Function at 0x1401e6f5e
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140014470
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140014530
add rsp, 0x10
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140014530
add rsp, 0x10
mov qword [rsp + 0x40], 0x20006
cmp qword [rsp + 0x88], 0
je 0x1401e6fdd
mov r15, qword [rsp + 0x40]
or r15, 0x200
mov qword [rsp + 0x40], r15
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140012a10
add rsp, 0x28
call fcn.140014750
movabs rcx, 0x14018c282
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014770
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400147a0
or rax, rax
je 0x1401e70ad
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012ab0
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140013360
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400143a0
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
mov r8, rax
movabs rdx, 1
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140013360
add rsp, 0x28
call fcn.140014750
movabs rcx, 0x14018c282
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140014770
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400147a0
or rax, rax
je 0x1401e717d
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140012ab0
add rsp, 0x28
dec rax
mov rdx, rax
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140012a10
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400143a0
mov r15, qword [rsp + 0x90]
and r15, r15
je 0x1401e71ae
movabs rax, 0x14018e8f0
mov r8, rax
movabs rdx, gethostname
mov rcx, qword [rsp + 0x90]
call fcn.1400139f0
sub rsp, 8
lea rax, [rsp + 0x50]
push rax
mov r9, qword [rsp + 0x50]
movabs r8, 0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401e7269
mov r15, qword [rsp + 0x90]
and r15, r15
je 0x1401e724f
push qword [rsp + 0x38]
mov rbp, qword [rsp + 0x98]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.1401e92a7
add rsp, 0x28
mov rbp, qword [rsp + 0x98]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.1400143a0
cmp qword [rsp + 0x48], 0
je 0x1401e7261
mov rcx, qword [rsp + 0x48]
call sub.ADVAPI32.dll_RegCloseKey
xor rax, rax
jmp 0x1401e7301
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call sub.ADVAPI32.dll_RegDeleteValueW
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x48]
call sub.ADVAPI32.dll_RegCloseKey
cmp qword [rsp + 0x38], 0
je 0x1401e72f5
mov r15, qword [rsp + 0x90]
and r15, r15
je 0x1401e72f0
push qword [rsp + 0x38]
mov rbp, qword [rsp + 0x98]
pop rax
mov dword [rbp + 8], eax
push rcx
sub rsp, 0x28
call fcn.140014710
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140014710
add rsp, 0x20
pop rcx
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.1401e92a7
add rsp, 0x28
mov rbp, qword [rsp + 0x98]
lea rcx, [rbp + 0xc]
pop rdx
call fcn.1400143a0
xor rax, rax
jmp 0x1401e7301
mov rax, 1
jmp 0x1401e7301
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140014650
add rsp, 0x28
pop rax
add rsp, 0x58
pop r15
pop rbp
ret