Function at 0x140105b70
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x90]
cmp dword [rcx + 4], 0
je 0x140105fa9
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140105fa9
cmp byte [rbx + 0x18], 0
jne 0x140105fa9
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140105fa9
mov rax, qword [rdi]
mov qword [rbp - 0x38], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x140105bf0
lock inc dword [rax]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x40]
call fcn.1401047d0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x28]
call fcn.140104f60
mov r14, rax
mov rcx, qword [rsi + 0x90]
xor r15d, r15d
cmp dword [rcx + 4], r15d
je 0x140105c45
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140105c45
cmp byte [rbx + 0x18], r15b
jne 0x140105c45
mov rcx, rbx
call fcn.140104b80
mov rdi, rax
jmp 0x140105c48
mov rdi, r15
mov ebx, dword [rsi + 0x9c]
mov qword [rbp - 0x30], r15
or ebx, 0x2001f
mov rcx, r14
call fcn.140022180
mov rdx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, r15
test eax, eax
cmove rbx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov eax, dword [rcx]
or edi, 0xffffffff
test eax, eax
je 0x140105ca5
cmp eax, edi
je 0x140105cb3
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105cb3
mov rcx, qword [rbp - 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
test rbx, rbx
je 0x140105d10
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140104e00
nop
mov rcx, rax
call fcn.140022180
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rcx, qword [rbp - 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140105cf9
cmp eax, 0xffffffff
je 0x140105d07
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105d07
mov rcx, qword [rbp - 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi + 0x90]
cmp dword [rcx + 4], 0
je 0x140105d44
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.140104b80
test rax, rax
je 0x140105d44
cmp byte [rbx + 0x18], 0
jne 0x140105d44
mov rcx, rbx
call fcn.140104b80
mov r14, rax
jmp 0x140105d47
mov r14, r15
mov ebx, dword [rsi + 0x9c]
mov qword [rbp - 0x18], r15
or ebx, 0x2001f
lea rcx, [rbp + 0x40]
call fcn.140022180
mov rdx, rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140105f7d
mov r14, qword [rbp - 0x18]
test r14, r14
je 0x140105f7d
mov edx, dword [rsi + 0x9c]
mov rcx, r14
call fcn.140104430
mov rax, qword [rbp + 0x40]
cmp dword [rax + 4], 0
jne 0x140105ef2
mov r8d, 1
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.1401037c0
nop
mov rcx, qword [rbp + 0x50]
lea r12, [rcx + 8]
movsxd rbx, dword [r12]
add rbx, 2
lea rbx, [rcx + rbx*8]
lea r13, [rcx + 0xc]
movsxd r15, dword [r13]
add r15, 2
lea r15, [rcx + r15*8]
cmp rbx, r15
je 0x140105e71
nop dword [rax]
mov rcx, rbx
call fcn.140022180
mov rdx, rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test eax, eax
je 0x140105e64
mov rcx, qword [rbx]
mov qword [rbp + 0x58], rcx
mov edx, dword [rcx]
inc edx
cmp edx, 1
jbe 0x140105e1d
lock inc dword [rcx]
lea rcx, [rbp + 0x58]
call fcn.140022180
mov r8, rax
lea rdx, [0x1402e41c8]
mov ecx, esi
call fcn.140010d50
nop
mov rcx, qword [rbp + 0x58]
mov eax, dword [rcx]
test eax, eax
je 0x140105e56
cmp eax, 0xffffffff
je 0x140105e64
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105e64
mov rcx, qword [rbp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
add rbx, 8
cmp rbx, r15
jne 0x140105df0
mov rcx, qword [rbp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x140105e8b
cmp eax, 0xffffffff
je 0x140105eed
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105eed
mov rcx, qword [rbp + 0x50]
movsxd rbx, dword [r13]
add rbx, 2
lea rbx, [rcx + rbx*8]
movsxd rsi, dword [r12]
add rsi, 2
lea rsi, [rcx + rsi*8]
cmp rsi, rbx
je 0x140105ee7
nop dword [rax + rax]
sub rbx, 8
mov rcx, qword [rbx]
mov eax, dword [rcx]
test eax, eax
je 0x140105ecd
cmp eax, 0xffffffff
je 0x140105ede
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105ede
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbx]
call fcn.14002cfa0
cmp rbx, rsi
jne 0x140105eb0
mov rcx, qword [rbp + 0x50]
call fcn.14002d690
nop
jmp 0x140105f73
lea rcx, [rbp + 0x40]
call fcn.140022180
mov rbx, rax
mov rcx, rsi
call fcn.1401068b0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x140105f73
mov rcx, qword [rbp + 0x40]
mov qword [rbp - 0x40], rcx
mov edx, dword [rcx]
inc edx
cmp edx, 1
jbe 0x140105f2c
lock inc dword [rcx]
lea rcx, [rbp - 0x40]
call fcn.140022180
mov r8, rax
lea rdx, [0x1402e4200]
mov ecx, ebx
call fcn.140010d50
nop
mov rcx, qword [rbp - 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140105f65
cmp eax, 0xffffffff
je 0x140105f73
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140105f73
mov rcx, qword [rbp - 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140105f99
cmp eax, 0xffffffff
je 0x140105fb6
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x140105fb6
mov rcx, qword [rbp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cfa0
jmp 0x140105fb6
mov edx, 1
mov rcx, rsi
call fcn.1400d99b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret