Function at 0x100001de4
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x158
mov rdx, qword [rcx + 0x18]
mov rdi, rcx
xor ebp, ebp
lea rcx, [rax - 0x38]
mov qword [rax + 0x18], rbp
mov esi, ebp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, qword [rdi + 0x20]
lea rax, [rsp + 0x140]
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rcx, [rsp + 0x110]
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rbp
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 5
lea rax, [rsp + 0x110]
mov dword [rsp + 0x30], ebp
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x188]
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x88], 0x40
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
call qword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, ebp
jne 0x1000020ea
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x180]
call fcn.100001864
cmp eax, ebp
je 0x100001f5b
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.1000018c8
cmp eax, ebp
mov ebx, eax
je 0x100001f2c
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1000020e8
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x180]
mov esi, 1
call fcn.100001864
cmp eax, ebp
mov ebx, eax
je 0x100001f5b
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x100002078
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ntdll.dll_NtFlushKey]
cmp eax, ebp
mov ebx, eax
je 0x100001f82
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x100002066
lea rdx, [0x1000013a0]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rsp + 0x198]
lea r8, [rsp + 0x120]
xor edx, edx
xor ecx, ecx
call sub.ntdll.dll_LdrGetDllHandle
cmp eax, ebp
jne 0x100002000
lea rdx, [0x1000013b0]
lea rcx, [rsp + 0x100]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov rcx, qword [rsp + 0x198]
lea r9, [rsp + 0x190]
lea rdx, [rsp + 0x100]
xor r8d, r8d
call sub.ntdll.dll_LdrGetProcedureAddress
neg eax
sbb r9, r9
and r9, qword [rsp + 0x190]
mov qword [rsp + 0x190], r9
jmp 0x100002008
mov r9, qword [rsp + 0x190]
cmp r9, rbp
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
je 0x1000020f6
mov r8d, dword [rdi]
call r9
cmp eax, ebp
mov ebx, eax
jne 0x100001f6f
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rsp + 0x70]
call sub.ntdll.dll_ZwDeleteFile
mov rdx, qword [rsp + 0x180]
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtReplaceKey]
mov ebx, eax
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ntdll.dll_NtClose]
cmp esi, ebp
je 0x1000020e8
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x130]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], rbp
mov dword [rsp + 0xe8], 0x40
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xf8], rbp
call qword [sym.imp.ntdll.dll_NtUnloadKey]
cmp eax, ebp
je 0x1000020e8
lea rcx, [0x100001178]
mov edx, eax
call fcn.1000017d8
mov eax, ebx
add rsp, 0x158
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.ntdll.dll_NtSaveKey]
jmp 0x100002027