Function at 0x140023e50
Capabilities:
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x398], rbx
mov rax, qword [0x14009f008]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r13d, r8d
mov r12d, edx
mov rsi, rcx
mov r8d, dword [rcx + 0x50]
lea rdx, [rsp + 0x70]
call fcn.140023dd0
nop
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140023f0a
lea rdx, str.EndpointId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x50], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
or r14, 0xffffffffffffffff
cmp dword [rsp + 0x50], ebx
jne 0x14002467b
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x120]
call fcn.14005b700
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
lea r8d, [r14 + 0xe]
lea rdx, [0x140086cf8]
lea rcx, [rbp - 0x28]
call fcn.140002500
nop
lea r8d, [r14 + 0x10]
lea rdx, str.WavesSvc64.exe
lea rcx, [rbp - 0x28]
call fcn.140002500
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x68], 0
cmp byte [rbp + 0x120], 0
jne 0x140023fb2
mov r8, rbx
jmp 0x140023fca
lea rax, [rbp + 0x120]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140023fc0
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140002500
nop
mov rcx, qword [rbp - 0x58]
cmp rcx, 1
jb 0x140024046
lea rax, [rbp - 0x68]
mov rdi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x50]
cmp r15, 0x10
cmovae rax, rdi
lea rbx, [rcx - 1]
add rbx, rax
cmp byte [rbx], 0x5c
sete al
test al, al
je 0x140024022
movzx eax, byte [rbx]
cmp al, byte [0x140085b1c]
jne 0x140024019
xor eax, eax
jmp 0x14002401e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140024035
lea rcx, [rbp - 0x68]
call fcn.140002440
cmp rbx, rax
je 0x140024046
dec rbx
jmp 0x140024000
lea rax, [rbp - 0x68]
cmp r15, 0x10
cmovae rax, rdi
sub rbx, rax
jmp 0x140024049
mov rbx, r14
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp - 0x68]
call fcn.140018880
nop
lea r8, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14002b190
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000bed0
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x1400240d2
inc rax
mov rcx, qword [rbp - 8]
cmp rax, 0x1000
jb 0x1400240cd
test cl, 0x1f
je 0x1400240a0
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400240af
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400240be
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400240ca
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0x10], 0xf
xor r15d, r15d
mov qword [rbp + 8], r15
mov byte [rbp - 8], r15b
mov rax, qword [rbp + 0x110]
cmp rax, 0x10
jb 0x140024141
inc rax
mov rcx, qword [rbp + 0xf8]
cmp rax, 0x1000
jb 0x14002413c
test cl, 0x1f
je 0x14002410f
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002411e
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002412d
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024139
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov edx, r13d
lea rcx, [rbp + 0xd8]
call fcn.140022f50
mov rdi, rax
mov edx, r12d
lea rcx, [rbp + 0xb8]
call fcn.140022f50
mov rbx, rax
mov edx, dword [rsi + 0x50]
lea rcx, [rbp + 0x98]
call fcn.140022f70
nop
mov r8, rax
lea rdx, str._Retask
lea rcx, [rbp + 0x78]
call fcn.14002b1e0
nop
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.14002b240
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14002b100
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14002b240
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14002b100
nop
mov rax, qword [rbp + 0x30]
cmp rax, 0x10
jb 0x140024219
inc rax
mov rcx, qword [rbp + 0x18]
cmp rax, 0x1000
jb 0x140024214
test cl, 0x1f
je 0x1400241e7
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400241f6
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024205
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024211
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0x30], 0xf
mov qword [rbp + 0x28], r15
mov byte [rbp + 0x18], 0
mov rax, qword [rbp + 0x50]
cmp rax, 0x10
jb 0x14002427f
inc rax
mov rcx, qword [rbp + 0x38]
cmp rax, 0x1000
jb 0x14002427a
test cl, 0x1f
je 0x14002424d
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002425c
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002426b
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024277
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0x50], 0xf
mov qword [rbp + 0x48], r15
mov byte [rbp + 0x38], 0
mov rax, qword [rbp + 0x70]
cmp rax, 0x10
jb 0x1400242e5
inc rax
mov rcx, qword [rbp + 0x58]
cmp rax, 0x1000
jb 0x1400242e0
test cl, 0x1f
je 0x1400242b3
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400242c2
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400242d1
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400242dd
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r15
mov byte [rbp + 0x58], 0
mov rax, qword [rbp + 0x90]
cmp rax, 0x10
jb 0x14002434e
inc rax
mov rcx, qword [rbp + 0x78]
cmp rax, 0x1000
jb 0x140024349
test cl, 0x1f
je 0x14002431c
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002432b
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002433a
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024346
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
mov rax, qword [rbp + 0xb0]
cmp rax, 0x10
jb 0x1400243c0
inc rax
mov rcx, qword [rbp + 0x98]
cmp rax, 0x1000
jb 0x1400243bb
test cl, 0x1f
je 0x14002438e
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002439d
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400243ac
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400243b8
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
mov rax, qword [rbp + 0xd0]
cmp rax, 0x10
jb 0x140024435
inc rax
mov rcx, qword [rbp + 0xb8]
cmp rax, 0x1000
jb 0x140024430
test cl, 0x1f
je 0x140024403
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024412
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024421
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x14002442d
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0xd0], 0xf
mov qword [rbp + 0xc8], r15
mov byte [rbp + 0xb8], 0
mov rax, qword [rbp + 0xf0]
cmp rax, 0x10
jb 0x1400244aa
inc rax
mov rcx, qword [rbp + 0xd8]
cmp rax, 0x1000
jb 0x1400244a5
test cl, 0x1f
je 0x140024478
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024487
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024496
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400244a2
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp + 0xf0], 0xf
mov qword [rbp + 0xe8], r15
mov byte [rbp + 0xd8], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
call fcn.14000f920
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x54]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000f9b0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000f9e0
add rdi, 4
lea rax, [rsp + 0x58]
cmp rdi, rax
je 0x14002452c
mov rbx, qword [rsp + 0x60]
jmp 0x1400244f0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
lea r8, [rsp + 0x60]
call fcn.14002f390
nop
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x1400245a9
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x1400245a4
test cl, 0x1f
je 0x140024577
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024586
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024595
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400245a1
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x48], 0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14002460f
inc rax
mov rcx, qword [rbp - 0x68]
cmp rax, 0x1000
jb 0x14002460a
test cl, 0x1f
je 0x1400245dd
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400245ec
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400245fb
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024607
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x1400246e4
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x140024674
test cl, 0x1f
je 0x140024647
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140024656
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140024665
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140024671
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
jmp 0x1400246e4
mov rcx, qword [rsi + 0x2d0]
test rcx, rcx
je 0x140024698
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140024698
mov qword [rsi + 0x2d0], rbx
cmp qword [rsi + 0x2d0], rbx
jne 0x1400246c5
lea r9, str.RealtekAudioBackgroundProcessClass
lea r8, str.RealtekAudioBackgroundProcessClass
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov qword [rsi + 0x2d0], rax
cmp rax, rbx
je 0x1400246d5
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call fcn.140024730
jmp 0x1400246e4
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call fcn.1400249a0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140024702
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14003a8a0
mov rbx, qword [rsp + 0x398]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret