Function at 0x14003ead0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rbp + 0x680], rax
movaps xmm0, xmmword [0x140206820]
movaps xmm1, xmmword [0x140206830]
mov eax, 0xf713
mov word [rsp + 0x64], ax
mov rax, qword [str.mswebhlp]
mov rbx, rcx
mov qword [rsp + 0x70], rax
movzx eax, byte [0x140206810]
lea rdx, [rbp + 0x480]
movaps xmmword [rbp + 0x30], xmm0
movaps xmm0, xmmword [0x140206840]
movaps xmmword [rbp + 0x40], xmm1
mov byte [rsp + 0x78], al
movabs rax, 0x6c706b6d6c7275
lea rcx, [rsp + 0x60]
movaps xmm1, xmmword [0x140206850]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x1402067c0]
mov qword [rbp - 0x80], rax
mov eax, dword [0x140206860]
mov r8d, 0x200
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x1402067d0]
movaps xmmword [rbp - 0x70], xmm0
mov dword [rbp + 0x70], eax
mov eax, dword [0x140206800]
mov dword [rsp + 0x60], 0xdeca39c1
movaps xmm0, xmmword [0x1402067e0]
movaps xmmword [rbp - 0x60], xmm1
movaps xmm1, xmmword [0x1402067f0]
mov dword [rbp - 0x30], eax
movzx eax, byte [0x140206804]
mov dword [rsp + 0x66], 0x99ba11d2
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x140206770]
movaps xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x2c], al
mov eax, dword [0x1402067b0]
mov dword [rsp + 0x6a], 0xe9c88000
movaps xmm1, xmmword [0x140206780]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x140206790]
mov dword [rbp + 0x20], eax
movzx eax, word [0x1402067b4]
mov word [rsp + 0x6e], 0x1a49
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x1402067a0]
movaps xmmword [rbp], xmm0
mov word [rbp + 0x24], ax
movaps xmmword [rbp + 0x10], xmm1
call fcn.1400c8cb0
lea rdx, str.CLSID_s
lea rcx, [rbp + 0x280]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x280]
xor r8d, r8d
mov rcx, 0xffffffff80000000
call fcn.1400d3390
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
lea rdx, [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14003ecb6
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.1400c8cb0
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
lea rdx, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14003ed26
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.1400c8cb0
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
mov rcx, rbx
call fcn.14003e280
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, [rbp - 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14003ed9d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret