Function at 0x14003e700
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rbp + 0x48], rax
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003e74e
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___Enter
call fcn.140034cf0
lea rcx, [rbp - 0x48]
call fcn.140021830
nop
mov r12, 0xffffffffffffffff
cmp byte [rbp - 0x38], 1
je 0x14003e78a
movzx eax, byte [0x1401b5780]
cmp al, 5
ja 0x14003ee02
lea edx, [r12 + 6]
lea rcx, str.clean_partnershared_reg_hive___failed_to_get_config_object
call fcn.140034cf0
jmp 0x14003ee02
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
lea rdx, str.default_email_deletion
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], 0x16
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x28]
mov rax, qword [rax + 0x10]
call qword [case.0x14000cca5.0]
nop
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
xor r13d, r13d
mov qword [rbp - 0x70], r13
mov rax, qword [rbp - 0x28]
lea rcx, str.registry
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 8
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x28]
mov rax, qword [rax + 0x80]
call qword [case.0x14000cca5.0]
mov r15, qword [rbp - 0x80]
cmp r15, qword [rbp - 0x78]
je 0x14003ed7a
lea rax, str.Software
mov qword [rsp + 0x20], rax
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x14003e823
mov rdx, qword [r15]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14003e840
lea rcx, [rbp - 0x68]
call fcn.140002fb0
nop
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003e87f
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive__Registry_path__s
call fcn.140034cf0
lea r11, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
setae r14b
mov rsi, qword [rbp - 0x68]
cmovae r11, rsi
mov rbx, qword [rbp - 0x58]
cmp rbx, 8
jb 0x14003ed19
lea rdi, [rbx - 7]
lea rdi, [r11 + rdi*2]
mov rcx, r11
nop dword [rax]
mov rax, rdi
sub rax, rcx
sar rax, 1
mov rdx, r13
je 0x14003e8da
cmp word [rcx], 0x53
je 0x14003e8d7
cmp rax, 1
je 0x14003e8da
dec rax
add rcx, 2
cmp word [rcx], 0x53
jne 0x14003e8c4
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14003ed19
mov r9d, 8
lea rax, str.Software
movzx edx, word [rdx]
mov r8d, 0x53
cmp dx, r8w
jb 0x14003e92c
mov r10, rcx
sub r10, qword [rsp + 0x20]
cmp dx, r8w
ja 0x14003e92c
cmp r9, 1
je 0x14003e935
dec r9
add rax, 2
movzx edx, word [rax + r10]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14003e90e
add rcx, 2
jmp 0x14003e8b0
sub rcx, r11
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14003ed19
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
cmp rbx, rcx
jb 0x14003ee96
mov qword [rbp - 0x30], rbx
mov rax, rbx
sub rax, rcx
cmp rax, rbx
cmovb rbx, rax
lea rax, [rbp - 0x68]
test r14b, r14b
cmovne rax, rsi
lea rdx, [rax + rcx*2]
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.140002fb0
nop
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003e9c2
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive__subkey_path__s
call fcn.140034cf0
lea r11, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r11, qword [rbp - 0x68]
mov rax, qword [rbp - 0x58]
cmp rax, 0x11
jb 0x14003eb5c
add rax, 0xfffffffffffffff0
lea rbx, [r11 + rax*2]
mov rax, r11
lea rdi, [0x14016c7c8]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov rdx, r13
je 0x14003ea1a
cmp word [rax], 0x48
je 0x14003ea17
cmp rcx, 1
je 0x14003ea1a
dec rcx
add rax, 2
cmp word [rax], 0x48
jne 0x14003ea04
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14003eb5c
mov r9d, 0x11
mov rcx, rdi
movzx edx, word [rdx]
mov r8d, 0x48
cmp dx, r8w
jb 0x14003ea66
mov r10, rax
sub r10, rdi
cmp dx, r8w
ja 0x14003ea66
cmp r9, 1
je 0x14003ea6c
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14003ea48
add rax, 2
jmp 0x14003e9f0
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14003eb5c
lea rax, vtable.NEXS::session_api.0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140018cf0
test eax, eax
jne 0x14003eca4
lea rdx, [rsp + 0x48]
mov ecx, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
movzx eax, byte [0x1401b5780]
jne 0x14003ec69
cmp al, 6
ja 0x14003ead3
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___RegOpenCurrentUser_success.
call fcn.140034cf0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003eb18
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003eb18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___RegDeleteKey_failed_with_error___d
call fcn.140034cf0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003eb40
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___registry_hive_clean_up_success
call fcn.140034cf0
nop
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 0x10]
call qword [case.0x14000cca5.0]
nop
jmp 0x14003ebc0
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003eb78
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___going_to_delete_HKLM_partner_hive
call fcn.140034cf0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003ebc0
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003ebc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___RegDeleteKey_failed_with_error___d
call fcn.140034cf0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14003ec02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ebfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ee8a
call fcn.140074f80
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14003ec56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ec51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ee90
call fcn.140074f80
add r15, 0x20
cmp r15, qword [rbp - 0x78]
je 0x14003ed76
jmp 0x14003e816
cmp al, 5
ja 0x14003ec88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, 5
lea rcx, str.clean_partnershared_reg_hive_RegOpenCurrentUser_failed__d
call fcn.140034cf0
nop
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 0x10]
call qword [case.0x14000cca5.0]
nop
jmp 0x14003ecc1
movzx eax, byte [0x1401b5780]
cmp al, 5
ja 0x14003ecc1
mov edx, 5
lea rcx, str.clean_partnershared_reg_hive__get_impersonated_logged_on_user_token_failed
call fcn.140034cf0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14003ed03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ecfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ee84
call fcn.140074f80
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
jmp 0x14003ed36
movzx eax, byte [0x1401b5780]
cmp al, 6
ja 0x14003ed36
mov edx, 6
lea rcx, str.clean_partnershared_reg_hive___Software_key_not_found
call fcn.140034cf0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14003ed76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ed71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ee9c
call fcn.140074f80
mov r15, qword [rbp - 0x80]
test r15, r15
je 0x14003ede1
mov rbx, qword [rbp - 0x78]
cmp r15, rbx
je 0x14003ed9d
mov rcx, r15
call fcn.14000d700
add r15, 0x20
cmp r15, rbx
jne 0x14003ed88
mov r15, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x70]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x14003edcd
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ee7e
mov rcx, r15
call fcn.140074f80
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
movzx ecx, byte [rbp + 0x40]
test ecx, ecx
je 0x14003ee02
cmp ecx, 1
jne 0x14003ee02
mov rax, qword [rbp - 0x28]
xor edx, edx
lea rcx, [rbp - 0x28]
mov rax, qword [rax]
call qword [case.0x14000cca5.0]
nop
movzx ecx, byte [rbp - 0x38]
test ecx, ecx
je 0x14003ee51
cmp ecx, 1
jne 0x14003ee51
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x14003ee51
mov eax, r12d
lock xadd dword [rbx + 8], eax
cmp eax, ecx
jne 0x14003ee51
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14000cca5.0]
nop
lock xadd dword [rbx + 0xc], r12d
cmp r12d, 1
jne 0x14003ee51
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14000cca5.0]
nop
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400fb890
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140103230
nop
call fcn.140103230
int3
call fcn.140103230
nop
call fcn.140103230
nop
call fcn.14000ddc0
nop
call fcn.140103230
int3