Function at 0x14006d1b0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x208], ebp
cmp byte [0x1400e3e01], bpl
je 0x14006d524
test bl, bl
je 0x14006d304
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14006c550
nop
mov byte [rsp + 0x208], 1
lea rcx, [rsp + 0x68]
call fcn.1400448e0
nop
mov dword [rsp + 0x30], 0x18
mov dword [rsp + 0x40], ebp
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov r9d, dword [rdi + 8]
or r9d, 0xf003f
lea rax, [rsp + 0x208]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r8, rsi
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.14006c0d0
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x88], rbp
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x80], rbp
mov rcx, qword [rsp + 0x78]
call fcn.140073030
mov rcx, qword [rsp + 0x70]
call fcn.140073030
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8b, 1
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14006ba90
test rax, rax
je 0x14006d2e5
nop
movzx r8d, bl
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14006d1b0
mov r8b, 1
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14006ba90
test rax, rax
jne 0x14006d2c0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14006d2fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x58]
call fcn.140073030
mov eax, dword [0x1400e66b0]
test al, 1
jne 0x14006d341
or eax, 1
mov dword [0x1400e66b0], eax
xor r9d, r9d
lea r8, str.RegDeleteKeyEx
lea rdx, str.advapi32
lea rcx, [0x1400e66a0]
call fcn.14004b920
lea rcx, [0x1400b4990]
call fcn.140075530
nop
cmp qword [0x1400e66a0], 0
je 0x14006d3c6
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], ebp
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140049000
nop
mov r8d, dword [rdi + 8]
and r8d, 0x300
xor r9d, r9d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdi]
call fcn.14006b2d0
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14006d3b7
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006d3bc
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14006d3bc
mov rcx, qword [rsp + 0x38]
call fcn.140073030
jmp 0x14006d489
test dword [rdi + 8], 0x300
je 0x14006d420
lea rax, [0x1400b59c8]
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa0], 0
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.RegDeleteKeyEx_not_available_and_view_is_not_default
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14001e6f0
lea rdx, [0x1400e0790]
lea rcx, [rsp + 0x98]
call fcn.140073110
int3
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], ebp
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140049000
nop
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14006d47f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006d484
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14006d484
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test ebx, ebx
je 0x14006d54e
lea rax, [0x1400b59c8]
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa0], 0
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.RegDeleteKey
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x98], r11
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x1a0]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x98]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x98]
call fcn.140073110
int3
mov r9d, 0xf5
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x98]
call fcn.140022960
mov rcx, rax
call fcn.140022860
int3
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret