Function at 0x140006660
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x138]
sub rsp, 0x220
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x78], rsi
test rdx, rdx
je 0x140006ba2
mov eax, dword [0x140015b40]
cmp dword [rcx], eax
jne 0x1400066df
mov eax, dword [0x140015b44]
cmp dword [rcx + 4], eax
jne 0x1400066df
mov eax, dword [0x140015b48]
cmp dword [rcx + 8], eax
jne 0x1400066df
mov eax, dword [0x140015b4c]
cmp dword [rcx + 0xc], eax
je 0x140006ba2
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x140016338]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140015b30]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140006ba2
cmp dword [rbx], esi
je 0x140006761
nop
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
mov rcx, qword [rsp + 0x78]
lea r9, [rbp - 0x80]
mov r8d, 1
mov rdx, rdi
mov rax, qword [rcx]
test r14d, r14d
je 0x14000674c
cmp dword [rbx], r8d
jne 0x14000673f
call qword [rax + 0x28]
jmp 0x140006742
call qword [rax + 0x38]
test eax, eax
js 0x140006ba4
jmp 0x140006759
cmp dword [rbx], 1
jne 0x140006756
call qword [rax + 0x30]
jmp 0x140006759
call qword [rax + 0x40]
add rbx, 0x10
cmp dword [rbx], esi
jne 0x140006710
test r14d, r14d
jne 0x140006ba6
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov ecx, esi
test eax, eax
setne cl
test ecx, ecx
jne 0x140006791
lea eax, [rcx + 0xd]
jmp 0x140006ba4
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
je 0x1400067e0
cmp eax, 0xc
je 0x1400067d5
cmp eax, 0x16
je 0x1400067ca
cmp eax, 0x22
je 0x1400067ca
cmp eax, 0x50
je 0x1400067e0
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x14000682f
cmp eax, 0xc
je 0x140006824
cmp eax, 0x16
je 0x140006819
cmp eax, 0x22
je 0x140006819
cmp eax, 0x50
je 0x14000682f
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x14000687e
cmp eax, 0xc
je 0x140006873
cmp eax, 0x16
je 0x140006868
cmp eax, 0x22
je 0x140006868
cmp eax, 0x50
je 0x14000687e
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
mov rbx, rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ?getSubstituteFont@AcDbHostApplicationServices@@UEAA_NPEAPEA_WPEB_WHH@Z
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006983
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14000690d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x140006983
cmp dword [rsp + 0x70], esi
jne 0x140006983
cmp byte [0x140023810], sil
jne 0x14000695c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000694c
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023808], rax
jmp 0x140006953
mov rax, qword [0x140023808]
mov byte [0x140023810], 1
jmp 0x140006963
mov rax, qword [0x140023808]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x14000697d
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x140006983
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
je 0x1400069d2
cmp eax, 0xc
je 0x1400069c7
cmp eax, 0x16
je 0x1400069bc
cmp eax, 0x22
je 0x1400069bc
cmp eax, 0x50
je 0x1400069d2
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x140006a21
cmp eax, 0xc
je 0x140006a16
cmp eax, 0x16
je 0x140006a0b
cmp eax, 0x22
je 0x140006a0b
cmp eax, 0x50
je 0x140006a21
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x140006a70
cmp eax, 0xc
je 0x140006a65
cmp eax, 0x16
je 0x140006a5a
cmp eax, 0x22
je 0x140006a5a
cmp eax, 0x50
je 0x140006a70
mov ecx, 0x80004005
call fcn.140006c00
int3
mov ecx, 0x80070057
call fcn.140006c00
int3
mov ecx, 0x8007000e
call fcn.140006c00
int3
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ?getSubstituteFont@AcDbHostApplicationServices@@UEAA_NPEAPEA_WPEB_WHH@Z
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006ab2
mov eax, esi
test rbx, rbx
je 0x140006aad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
cdqe
test rax, rax
jne 0x140006b85
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x140006b0f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x140006b85
cmp dword [rsp + 0x70], esi
jne 0x140006b85
cmp byte [0x140023810], sil
jne 0x140006b5e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006b4e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023808], rax
jmp 0x140006b55
mov rax, qword [0x140023808]
mov byte [0x140023810], 1
jmp 0x140006b65
mov rax, qword [0x140023808]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x140006b7f
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x140006b85
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x140006b93
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006ba6
mov eax, esi
mov esi, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140006bb7
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov eax, esi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140012970
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret