Function at 0x140004e50
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2398
call fcn.140008650
sub rsp, rax
mov qword [rsp + 0x148], 0xfffffffffffffffe
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x2380], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0xf0], eax
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004f08
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xd8], eax
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xd8]
jmp 0x140005ab5
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7d
je 0x140005a99
mov dword [rsp + 0x48], 1
mov rdx, qword [str.Delete]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004f47
mov dword [rsp + 0x70], 1
jmp 0x140004f4f
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x78], eax
mov rdx, qword [str.ForceRemove]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004f7b
cmp dword [rsp + 0x78], 0
je 0x1400051e2
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004fa0
jmp 0x140005a99
cmp dword [rsp + 0x23b8], 0
je 0x1400051e2
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x100], 0
cmp qword [rsp + 0x68], 0
jne 0x140005000
mov qword [rsp + 0x108], 0
jmp 0x140005051
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
test eax, eax
je 0x140005041
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
mov ecx, 0x5c
movzx ecx, cx
cmp eax, ecx
jne 0x14000502f
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x100], rax
jmp 0x140005041
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x68], rax
jmp 0x140005000
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x108], rax
cmp qword [rsp + 0x108], 0
je 0x14000508b
mov dword [rsp + 0xdc], 0x80020009
lea rcx, [rsp + 0x80]
call fcn.140002f10
nop
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xdc]
jmp 0x140005ab5
mov dword [rsp + 0x4c], 0
jmp 0x14000509f
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0xc
jge 0x1400050d4
movsxd rax, dword [rsp + 0x4c]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400050d2
mov dword [rsp + 0x74], 0
jmp 0x1400050dc
jmp 0x140005095
mov dword [rsp + 0x74], 1
cmp dword [rsp + 0x74], 0
je 0x140005158
xor eax, eax
test eax, eax
jne 0x1400050e3
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rdx, qword [rsp + 0x23a8]
lea rcx, [rsp + 0x80]
call fcn.1400044b0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
cmp dword [rsp + 0x78], 0
je 0x1400051d5
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005191
lea rcx, [rsp + 0x80]
call fcn.140002f10
jmp 0x140005a99
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400060e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400051c3
lea rcx, [rsp + 0x80]
call fcn.140002f10
jmp 0x140005a99
lea rcx, [rsp + 0x80]
call fcn.140002f10
jmp 0x1400059d0
lea rcx, [rsp + 0x80]
call fcn.140002f10
mov rdx, qword [str.NoRemove]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005228
mov dword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005228
jmp 0x140005a99
mov rdx, qword [0x140016190]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400054de
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000526a
jmp 0x140005a99
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000528f
jmp 0x140005a99
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x3d
je 0x1400052c0
mov dword [rsp + 0xe0], 0x80020009
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xe0]
jmp 0x140005ab5
cmp dword [rsp + 0x23b8], 0
je 0x1400053d4
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
xor eax, eax
test eax, eax
jne 0x1400052f1
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov r9, qword [rsp + 0x23a8]
lea r8, [rsp + 0x380]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140001f60
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
cmp dword [rsp + 0x40], 0
jge 0x1400053b0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xe4], eax
lea rcx, [rsp + 0xa8]
call fcn.140002f10
nop
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xe4]
jmp 0x140005ab5
lea rcx, [rsp + 0xa8]
call fcn.140002f10
jmp 0x1400059d0
cmp dword [rsp + 0x23c0], 0
jne 0x1400054b4
cmp dword [rsp + 0x48], 0
je 0x1400054b4
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x110]
call fcn.140003c70
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140005488
xor eax, eax
test eax, eax
jne 0x140005439
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140005486
cmp dword [rsp + 0x44], 2
je 0x140005486
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x110]
call fcn.140002f10
jmp 0x140005a99
jmp 0x1400054a7
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x110]
call fcn.140002f10
jmp 0x140005a99
lea rcx, [rsp + 0x110]
call fcn.140002f10
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400060e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400054d9
jmp 0x140005a99
jmp 0x140004f08
mov dx, 0x5c
mov rcx, qword [rsp + 0x23a8]
call fcn.140006220
test rax, rax
je 0x140005515
mov dword [rsp + 0xe8], 0x80020009
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xe8]
jmp 0x140005ab5
cmp dword [rsp + 0x23b8], 0
je 0x140005654
mov r9d, 0x2001f
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x50]
call fcn.140003c70
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400055ed
mov r9d, 0x20019
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x50]
call fcn.140003c70
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400055ed
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x50]
call fcn.140002f60
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400055ed
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0xec], eax
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xec]
jmp 0x140005ab5
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005612
jmp 0x140005a99
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x3d
jne 0x14000564f
mov r9, qword [rsp + 0x23a8]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x23a0]
call fcn.140001f60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000564f
jmp 0x140005a99
jmp 0x1400059d0
cmp dword [rsp + 0x23c0], 0
jne 0x140005684
mov r9d, 0x20019
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x50]
call fcn.140003c70
mov dword [rsp + 0x44], eax
jmp 0x14000568c
mov dword [rsp + 0x44], 2
cmp dword [rsp + 0x44], 0
je 0x14000569e
mov dword [rsp + 0x23c0], 1
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x23a8]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.14000c814
mov ecx, eax
call fcn.140002b80
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400056eb
jmp 0x140005a99
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400060e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005710
jmp 0x140005a99
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x1400057d9
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x98], 0xffffffffffffffff
inc qword [rsp + 0x98]
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x98]
cmp word [rax + rcx*2], 0
jne 0x140005740
mov rax, qword [rsp + 0x98]
cmp rax, 1
jne 0x1400057d9
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x23b8]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140004e50
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400057b4
cmp dword [rsp + 0x23c0], 0
jne 0x1400057b4
jmp 0x140005a99
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400057d9
jmp 0x140005a99
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x23c0], eax
cmp dword [rsp + 0x44], 2
jne 0x1400057f3
jmp 0x140004f08
cmp dword [rsp + 0x44], 0
je 0x14000581d
cmp dword [rsp + 0x23c0], 0
je 0x14000580b
jmp 0x140004f08
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0x40], eax
jmp 0x140005a99
cmp dword [rsp + 0x23c0], 0
je 0x140005884
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400034a0
test eax, eax
je 0x140005884
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x23a0]
call fcn.140002ca0
test eax, eax
je 0x14000587f
cmp dword [rsp + 0x48], 0
je 0x14000587f
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x50]
call fcn.1400044b0
jmp 0x140004f08
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400034a0
mov dword [rsp + 0xfc], eax
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400058e8
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0xf4], eax
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xf4]
jmp 0x140005ab5
cmp dword [rsp + 0x48], 0
je 0x1400059d0
cmp dword [rsp + 0xfc], 0
jne 0x1400059d0
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
xor eax, eax
test eax, eax
jne 0x140005924
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0xc0]
call fcn.140003110
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
cmp dword [rsp + 0x44], 0
je 0x1400059c3
mov ecx, dword [rsp + 0x44]
call fcn.140002c30
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0xc0]
call fcn.140002f10
jmp 0x140005a99
lea rcx, [rsp + 0xc0]
call fcn.140002f10
cmp dword [rsp + 0x23b8], 0
je 0x140005a94
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x140005a94
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0xa0], 0xffffffffffffffff
inc qword [rsp + 0xa0]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0xa0]
cmp word [rax + rcx*2], 0
jne 0x140005a0e
mov rax, qword [rsp + 0xa0]
cmp rax, 1
jne 0x140005a94
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x23b8]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140004e50
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005a72
jmp 0x140005a99
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140003970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005a94
jmp 0x140005a99
jmp 0x140004f08
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xf8], eax
lea rcx, [rsp + 0x50]
call fcn.140002f10
mov eax, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x2380]
xor rcx, rsp
call fcn.1400086c0
add rsp, 0x2398
ret