Function at 0x14001f220
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14001f2d5
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14001f2a1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001f2b9
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001f2b9
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14001f2b9
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14005faa0], 0
jne 0x14001f320
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f310
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005fa98], rax
mov byte [0x14005faa0], 1
jmp 0x14001f327
mov rax, qword [0x14005fa98]
mov byte [0x14005faa0], 1
jmp 0x14001f327
mov rax, qword [0x14005fa98]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001f2aa
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
cmp eax, 0x484c3ce5
loope 0x14009d1dc
invalid
jo 0x14009d1ee
cmp ah, ch
sub al, 0x4c
push rax
invalid
cmp byte [rax + 0x686c2f08], al
or byte [rdi], ch
insb byte [rdi], dx
push 0xffffffffed67ae53
sub dword [rax + 0x68], 0x68
add ch, byte [rax + 2]
push 0x204c24e5
add ch, byte [rax + 0x39]
xchg edi, eax
jge 0x14009d1e7
push 0x68026802
in eax, 0x24
and byte [rdx], r8b
and byte [rdx], al
push 0x47d9739
sub al, 0x60
js 0x14009d1d4
test al, 0x67
in al, dx
pop rsi
imul ebp, dword [rax + 0x68], 0x2c4c2ce3
sub al, 0x4c
sub al, 0x55
jrcxz 0x14009d21c
invalid
sub al, 0x55
push 0x1d686869
jmp 0x14009d20f
push 0x4c3ce368
sub bl, ah
je 0x14009d26c
mov ecx, 0x2ce5781c
in eax, 0x2c
sub byte [rax], r15b
sub byte [rax], bh
xchg edi, eax
jge 0x14009d23c
sub al, 0x60
js 0x14009d1a9
call 0x185723a95
push 0x68456868
push 0x68
invalid
sbb al, 0x7a
invalid
jmp 0x14009d1b5
sub byte [rdx + 0x1c], 0x65
in eax, 0x24
sub byte [rcx], r15b
xchg edi, eax
jge 0x14009d258
cmp dword [rdi + 0x602c187d], edx
sub al, 0x60
js 0x14009d1c7
invalid
punpckhdq mm5, qword [rax + 0x68]
push 0x1c9793eb
jecxz 0x14009d284
jmp 0x14009d1ee
xor byte [rdi + 0x6868686f], r13b
push 0xffffffff836c27e1
jp 0x14009d259
xchg ebp, eax
xchg edi, eax
sbb al, 0x65
jrcxz 0x14009d2b0
cmp al, 0xaf
invalid
xchg edi, eax
jge 0x14009d233
sub eax, 0x14e97860
sub al, 0x6a
push 0x68
push 0x68f0ec67
push 0x24e53d68
cmp rdi, qword [rcx]
in eax, 0x3c
cmp al, 0x4c
push rax
invalid
invalid
in al, dx
jge 0x14009d255
xchg edi, eax
xchg edi, eax
cmp eax, 0x484c24e5
and al, 0x4c
cmp rdi, qword [rcx]
in eax, 0x3c
push rax
invalid
jrcxz 0x14009d335
xor al, 0x37
xor eax, 0x65e10c33
invalid
push 0xffffffffeb686868
lodsb al, byte [rsi]
xor byte [rdx + 0x2ce36878], ch
and byte [rax], r15b
or byte [rax - 0x7c979344], 0xf8
xchg edi, eax
jge 0x14009d2bb
sub eax, 0x24e37860
jl 0x14009d374
js 0x14009d31a
and al, 0x4c
jl 0x14009d374
in eax, 0x24
pop rax
cmp ah, 0xe6
insb byte [rdi], dx
push 0xffffffffe3343ee3
xor byte cs:[rdx], bh
in eax, 0x24
pop rax
cmp byte [rcx], bh
and dl, 0x5d
imul ebp, dword [rax - 0x15], 0x3ce564ac
in eax, 0x24
sbb al, 0x3a
adc cl, 0xc0
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d395
pop rsp
add ch, byte [rcx + 0x3f]
cmp byte [rsi + 0x6a184c2c], ch
xchg edi, eax
jge 0x14009d313
sub byte [rax + 0x78], ah
jmp 0x14009d30f
sbb dh, 0xc0
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d3c3
insb byte [rdi], dx
loope 0x14009d3cb
adc byte [rdi - 0x1cc6c24b], r11b
cmp ebx, esp
cmpsb byte [rsi], byte [rdi]
sbb byte [rsp + rax*8], 0x97
xchg edi, eax
jrcxz 0x14009d3ea
adc byte [rax], r15b
cmp ah, bl
cmpsb byte [rsi], byte [rdi]
or byte [rdi], 0xc4
xchg edi, eax
xchg edi, eax
jmp 0x14009d34b
xor dword [rcx - 0x1d], 0x2f
invalid
insb byte [rdi], dx
cmp eax, 0x80a6e338
invalid
cmpsb byte [rsi], byte [rdi]
and byte [rdi], 0xc4
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d3f7
adc byte [rax], r15b
cmp ebx, esp
cmpsb byte [rsi], byte [rdi]
sub byte [rdx], 0xc4
xchg edi, eax
xchg edi, eax
push rbx
sub al, 0x4c
adc byte [rdi - 0x14], ah
in al, dx
in al, dx
fsubr qword [rax + 0x68]
push 0x784c24e3
cmp byte [rdx], al
imul edi, dword [rbx], 0x97eb9380
xchg edi, eax
jrcxz 0x14009d435
js 0x14009d425
add ch, byte [rcx + 0x3b]
adc byte [rbx - 0x1c686815], 0x3e
je 0x14009d3fb
push 0xffffffff973a6802
jge 0x14009d3a4
push 0xffffffffa47d973a
sub esp, dword [rax + 0x78]
jrcxz 0x14009d473
cmp esp, ebx
cmpsb byte [rsi], byte [rdi]
xchg edi, eax
clc
lodsb al, byte [rsi]
push 0xffffffffe1816868
push 0xffffffff95eb6868
xchg edi, eax
in al, dx
call 0x123723c85
xor al, 0x4c
adc bl, ah
outsd dx, dword [rsi]
push rbx
mov al, 0x1c
invalid
adc byte [rdi - 0x1cc6c44d], r11b
mov bl, 0x3b
cmp ebx, esp
cmpsb byte [rsi], byte [rdi]
sbb cl, 0xc2
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d47d
adc byte [rax], r15b
cmp ah, bl
cmpsb byte [rsi], byte [rdi]
or ah, 0xc2
xchg edi, eax
xchg edi, eax
jmp 0x14009d3de
adc byte [rsi + rcx*2], bl
jrcxz 0x14009d49c
js 0x14009d4b3
add ch, byte [rcx + 0x3d]
adc ch, 0xeb
xchg edi, eax
cmp eax, 0x97ebd580
xchg edi, eax
jrcxz 0x14009d4c3
je 0x14009d489
push 0xffffffff973a6802
jge 0x14009d432
push 0xffffffffa47d973a
sub esp, dword [rax + 0x78]
jrcxz 0x14009d501
cmp eax, 0xf897a6e3
movabs al, byte [0x801c4c24e5686868]
in eax, 0x24
sbb al, 0x80
iretd
or al, 0x6b
adc dword [rsi - 0x6a], 0xf8f89797
push rsi
xchg esi, eax
xchg edi, eax
xchg edi, eax
clc
clc
clc
clc
clc
clc
clc
clc
clc
jrcxz 0x14009d4e6
js 0x14009d4b0
js 0x14009d4b0
test byte [rax - 0x15], ah
movabs al, byte [0xe35c1c3fa0533e97]
sbb al, 0x4c
jo 0x14009d4b8
jo 0x14009d4b8
adc al, 0x4c
jl 0x14009d4be
and al, 0x4c
invalid
xor byte [rdi - 0x1c979307], 0x2c
je 0x14009d4d2
mov bh, 0xf9
insb byte [rdi], dx
push 0x744c2ce3
jrcxz 0x14009d52e
insb byte [rdi], dx
insb byte [rdi], dx
cmp ah, bl
invalid
jrcxz 0x14009d554
invalid
cmp ebx, esp
cmpsd dword [rsi], dword [rdi]
xor byte [rcx - 6], 0x6c
push 0xffffffffaceb3637
invalid
stosb byte [rdi], al
jl 0x14009d56c
push rcx
sub al, 0x4c
sbb al, 0x43
jrcxz 0x14009d528
jo 0x14009d4f2
adc al, 0x4c
jl 0x14009d515
push 0x644c2ce5
jrcxz 0x14009d598
sub al, 0x4c
jrcxz 0x14009d598
jrcxz 0x14009d598
jrcxz 0x14009d4c3
cmp bh, byte [rax]
or dh, 0xf9
insb byte [rdi], dx
push 0x744c24e3
jrcxz 0x14009d597
outsb dx, byte [rsi]
jrcxz 0x14009d564
insb byte [rdi], dx
jrcxz 0x14009d4d5
cmp bh, byte [rax]
or byte [rax + 0x37686cf9], 0x36
jmp 0x14009d4e5
cmp byte [rax + 0x686cf988], al
invalid
jrcxz 0x14009d4e5
cmp byte [rax - 0x68683f2a], al
jrcxz 0x14009d5a4
in eax, 0x24
jl str.p___v
and al, 0x4c
jl str.p___v
jrcxz 0x14009d501
jrcxz 0x14009d58d
insb byte [rdi], dx
add byte [rbp + 0x68], 0x68
push 0x6ae3b8e3
jrcxz 0x14009d58b
mov eax, 0x22e36ae3
insb byte [rdi], dx
in eax, 0x7c
outsd dx, dword [rsi]
jrcxz 0x14009d59b
imul rsp, qword [rbx + 0x78e13637], 0xffffffffffffffe1
and byte [rbx + rsi - 0x15], ch
loope 0x14009d599
insb byte [rdi], dx
xor ebp, ebx
jmp 0x14009d529
lodsb al, byte [rsi]
js 0x14009d529
insb byte [rdi], dx
push 0xfffffffff8f8f8f8
clc
clc
clc
clc
clc
clc
clc
clc
clc
clc
clc
clc
jmp 0x14009d516
jo 0x14009d5d1
invalid
cdq
or byte [rbx], 0xc4
or eax, esp
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d52f
pop rbx
test dword [rbx - 0x6b], edx
sbb eax, 0x4c2ce37e
jle 0x14009d589
sub al, 0x4c
pop rbx
movabs eax, dword [0x38e13660e137ba5b]
insb byte [rdi], dx
xor eax, 0xaa70aceb
insb byte [rdi], dx
push 0xffffffff80a7e33b
jne 0x14009d5d8
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d56c
loope 0x14009d5f3
je 0x14009d54a
cmp dl, byte [rdi]
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d577
loope 0x14009d5fe
sub al, 0x4c
js 0x14009d555
js 0x14009d555
scasd eax, dword [rdi]
invalid
xchg edi, eax
jrcxz 0x14009d58b
jrcxz 0x14009d584
loope 0x14009d613
xor al, 0x4c
jl 0x14009d562
jl 0x14009d562
movabs byte [0xe3a6e36902979717], al
xchg edi, eax
xchg edi, eax
add ch, byte [rcx - 0x1d]
cmpsb byte [rsi], byte [rdi]
jrcxz 0x14009d57c
nop
and byte [rcx + 0x6b686c32], 0xab
xor ch, byte [rax + rbp*2 + 0x6b]
stosd dword [rdi], eax
cmp eax, 0x2ce1a6e3
je 0x14009d57b
sal dword [rdx], cl
insb byte [rdi], dx
push 0x4e1b0e3
imul rsi, qword [rdi + 0x4c4c04e1], 0xffffffffffffffed
mov bh, 0xe1
add al, 0x4c
in eax, dx
xchg edi, eax
invalid
jno 0x14009d5e4
xchg edi, eax
xchg edi, eax
cmp bl, ah
sub al, 0x4c
cmp bl, r12b
cmpsb byte [rsi], byte [rdi]
and byte [rax + rax*8 - 0x1ed26869], 0x2c
push rbx
xchg dword [rdx + rcx*4], edx
jrcxz 0x14009d643
js 0x14009d685
mov bh, 0x15
jbe 0x14009d671
jrcxz 0x14009d5de
sbb byte [rbx - 0x1c686832], 0x24
cmp byte [rcx], dil
jrcxz 0x14009d5eb
or dh, 0xc0
xchg edi, eax
xchg edi, eax
sub esp, ecx
sub al, 0x4c
push rbx
mov bh, 0x14
mov ah, bl
xor al, 0x4c
jl 0x14009d6b3
xchg edi, eax
in eax, dx
mov bl, 0x16
jbe 0x14009d69d
jrcxz 0x14009d606
add byte [rbx - 0x1c686833], 0x3c
cmp al, 0x4c
cmp byte [rdx], r15b
jrcxz 0x14009d613
cmp ah, bl
cmpsb byte [rsi], byte [rdi]
add dh, 0xc1
xchg edi, eax
xchg edi, eax
invalid
adc eax, 0xa6e33f76
sub byte [rcx + 0x389797cd], 0xe3
sub al, 0x4c
cmp bl, spl
cmpsb byte [rsi], byte [rdi]
sub ah, 0xc1
xchg edi, eax
xchg edi, eax
invalid
loope 0x14009d6cb
push rbx
xchg ebx, eax
adc al, 0x8a
jrcxz 0x14009d6d3
jrcxz 0x14009d6cf
jrcxz 0x14009d6eb
invalid
xor r14, qword [rdi]
loope 0x14009d715
loope 0x14009d6f0
insb byte [rdi], dx
xor eax, 0xaa70aceb
insb byte [rdi], dx
push 0x6868c90c
push 0x970268
clc
jae 0x14009d72c
invalid
js 0x14009d706
or al, 0xe1
push 0xffffffffeb686868
loope 0x14009d71e
push 0xffffffffeb686868
push 0x5484eb68
push rsp
cmp eax, 0xaf91e33f
test byte [rbp + rdi + 0x3f], dl
push rsp
invalid
invalid
jrcxz 0x14009d66d
scasd eax, dword [rdi]
invalid
push 0xffffffff97c37080
xchg edi, eax
jrcxz 0x14009d66a
in eax, dx
test dword [rdi - 0x14], esp
xchg dword [rax + 0x68], ebp
push 0xffffffffa7e36868
invalid
outsd dx, dword [rsi]
push 0xffffffff80a7e368
outsd dx, dword [rsi]
ret
mov cl, 0x68
push 0x1c97ed68
imul esp, ebx, 0x2f
je 0x14009d748
xchg edi, eax
jge 0x14009d693
sub esp, dword [rax + 0x78]
in eax, dx
js 0x14009d704
test al, 0x67
in al, dx
stosd dword [rdi], eax
push 0xffffffffe53e6868
and al, 0x4c
and al, 0xf3
in eax, 0x24
and al, 0xf3
xchg edi, eax
xchg edi, eax
jrcxz 0x14009d746
xor byte [rdx], r8b
imul esp, ebp, 0xaf784c3c
add ch, byte [rcx - 0x1b]
cmp al, 0x4c
js 0x14009d6e2
sub al, 0x4c
cmp al, 0x68
push 0x2ee36868
js 0x14009d721
cmp byte fs:[rcx], bh
cmp ah, bl
movsd dword [rdi], dword [rsi]
sbb byte [rsi], 0x16
invalid
xchg edi, eax
xchg edi, eax
in eax, dx
test al, 0x1c
invalid