Function at 0x1400971f0
Capabilities:
Delete registry key

Disassembly:
test dword [rdx + 0x118], 0x800
jne 0x1400976d0
jmp 0x140097210
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rcx, r8
mov rbx, rdx
xor r12d, r12d
mov r15, 0xffffffffffffffff
mov r9, r15
lea r8d, [r12 + 5]
lea rdx, [rbp - 0x18]
call fcn.14000a520
nop
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x48], r12
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400972cf
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400972b9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r12d
jmp 0x1400972d4
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x1400972e1
xor dil, dil
jmp 0x140097606
mov dword [rsp + 0x34], r12d
mov byte [rsp + 0x30], 0
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x1400976a0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [0x1400e13b8]
movups xmmword [rbp + 8], xmm0
lea rcx, [rbx + 0xf0]
cmp qword [rcx + 0x18], 8
jb 0x140097327
mov rcx, qword [rcx]
lea rdx, [rbp + 8]
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x34]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x70], rax
lea rax, [rbp + 8]
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x20], r12
lea rax, [0x1400da9d8]
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x30], xmm0
lea rax, [rbp - 0x58]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x38]
call fcn.140027c30
cmp byte [rsp + 0x30], 0
jne 0x1400975e4
mov rcx, qword [rsp + 0x50]
mov ebx, dword [rcx - 0x10]
test ebx, ebx
je 0x1400975e4
call fcn.1400a4010
mov r14d, eax
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x1400976ab
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8d, ebx
lea rdx, str.__0_dd
lea rcx, [rsp + 0x60]
call fcn.14002af10
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14009747f
mov rsi, qword [rsp + 0x38]
cmp qword [rbx], 0
je 0x140097461
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14009742f
mov eax, 1
jmp 0x140097473
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097428
mov qword [rsp + 0x28], r12
mov r8, qword [rbx]
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140097473
cmp dword [rbx + 8], 0
je 0x140097428
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400974ea
xor dil, dil
jmp 0x1400975c3
cmp byte [0x140133c78], 0
jne 0x1400974ca
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400974ba
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140133c70], rax
mov byte [0x140133c78], 1
jmp 0x1400974d1
mov rax, qword [0x140133c70]
mov byte [0x140133c78], 1
jmp 0x1400974d1
mov rax, qword [0x140133c70]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14009746a
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, rdi
call rax
jmp 0x140097473
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x1400976b6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x1400976c1
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
cmp r14d, dword [rsp + 0x34]
jge 0x140097585
mov rdi, qword [rsp + 0x60]
nop word [rax + rax]
lea esi, [r14 + 1]
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14002af10
mov r8d, r14d
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14002af10
mov rbx, qword [rsp + 0x68]
mov r8, rbx
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
mov r14d, esi
cmp esi, dword [rsp + 0x34]
jl 0x140097540
mov dil, 1
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400975a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400975c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400975e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x1400975e7
xor dil, dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140097606
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009761b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14009765c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140097657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009769a
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r12w
movzx eax, dil
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.14009c570
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rcx, r8
mov rbx, rdx
xor r12d, r12d
mov r15, 0xffffffffffffffff
mov r9, r15
lea r8d, [r12 + 5]
lea rdx, [rbp - 0x18]
call fcn.14000a520
nop
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x48], r12
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009778f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140097779
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r12d
jmp 0x140097794
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x1400977a1
xor dil, dil
jmp 0x140097ac6
mov dword [rsp + 0x34], r12d
mov byte [rsp + 0x30], 0
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140097b60
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [0x1400e13b8]
movups xmmword [rbp + 8], xmm0
lea rcx, [rbx + 0xf0]
cmp qword [rcx + 0x18], 8
jb 0x1400977e7
mov rcx, qword [rcx]
lea rdx, [rbp + 8]
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x34]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x70], rax
lea rax, [rbp + 8]
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x20], r12
lea rax, [0x1400da9a0]
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x30], xmm0
lea rax, [rbp - 0x58]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x38]
call fcn.140027c30
cmp byte [rsp + 0x30], 0
jne 0x140097aa4
mov rcx, qword [rsp + 0x50]
mov ebx, dword [rcx - 0x10]
test ebx, ebx
je 0x140097aa4
call fcn.1400a4010
mov r14d, eax
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140097b6b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8d, ebx
lea rdx, str.__0_dd
lea rcx, [rsp + 0x60]
call fcn.14002af10
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14009793f
mov rsi, qword [rsp + 0x38]
cmp qword [rbx], 0
je 0x140097921
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400978ef
mov eax, 1
jmp 0x140097933
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400978e8
mov qword [rsp + 0x28], r12
mov r8, qword [rbx]
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140097933
cmp dword [rbx + 8], 0
je 0x1400978e8
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400979aa
xor dil, dil
jmp 0x140097a83
cmp byte [0x140133c78], 0
jne 0x14009798a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009797a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140133c70], rax
mov byte [0x140133c78], 1
jmp 0x140097991
mov rax, qword [0x140133c70]
mov byte [0x140133c78], 1
jmp 0x140097991
mov rax, qword [0x140133c70]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14009792a
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, rdi
call rax
jmp 0x140097933
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140097b76
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140097b81
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
cmp r14d, dword [rsp + 0x34]
jge 0x140097a45
mov rdi, qword [rsp + 0x60]
nop word [rax + rax]
lea esi, [r14 + 1]
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14002af10
mov r8d, r14d
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14002af10
mov rbx, qword [rsp + 0x68]
mov r8, rbx
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
mov r14d, esi
cmp esi, dword [rsp + 0x34]
jl 0x140097a00
mov dil, 1
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140097a63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140097a83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140097aa7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140097aa7
xor dil, dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140097ac6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140097adb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140097b1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140097b17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140097b5a
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r12w
movzx eax, dil
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.14009c570
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3