Function at 0x14000efc0
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x1278
call fcn.14004f000
sub rsp, rax
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov rax, qword [0x14006c868]
xor rax, rsp
mov qword [rsp + 0x1260], rax
mov dword [rsp + 0x68], r9d
mov qword [rsp + 0x70], r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov eax, dword [rsp + 0x12c0]
mov dword [rsp + 0x78], eax
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x518
mov dword [rsp + 0x20], 0xc
lea r9, str.Num_Els___d_n
lea r8d, [rsi + 2]
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0x90]
call fcn.140008810
mov rdx, rbp
mov rcx, rbx
call fcn.1400092d0
mov edi, eax
test eax, eax
jns 0x14000f072
jmp 0x14000fb26
cmp byte [rbp], 0x7d
je 0x14000fb16
nop dword [rax]
mov ebx, 1
mov dword [rsp + 0x6c], ebx
lea rdx, str.Delete
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor edi, edi
mov esi, edi
test eax, eax
sete sil
lea rdx, str.ForceRemove
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000f0bf
test esi, esi
je 0x14000f1d8
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fb11
cmp dword [rsp + 0x68], 0
je 0x14000f1d6
xor edi, edi
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
mov rcx, rbp
movzx eax, byte [rbp]
test al, al
je 0x14000f11e
nop dword [rax]
cmp al, 0x5c
je 0x14000f115
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
mov al, byte [rax]
test al, al
jne 0x14000f100
jmp 0x14000f11e
test rcx, rcx
jne 0x14000f998
lea rbx, str.AppID
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000f183
add rbx, 8
lea rax, [0x1400527d0]
cmp rbx, rax
jl 0x14000f130
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], edi
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.140009c70
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
test esi, esi
je 0x14000f1c9
mov rdx, rbp
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fb0a
mov rdx, rbp
mov rcx, rsi
call fcn.140009540
mov edi, eax
test eax, eax
js 0x14000fb03
mov dword [rsp + 0x88], 0
mov rbx, rsi
jmp 0x14000f58b
mov dword [rsp + 0x88], edi
mov ebx, dword [rsp + 0x6c]
jmp 0x14000f1d8
xor edi, edi
lea rdx, str.NoRemove
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14000f20e
mov ebx, edi
mov dword [rsp + 0x6c], ebx
mov rdx, rbp
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fafc
jmp 0x14000f213
mov rsi, qword [rsp + 0x60]
lea rdx, [0x140052714]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14000f3e9
lea rdx, [rsp + 0x260]
mov rcx, rsi
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000faf5
mov rdx, rbp
mov rcx, rsi
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000faee
cmp byte [rbp], 0x3d
jne 0x14000fa18
cmp dword [rsp + 0x68], 0
je 0x14000f2c6
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
xor ebx, ebx
mov dword [rsp + 0xb8], ebx
mov r9, rbp
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.14000e970
mov edi, eax
mov qword [rsp + 0xb0], rbx
mov dword [rsp + 0xb8], ebx
test eax, eax
js 0x14000f9b2
mov dword [rsp + 0xb8], ebx
mov rbx, qword [rsp + 0x60]
jmp 0x14000f58b
cmp dword [rsp + 0x12c0], 0
jne 0x14000f3ca
test ebx, ebx
je 0x14000f3ca
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], 0x569
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, str.Deleting__s_n
mov r8d, 1
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0xf0]
call fcn.140008810
xor edi, edi
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], edi
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140008c00
test eax, eax
jne 0x14000f9ee
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
jne 0x14000f38f
lea rax, str.m_hKey___0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1497
lea rdx, [0x140053e90]
lea ecx, [rdi + 2]
call fcn.14001e440
cmp eax, 1
jne 0x14000f38f
int3
lea rdx, [rsp + 0x260]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x14000f3ad
cmp eax, 2
jne 0x14000f9c9
test rbx, rbx
je 0x14000f3c3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], edi
mov rdx, rbp
mov rcx, rsi
call fcn.140009540
mov edi, eax
test eax, eax
js 0x14000fad9
mov rsi, qword [rsp + 0x50]
jmp 0x14000f989
mov rcx, rbp
movzx eax, byte [rbp]
test al, al
je 0x14000f412
cmp al, 0x5c
je 0x14000f409
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
mov al, byte [rax]
test al, al
jne 0x14000f3f4
jmp 0x14000f412
test rcx, rcx
jne 0x14000fa32
cmp dword [rsp + 0x68], 0
je 0x14000f5eb
mov r9d, 0x2001f
mov r8, rbp
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140008c00
test eax, eax
je 0x14000f549
mov r9d, 0x20019
mov r8, rbp
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140008c00
test eax, eax
je 0x14000f549
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x118], 0x590
mov qword [rsp + 0x20], rbp
lea r9, str.Creating_key__s_n
mov r8d, 2
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0x110]
call fcn.140008810
test rbx, rbx
jne 0x14000f4cd
lea rax, str.hKeyParent___0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x14c7
lea rdx, [0x140053e90]
lea ecx, [rbx + 2]
call fcn.14001e440
cmp eax, 1
jne 0x14000f4cd
int3
xor edi, edi
mov qword [rsp + 0xc0], rdi
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000fa4c
mov eax, edi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f52e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], edi
test eax, eax
jne 0x14000fa51
jmp 0x14000f54e
mov rsi, qword [rsp + 0x50]
mov rdx, rbp
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fb16
cmp byte [rbp], 0x3d
jne 0x14000f58b
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14000e970
mov edi, eax
test eax, eax
js 0x14000fa6f
cmp byte [rbp], 0x7b
jne 0x14000f984
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x14000f97d
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.14000efc0
mov edi, eax
test eax, eax
js 0x14000fb16
mov rdx, rbp
mov rcx, rbx
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fb16
jmp 0x14000f989
cmp dword [rsp + 0x12c0], 0
jne 0x14000f653
mov r9d, 0x20019
mov r8, rbp
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140008c00
mov ebx, eax
test eax, eax
jne 0x14000f658
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 0x5b3
mov qword [rsp + 0x20], rbp
lea r9, str.Opened_Key__s_n
lea r8d, [rbx + 1]
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0xd0]
call fcn.140008810
jmp 0x14000f6a0
mov ebx, 2
mov dword [rsp + 0x12c0], 1
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0x130], rax
mov dword [rsp + 0x138], 0x5b5
mov qword [rsp + 0x20], rbp
lea r9, str.Ignoring_Open_key_on__s_:_In_Recovery_mode_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0x130]
call fcn.140008810
or r9, 0xffffffffffffffff
mov r8, rbp
mov edx, 0x104
lea rcx, [rsp + 0x150]
call fcn.140022fa0
test eax, eax
je 0x14000f6e1
cmp eax, 0xc
je 0x14000fa8f
cmp eax, 0x16
je 0x14000fa84
cmp eax, 0x22
je 0x14000fa84
cmp eax, 0x50
jne 0x14000fa79
mov rdx, rbp
mov rcx, rsi
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fad2
mov rdx, rbp
mov rcx, rsi
call fcn.140009540
mov edi, eax
test eax, eax
js 0x14000facb
cmp byte [rbp], 0x7b
jne 0x14000f776
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x14000f76f
mov eax, dword [rsp + 0x12c0]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov rsi, qword [rsp + 0x50]
mov r8, rsi
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
call fcn.14000efc0
mov edi, eax
test eax, eax
jns 0x14000f756
cmp dword [rsp + 0x12c0], 0
je 0x14000fb16
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
call fcn.1400092d0
mov edi, eax
test eax, eax
js 0x14000fb16
jmp 0x14000f77b
mov rsi, qword [rsp + 0x50]
jmp 0x14000f77b
mov rsi, qword [rsp + 0x50]
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x12c0], eax
je 0x14000f7c4
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xe8], 0x5cd
lea r9, str.Ending_Recovery_Mode_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0xe0]
call fcn.140008810
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x12c0], eax
cmp ebx, 2
je 0x14000f989
test ebx, ebx
je 0x14000f7e5
test eax, eax
je 0x14000fa9a
jmp 0x14000f989
test eax, eax
je 0x14000f8a5
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call fcn.140009480
test eax, eax
je 0x14000f8a5
lea rbx, str.AppID
nop dword [rax]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000f989
add rbx, 8
lea rax, [0x1400527d0]
cmp rbx, rax
jl 0x14000f810
cmp dword [rsp + 0x6c], 0
je 0x14000f989
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], 0x5e7
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, str.Deleting_non_empty_subkey__s_by_force_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0x100]
call fcn.140008810
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009c70
mov rsi, qword [rsp + 0x50]
jmp 0x14000f989
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call fcn.140009480
mov ebx, eax
xor eax, eax
test rsi, rsi
je 0x14000f8cb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], 0
test eax, eax
jne 0x14000fab0
cmp dword [rsp + 0x6c], eax
je 0x14000f989
test ebx, ebx
jne 0x14000f989
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], 0x5f5
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, str.Deleting_Key__s_n
xor r8d, r8d
mov rdx, qword [0x14006e580]
lea rcx, [rsp + 0x120]
call fcn.140008810
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov dword [rsp + 0x98], ebx
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x90]
call fcn.140008b30
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x98], ebx
test eax, eax
jne 0x14000faa5
mov dword [rsp + 0x98], ebx
jmp 0x14000f989
mov rsi, qword [rsp + 0x50]
jmp 0x14000f989
mov rsi, qword [rsp + 0x50]
cmp byte [rbp], 0x7d
je 0x14000fb16
jmp 0x14000f080
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f9a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x14000fb26
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f9c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14000fb26
mov ecx, eax
call fcn.140008620
mov edi, eax
test rbx, rbx
je 0x14000fae7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov ecx, eax
call fcn.140008620
mov edi, eax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000fae0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000fa28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x14000fb26
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000fa42
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x14000fb26
mov rsi, qword [rsp + 0x50]
mov ecx, eax
call fcn.140008620
mov ebx, eax
test rsi, rsi
je 0x14000fa68
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14000fb26
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
mov ecx, ebx
call fcn.140008620
mov edi, eax
jmp 0x14000fb16
mov ecx, eax
call fcn.140008620
mov edi, eax
jmp 0x14000fb16
mov ecx, eax
call fcn.140008620
mov ebx, eax
test rsi, rsi
je 0x14000fac7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14000fb26
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
jmp 0x14000fb16
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x14000fb24
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x1260]
xor rcx, rsp
call fcn.14001f7f0
add rsp, 0x1278
pop rdi
pop rsi
pop rbp
pop rbx
ret