Function at 0x140022f50
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
movabs rax, 0x2c707f3c7474ac59
mov qword [rsp + 0x30], rax
movabs rax, 0x17d89ccfce317793
mov qword [rsp + 0x38], rax
movabs rax, 0x4d15cfd432549522
mov qword [rsp + 0x40], rax
movabs rax, 0xeae5617ca1f26e28
mov qword [rsp + 0x48], rax
movabs rax, 0x3a336873f163a73a
mov qword [rsp + 0x50], rax
movabs rax, 0x949bc6ddb3fcf1bb
mov qword [rsp + 0x58], rax
movabs rax, 0x2e2a19a38319aa18
mov qword [rsp + 0x60], rax
movabs rcx, 0x8bc1844a19548038
mov qword [rsp + 0x68], rcx
movabs r12, 0x5e040c551311fe05
mov qword [rsp + 0x110], r12
movabs r14, 0x79b1f4acaf7c2bea
mov qword [rsp + 0x118], r14
movabs rax, 0x2070bba74b07c947
mov qword [rsp + 0x120], rax
movabs rax, 0x9e8b040ed3872d74
mov qword [rsp + 0x128], rax
movabs rax, 0x695f0701850dc879
mov qword [rsp + 0x130], rax
movabs rax, 0xfdedb4b8e0a085de
mov qword [rsp + 0x138], rax
movabs rax, 0x2e2a19a3df6acf7b
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x60], xmm1
xorps xmm0, xmm0
movups xmmword [r11 - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x68], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x1400230f7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.14001c2b0
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140023120
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x110]
call fcn.14001bf70
movabs r15, 0x3a6563397d448a4b
mov qword [rsp + 0x80], r15
movabs rax, 0x79b186c9d91559ae
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r14
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x80], xmm0
movabs rax, 0x326022397f758a6b
mov qword [rsp + 0xe0], rax
movabs rax, 0x79b1f4acaf7c2b86
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], r14
movdqa xmm0, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140023a1a
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0xd0]
call r14
mov r13d, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], r15
movabs rax, 0x598b86c9d91559ae
mov qword [rsp + 0x38], rax
movabs rax, 0x2070bba74b07c947
mov qword [rsp + 0x40], rax
movabs rcx, 0x9e8b040ed3872d74
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xe0], r12
movabs r15, 0x79b1f4acaf7c2bea
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rcx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140077670]
call fcn.14001c000
mov r14, rax
mov edx, r13d
lea rcx, [rsp + 0x80]
call fcn.140020e40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140023302
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.1400329c0
mov rcx, rax
call fcn.14002f910
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x140023359
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023354
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a8c
call fcn.1400355ac
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140079684], eax
jle 0x1400234cb
lea rcx, [0x140079684]
call fcn.140035688
cmp dword [0x140079684], 0xffffffff
jne 0x1400234cb
movabs rax, 0x1d58613067628756
mov qword [rsp + 0x30], rax
movabs rax, 0x16f280c2ca0e599f
mov qword [rsp + 0x38], rax
movabs rax, 0x5415e8cb2475bd29
mov qword [rsp + 0x40], rax
movabs rax, 0xfbe86d78a1e27e28
mov qword [rsp + 0x48], rax
movabs rax, 0x695f0701850d940a
mov qword [rsp + 0x50], rax
movabs rax, 0xfdedb4b8e0a085de
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
movabs r14, 0x2070bba74b07c947
mov qword [rsp + 0xf0], r14
movabs rcx, 0x9e8b040ed3872d74
mov qword [rsp + 0xf8], rcx
movabs rcx, 0x695f0701850dc879
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [0x140079608], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140079618], xmm1
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140023490
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x140079608]
mov rcx, rbx
call fcn.14001c2b0
lea rcx, [0x14005b6b0]
call fcn.140035928
nop
lea rcx, [0x140079684]
call fcn.14003561c
jmp 0x1400234dc
lea rbx, [0x140079608]
movabs r14, 0x2070bba74b07c947
cmp qword [0x140079620], 0xf
cmova rbx, qword [0x140079608]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140023511
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x140023539
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140023539
mov bl, 1
jmp 0x14002353b
xor bl, bl
movabs rax, 0x7e616f3c65639b76
mov qword [rsp + 0x30], rax
movabs rax, 0xc380dfc61b4e98
mov qword [rsp + 0x38], rax
movabs rax, 0x1a03ced32a73ba67
mov qword [rsp + 0x40], rax
movabs rax, 0x9e8b040ed3872d54
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], r14
movabs rax, 0x9e8b040ed3872d74
mov qword [rsp + 0xf8], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x140077670]
call fcn.14001c000
movzx edx, bl
mov rcx, rax
call fcn.14002c690
mov rcx, rax
call fcn.14002f910
lea rcx, [rsp + 0xe0]
call fcn.14001dcc0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14001d170
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x140023617
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.14001bf70
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400236a0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002369b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a92
call fcn.1400355ac
movdqa xmm0, xmmword [0x14006dd90]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x1400236fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023a98
call fcn.1400355ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.14003385c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov r14d, 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 9
test rdi, rdi
je 0x1400237d1
cmp rdi, 0x7fffffff
ja 0x140023a9e
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140033884
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140023aa4
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002ca30
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], r14
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140033884
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023ab0
lea rcx, [rsp + 0x30]
call fcn.14001dbb0
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023820
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002381b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023aba
call fcn.1400355ac
test bl, bl
je 0x14002396d
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
lea r15, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r15, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
call fcn.14003385c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], si
mov dword [rsp + 0x80], 0x47
test rdi, rdi
je 0x1400238fe
cmp rdi, 0x7fffffff
ja 0x140023ac0
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140033884
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140023ac5
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002ca30
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r15
mov ecx, r12d
call fcn.140033884
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140023ad0
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
cmp r14, 7
cmova rcx, qword [rsp + 0x30]
call fcn.140033f18
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140023ada
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140023964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002395e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023ae9
call fcn.1400355ac
nop
jmp 0x14002396d
test r13d, r13d
setne bl
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400239b6
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023aef
call fcn.1400355ac
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140023a15
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023af5
call fcn.1400355ac
movzx eax, bl
jmp 0x140023a5f
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140023a5d
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023afb
call fcn.1400355ac
xor al, al
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140035550
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003b4b4
nop
call fcn.14003b4b4
nop
call fcn.14003b4b4
nop
call fcn.14001c9e0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14001cbf0
int3
shr rcx, 0x20
call fcn.14001cbf0
nop
call fcn.14003b4b4
nop
call fcn.14001c9e0
shr rbx, 0x20
mov ecx, ebx
call fcn.14001cbf0
shr rcx, 0x20
call fcn.14001cbf0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.14001d970
nop
call fcn.14003b4b4
nop
call fcn.14003b4b4
nop
call fcn.14003b4b4
int3
call fcn.14003b4b4
int3