0x1401cdfe2
cmp eax, 0x4dcf7dac
jne 0x1401cdf20
mov dword [rbp + 0x28], edi
mov eax, dword [rbp + 0x28]
cmp eax, 0x1b
mov eax, 0xc3778203
mov ecx, 0x9e6a7647
cmovl eax, ecx
jmp 0x1401cdf20
mov eax, r9d
jmp 0x1401cdf20
movsxd rax, dword [rbp + 0x28]
movzx ecx, byte [rbp + rax]
mov edx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x28]
mov edx, dword [rbp + 0x28]
movsxd rdx, dword [rbp + 0x28]
imul rbx, rdx, 0x5397829d
mov rsi, rbx
shr rsi, 0x3f
sar rbx, 0x24
add ebx, esi
imul ebx, ebx, 0x31
sub edx, ebx
lea ebx, [rdx + 0x36]
mov esi, 0xc9
sub esi, edx
and esi, ecx
not ecx
and ecx, ebx
or esi, ecx
mov byte [rbp + rax], sil
mov eax, dword [rbp + 0x28]
mov eax, dword [rbp + 0x28]
mov eax, 0x79300fd2
jmp 0x1401cdf20
movsxd rax, dword [rbp + 0x28]
movzx esi, byte [rbp + rax]
movsxd rcx, dword [rbp + 0x28]
imul rdx, rcx, 0x5397829d
mov r8, rdx
shr r8, 0x3f
sar rdx, 0x24
add edx, r8d
imul edx, edx, 0x31
sub ecx, edx
lea edx, [rcx + 0x36]
mov ebx, 0xc9
sub ebx, ecx
and ebx, esi
not esi
and esi, edx
or ebx, esi
mov byte [rbp + rax], bl
mov eax, dword [rbp + 0x28]
add eax, 1
mov dword [rbp + 0x20], eax
mov eax, r13d
jmp 0x1401cdf20
mov edi, dword [rbp + 0x20]
jmp 0x1401cdf17
mov eax, r11d
jmp 0x1401cdeb0
mov eax, 0xf90a642d
jmp 0x1401cdeb0
mov qword [rbp + 0x28], r14
mov rdx, qword [rbp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140180b20
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov qword [rbp + 0x20], r12
mov rax, qword [rbp + 0x20]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov edi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove edi, edx
mov ecx, 0xbfdfa790
cmove ecx, edx
mov qword [rbp + 0x28], rax
cmp qword [rbp - 8], 8
mov eax, 0xad6d326
mov ebx, 0xd8848f1c
cmovae ebx, eax
mov eax, 0x2da7141d
nop dword [rax]
cmp eax, 0xad6d325
jg 0x1401ce100
cmp eax, 0xb3ce7c32
je 0x1401ce120
cmp eax, 0xbfdfa790
je 0x1401ce12a
cmp eax, 0xd8848f1c
jne 0x1401ce0e0
jmp 0x1401ce144
cmp eax, 0xad6d326
je 0x1401ce139
cmp eax, 0x2da7141d
je 0x1401ce13d
cmp eax, 0x3722f1cd
jne 0x1401ce0e0
mov rax, qword [rbp + 0x20]
mov eax, 0xbfdfa790
jmp 0x1401ce0e0
mov eax, 0xd8848f1c
mov rdx, qword [r14]
jmp 0x1401ce0e0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp], rax
mov eax, edi
jmp 0x1401ce0e0
mov eax, ecx
jmp 0x1401ce0e0
mov rdx, qword [r15]
mov eax, ebx
jmp 0x1401ce0e0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor esi, esi
lea rcx, [rbp - 0x20]
call fcn.140173050
lea rcx, [rbp - 0x40]
call fcn.140173050
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp + 0x20], r12
mov rax, qword [rbp + 0x20]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov edi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove edi, edx
mov ecx, 0xbfdfa790
cmove ecx, edx
mov qword [rbp + 0x28], rax
cmp qword [rbp - 8], 8
mov eax, 0xad6d326
mov ebx, 0xd8848f1c
cmovae ebx, eax
mov eax, 0x2da7141d
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0xad6d325
jg 0x1401ce200
cmp eax, 0xb3ce7c32
je 0x1401ce220
cmp eax, 0xbfdfa790
je 0x1401ce22a
cmp eax, 0xd8848f1c
jne 0x1401ce1e0
jmp 0x1401ce244
cmp eax, 0xad6d326
je 0x1401ce239
cmp eax, 0x2da7141d
je 0x1401ce23d
cmp eax, 0x3722f1cd
jne 0x1401ce1e0
mov rax, qword [rbp + 0x20]
mov eax, 0xbfdfa790
jmp 0x1401ce1e0
mov eax, 0xd8848f1c
mov rdx, qword [r14]
jmp 0x1401ce1e0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp], rax
mov eax, edi
jmp 0x1401ce1e0
mov eax, ecx
jmp 0x1401ce1e0
mov rdx, qword [r15]
mov eax, ebx
jmp 0x1401ce1e0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
sete sil
jmp 0x1401ce153