Function at 0x1000071b8
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x22e8
call fcn.100011dc0
sub rsp, rax
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x22d0], rax
mov rax, rcx
mov qword [rsp + 0x68], rcx
mov ecx, dword [rsp + 0x2330]
xor ebp, ebp
mov dword [rsp + 0xb0], ecx
mov rcx, rax
mov rbx, rbp
mov dword [rsp + 0x74], r9d
mov qword [rsp + 0x78], r8
mov rsi, rdx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x80], rbx
call fcn.10000702c
cmp eax, ebp
mov edi, eax
jl 0x1000079ac
cmp word [rsi], 0x7d
je 0x1000079aa
mov eax, 1
lea rdx, [0x100001b00]
mov rcx, rsi
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
cmp eax, edi
lea rdx, [0x100001b28]
mov rcx, rsi
mov ebp, edi
sete bpl
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x100007277
cmp ebp, edi
je 0x100007356
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
cmp dword [rsp + 0x74], edx
je 0x100007354
movzx eax, word [rsi]
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
mov rcx, rsi
jmp 0x1000072ce
cmp ax, 0x5c
je 0x1000072d5
call qword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
mov rcx, rax
mov ax, word [rax]
cmp ax, dx
jne 0x1000072ba
jmp 0x1000072de
cmp rcx, rdx
jne 0x1000079c8
lea rdi, [0x100001b90]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100007322
lea rax, [0x100001bf0]
add rdi, 8
cmp rdi, rax
jl 0x1000072e5
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x98]
mov rdx, rsi
mov qword [rsp + 0x98], rax
call fcn.100006e2c
xor edi, edi
cmp ebp, edi
je 0x100007356
mov rbp, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
mov rdx, rsi
mov rcx, rbp
call fcn.100006d84
jmp 0x100007632
xor edi, edi
lea rdx, [0x100001b10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rbp, qword [rsp + 0x68]
cmp eax, edi
jne 0x10000738c
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x70], edi
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
xor edi, edi
lea rdx, [0x100001b40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x1000074b2
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
mov rdx, rsi
mov rcx, rbp
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
cmp word [rsi], 0x3d
jne 0x1000079c8
cmp dword [rsp + 0x74], edx
je 0x100007424
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0x98]
mov r9, rsi
mov rcx, rbp
mov qword [rsp + 0x98], rax
call fcn.100006910
jmp 0x100007632
cmp dword [rsp + 0x2330], edx
jne 0x100007496
cmp dword [rsp + 0x70], edx
je 0x100007496
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
jne 0x100007991
mov rbp, qword [rsp + 0x60]
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x100007483
cmp eax, 2
jne 0x1000079dd
cmp rbp, rdi
je 0x100007491
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.100006d84
xor edx, edx
mov edi, eax
cmp eax, edx
jl 0x10000799c
jmp 0x1000078bf
movzx eax, word [rsi]
mov rcx, rsi
jmp 0x1000074cc
cmp ax, 0x5c
je 0x1000074d3
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
cmp ax, di
jne 0x1000074ba
jmp 0x1000074dc
cmp rcx, rdi
jne 0x1000079f8
cmp dword [rsp + 0x74], edi
je 0x100007693
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x10000753c
mov eax, ecx
cmp rbx, rcx
je 0x100007527
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, ecx
je 0x1000075f7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100007589
mov eax, ecx
cmp rbx, rcx
je 0x100007578
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, ecx
je 0x1000075f7
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x60], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edi, edi
cmp eax, edi
jne 0x1000079fd
mov eax, edi
cmp rbx, rdi
je 0x1000075e2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, edi
jne 0x1000079fd
mov rdx, rsi
mov rcx, rbp
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
cmp word [rsi], 0x3d
jne 0x10000763e
lea rdx, [rsp + 0x80]
mov r9, rsi
xor r8d, r8d
mov rcx, rbp
call fcn.100006910
mov rbx, qword [rsp + 0x80]
xor edx, edx
mov edi, eax
cmp eax, edx
jl 0x10000799c
cmp word [rsi], 0x7b
jne 0x1000078bf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x1000078bd
mov r9d, dword [rsp + 0x74]
xor eax, eax
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.1000071b8
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
mov rdx, rsi
mov rcx, rbp
call fcn.10000702c
jmp 0x1000074a1
mov edi, dword [rsp + 0x2330]
xor eax, eax
cmp edi, eax
jne 0x1000076f1
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jne 0x1000076f8
mov ebp, eax
cmp rbx, rax
je 0x1000076e2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
jmp 0x1000076f6
mov ebp, 2
cmp ebp, eax
mov eax, 1
lea rcx, [rsp + 0xc0]
mov r8, rsi
cmovne edi, eax
or r9, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0x2330], edi
call sub.msvcrt.dll_wcsncpy_s
xor ecx, ecx
cmp eax, ecx
je 0x10000774a
cmp eax, 0xc
je 0x100007a23
cmp eax, 0x16
je 0x100007a18
cmp eax, 0x22
je 0x100007a18
cmp eax, 0x50
jne 0x100007a0d
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.100006d84
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
cmp word [rsi], 0x7b
jne 0x1000077e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x1000077e2
mov eax, dword [rsp + 0x2330]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov dword [rsp + 0x20], eax
call fcn.1000071b8
xor edx, edx
cmp eax, edx
mov edi, eax
jge 0x1000077c7
cmp dword [rsp + 0x2330], edx
je 0x10000799c
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.10000702c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x10000799c
jmp 0x1000077e4
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x2330], eax
cmp ebp, 2
je 0x1000078bf
cmp ebp, edx
je 0x10000780e
cmp eax, edx
jne 0x1000078bf
mov ecx, ebp
jmp 0x100007993
cmp eax, edx
je 0x1000078ce
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
jne 0x1000078ce
cmp dword [rsp + 0x60], edx
mov eax, edx
seta al
cmp eax, edx
je 0x1000078ce
lea rbp, [0x100001b90]
mov rdx, qword [rbp]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x1000078bf
lea rax, [0x100001bf0]
add rbp, 8
cmp rbp, rax
jl 0x100007872
cmp dword [rsp + 0x70], edx
je 0x1000078bf
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.100006e2c
mov rbx, qword [rsp + 0x80]
xor edx, edx
cmp word [rsi], 0x7d
je 0x10000799c
jmp 0x100007238
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
mov ebp, edx
cmp eax, edx
jne 0x100007920
cmp dword [rsp + 0x60], edx
seta bpl
cmp rbx, rdx
je 0x100007943
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rbx, rdx
mov qword [rsp + 0x80], rdx
cmp eax, edx
jne 0x100007a2e
cmp dword [rsp + 0x70], edx
je 0x1000078bf
cmp ebp, edx
jne 0x1000078bf
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x98], rax
call fcn.100006f68
xor edx, edx
cmp eax, edx
je 0x1000078bf
mov ecx, eax
call fcn.100007018
mov edi, eax
xor edx, edx
cmp rbx, rdx
je 0x1000079aa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x22d0]
xor rcx, rsp
call fcn.1000115c0
add rsp, 0x22e8
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rbx, rdx
je 0x1000079d6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x1000079ac
mov ecx, eax
call fcn.100007018
xor edx, edx
mov edi, eax
cmp rbp, rdx
je 0x10000799c
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000799a
cmp rbx, rdi
jmp 0x1000079cb
mov ecx, eax
call fcn.100007018
mov edi, eax
xor eax, eax
cmp rbx, rax
jmp 0x10000799f
mov ecx, 0x80004005
call fcn.100006d54
int3
mov ecx, 0x80070057
call fcn.100006d54
int3
mov ecx, 0x8007000e
call fcn.100006d54
int3
mov ecx, eax
call fcn.100007018
jmp 0x1000079ac